Integrating Knowledge Management and Quality Risk Management
ISPE held an Expert Xchange on 18 January 2022 entitled “Risk-Based Decision Making: Advancing the Integration of Quality Risk Management (QRM) and Knowledge Management (KM).” The session included presentations and interactive exercises that generated new and useful insights into the current effectiveness of the knowledge that flows into QRM and how a knowledge map can be used to diagnose opportunities to improve KM. The exercises also helped identify the types of knowledge generated during QRM. These insights demonstrated the opportunity to improve risk-based decision-making (RBDM) by uniting risk and knowledge through a suitable framework such as the Risk-Knowledge Infinity (RKI) Cycle.
The session was facilitated by the Pharmaceutical Regulatory Science Team (PRST) in Technical University (TU) Dublin, which presented introductory material to highlight the emphasis on knowledge and KM in the draft International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH) ICH Q9(R1) guideline.
This article provides a summary of the presentations and concepts introduced in the session, data gathered during the session, and a preliminary analysis of these data. The genesis of the session was based on work by the PRST in TU Dublin, who identified through research studies the need to intentionally connect QRM and KM as united enablers of the PQS envisioned by ICH Q10.
Benefits to connecting QRM and KM include supporting the primary objectives of ICH Q10, including achieving product realization, establishing and maintaining a state of control, and facilitating continual improvement. Additional benefits were identified in a survey of industry and regulatory authorities:
In response, the RKI Cycle was developed by PRST researchers as a framework to unite QRM and KM.
Concurrently, ICH Q9 has been undergoing revision with the aim to provide clearer guidance on several topics, including RBDM. A draft revision of the updated guideline, ICH Q9(R1), has been issued for public review.
The three-hour session in the ISPE Expert Xchange
| Section | Reference in draft ICH Q9(R1) text (emphasis in bold added by the authors) |
|---|---|
| Introduction | “In the development phase, quality risk management is part of building knowledge and understanding risk scenarios, so that appropriate risk control can be decided upon during technology transfer, for use during the commercial manufacturing phase. In this context, knowledge is used to make informed risk-based decisions, trigger re-evaluations, and stimulate continual improvements.” |
| Section 4.3, Subjectivity in QRM |
“While subjectivity cannot be completely eliminated from quality risk management activities, it may be controlled by addressing bias, the proper use of quality risk management tools, and maximising the use of relevant data and sources of knowledge.” “Decision makers should… assure that a quality risk management process is defined, deployed and reviewed and that adequate resources and knowledge |
| Section 5.1, Formality in QRM |
“The term ‘uncertainty’ in quality risk management means lack of knowledge about risks. The level of uncertainty that is associated with the area being risk assessed informs how much formality may be required to manage potential risks. Systematic approaches for acquiring, analysing, storing and disseminating scientific information are essential for generating knowledge, which in turn informs all quality risk management activities. Uncertainty may be reduced via effective knowledge management, which enables accumulated and new information (both internal and external) to be used to support risk-based decisions throughout the lifecycle.”
|
| Section 5.2 regarding Risk- Based Decision Making |
“Approaches to risk-based decision-making are beneficial, because they address uncertainty through the use of knowledge, facilitating informed decisions by regulators and the pharmaceutical industry in a multitude of areas, including when allocating resources. They also help recognize where uncertainty remains, so that appropriate risk controls (including improved detectability) may be identified to enhance understanding of those variables and further reduce the level of uncertainty.”
|
| Chapter 6 on Product Availability Risks |
“An effective pharmaceutical quality system drives both supply chain robustness and sustainable GMP compliance. It also uses quality risk management and knowledge management to provide an early warning system that supports effective oversight and response to evolving quality/manufacturing risks from the pharmaceutical company or its external partners.”
|
| Chapter 7, definition of Risk-Based Decision Making |
“Risk-based Decision Making: An approach or process that considers knowledge about risks relevant to the decision and whether risks are at an acceptable level.” |
| Annex II.9 on the application of QRM to Supply Chain Control |
“With regard to product availability risks related to quality/manufacturing issues, life cycle oversight of the supply chain includes maintaining current knowledge of quality/manufacturing hazards and prioritizing efforts to manage such risks. Understanding hazards to quality/manufacturing is critical to maintaining supply predictability. When risks are well understood and minimized, a higher confidence in product availability can be attained.” |
Knowledge and KM in the Draft ICH Q9(R1)
Kevin O’Donnell of the Health Products Regulatory Authority (HPRA, Ireland) and Rapporteur of ICH Q9(R1) presented on knowledge and KM concepts in the draft ICH Q9(R1) guidance
O’Donnell noted this statement in the published ICH Informational Presentation on the revision:
Notably, there are 23 references to the word “knowledge” in the draft ICH Q9(R1) guideline,
An Introduction to the RKI Cycle
Martin Lipa, Pharmaceutical Regulatory Science Researcher with the PRST, presented “An Introduction to the RKI Cycle, Rethinking the Connection Be-tween QRM and KM,” which highlighted the purpose of QRM and KM as dual PQS enablers. Lipa noted that knowledge and risk have an inverse relationship such that the more one knows and understands, the less uncertainty there is, and this presents an opportunity for risk reduction. Lipa introduced a framework linking risk and knowledge, the RKI Cycle, as depicted in Figure 1.
![Figure 1: The RKI Cycle [4]. (Used with permission. © 2020 Lipa & O’Donnell. All rights reserved.)](/sites/default/files/2022-06/0722_PE_JA_CoverStory_01.jpg)
![F igure 2: The RKI Cycle applied to ICH Q10 [4]. (Used with permission. © 2020 Lipa & O’Donnell. All rights reserved.)](/sites/default/files/2022-06/0722_PE_JA_CoverStory_02%20copy.jpg)
The RKI Cycle is based on the following key concepts:
- Knowledge is both an input to and an output from risk management.
- Knowledge has an inverse relationship with risk (for the purpose of these concepts, risk is used to describe collective actions associated with risk including risk analysis, control, communication, decisions).
- The concept of flow; knowledge flows effortlessly and on demand to inform risk, and risk informs new knowledge.
- The cycle is continuous and perpetual; knowledge is always evolving and should be continually applied to inform risk.
- The cycle applies across the product life cycle.
Lipa then described how the RKI Cycle could be applied to ICH Q10,
Lipa concluded by sharing research findings that reported 90% of a targeted population composed of industry, regulator, and academia experts surveyed (n = 32) agreed that deploying such a framework would improve QRM/KM integration, resulting in the benefits of more data-driven risk assessments, better risk-based decisions, and increased ability to leverage prior knowledge.
![Figure 3: Characteristics of RBDM from HROs [13]. (Used with permission. © 2021 Mulholland & Greene. All rights reserved.)](/sites/default/files/2022-06/0722_PE_JA_CoverStory_03.jpg)
The Role of QRM in RBDM
Valerie Mulholland, Pharmaceutical Regulatory Science Researcher with the PRST, shared her perspectives in “Effective Risk-Based Decision Making in the PQS–The Next Horizon in QRM.” Mulholland cited the ICH Q9(R1) concept paper,
Mulholland explored the concept of RBDM in the draft ICH Q9(R1) guideline
Mulholland discussed the concept of formality, one of four primary revision topics of ICH Q9(R1),
Mulholland shared the results from a poll conducted at the opening of the Expert Xchange session, which asked participants whether they had a formal definition for RBDM in their PQS. Only 19% indicated they have a formal definition, 38% said there is no formal definition, and 44% reported they are not sure or do not know.
Participants were asked whether their organizations have formal procedures or tools to support RBDM in their PQS: 14% reported no formal tools for RBDM, 63% indicated they had some formal tools adequate for low-complexity RBDM, and 23% reported they had tools adequate for high-complexity RBDM.
The presentation then introduced additional insights, including recently published research examining the definition and characteristics of RBDM from a variety of high-reliability organizations (HROs), which resulted in identifying 21 characteristics of RBDM,
Of the 21 characteristics, only 5 are commonly addressed by QRM processes, whereas up to 8 additional characteristics could be addressed with KM processes.
Mulholland concluded by recognizing the role of knowledge in decision-making, whether it be for complex scenarios or more predictable and rule-based situations. Furthermore, it was suggested that effective RBDM is often based on the use of effective QRM and KM, and that decision-makers need to fully understand complexity and uncertainty when making important decisions with respect to risk.
Exploring RKI Cycle Node 1
Node 1 of the RKI Cycle is premised on the assumption that “best available knowledge flows into QRM.” The presenters noted that an array of guidance, including ICH Q8(R2), Q9, and Q10,
- What could go wrong?
- How likely is it to happen?
- If it does happen, will you be able to detect it?
In addition, based on practices beyond the pharmaceutical industry,
- How sure are you [of the answers to 1–3]? How sure do you need to be? Is the result suitable?
| Regulatory Requirements |
PQS Knowledge | Project Capability | QRM Knowledge |
|---|---|---|---|
|
|
|
|
| Product Knowledge | Process Knowledge | |
|---|---|---|
|
|
|
Linking to the intent of node 1 to apply the “best knowledge to QRM,” the presenters posed these questions:
- How will you ensure you apply the best knowledge, experience, know-how, expertise, and prior knowledge to perform an optimal risk assessment and support the best possible risk-based decision?
- Is the most current knowledge visible, available, and accessible on demand?
- Is the knowledge of sufficient quality for use?
- What are you missing?
The presenters then introduced the concept of knowledge mapping
Knowledge Inputs to QRM
A key input to a knowledge map is understanding the knowledge inputs to a process. For example, taking a typical commissioning and qualification scenario, the authors identified potential sources of knowledge to support the associated QRM (and consequentially RBDM).
Exercise 1: Knowledge Map Case Study
As an illustration, the presenters introduced a knowledge mapping case study for the installation of an autoclave. Most (52) of the aggregated list of 57 knowledge inputs in Figure 4 were considered relevant to the risk assessment of an autoclave installation. A subset of these inputs was selected to illustrate the knowledge mapping process.
The instructions for knowledge mapping were introduced using a simplified knowledge map template,
Explicit knowledge was defined as codified knowledge (i.e., something written down in a document, a video, or an image), whereas tacit knowledge was defined as the knowledge in people’s heads (i.e., know-how, experience, expertise).
Knowledge flow was defined as to whether the knowledge was available and accessible on demand. Knowledge quality was defined as the knowledge being reliable for intended use, having sufficient context and rationale, and being complete and accurate.
The facilitators presented an example and mapped five knowledge inputs, covering both types of explicit and tacit knowledge. The first three knowledge inputs were mapped using an interactive poll designed to solicit perspectives from the participants to illustrate the current state of process knowledge on design and validation documents for facilities and utilities; prior knowledge/lessons learned from attendees or other sites; and routes for contamination/contamination control.
Two additional inputs were mapped in the session through an exchange of dialogue between facilitators (Mulholland as QRM expert and Lipa as KM expert), designed to illustrate to the participants the deeper thinking and discussions that should occur during a knowledge mapping exercise. These inputs were product/process knowledge; QRM documents from product/process development; and process knowledge: system integration requirements (e.g., manufacturing execution systems, electronic batch records, building management system).
Knowledge Map Results and Key Insights
Almost all attendees provided responses for the first three knowledge inputs. Although the sample size was small, the results are in line with Lipa’s previous experience. The authors propose the following insights:
- The flow and quality of explicit knowledge are markedly higher than that of tacit knowledge.
- Although results for explicit knowledge flow and quality fared better than that of tacit knowledge, there is clearly an opportunity for improvement, as on average just over half of respondents rated flow and quality as excellent, with a substantial percentage rated as only marginal or poor.
- Tacit knowledge flow received the lowest ratings, suggesting this may be an area for focus and improvement.
- Participants rated communication and lessons learned between sites as poor.
- There was a concerning marginal/poor rating of both tacit and explicit knowledge flow and quality, given the process importance of the equipment application and its role in the contamination control strategy, suggesting that even for critical processes, there may be gaps in information quality and reliability.
Knowledge Mapping: Potential Value for QRM
At the completion of the activity, the participants were asked to reflect on the utility of knowledge mapping as demonstrated through the case study exercise. They were asked the following questions via a survey about knowledge mapping.
In response to the first question, “Does knowledge mapping help you think more expansively about QRM knowledge?,” 97% of participants agreed or strongly agreed that it does.
Additional responses to other questions suggest that knowledge mapping has a significant potential utility in supporting QRM: 93% agreed that knowledge mapping can help recognize gaps in explicit knowledge; 86% agreed that knowledge mapping can help recognize gaps in tacit knowledge; 83% agreed that knowledge mapping can be used as a template or checklist to support QRM; and 97% agreed that knowledge mapping can highlight opportunities to improve KM.
Finally, the participants were asked what other three applications (e.g., processes) might benefit from knowledge mapping. Figure 5 suggests recognition of the opportunity for knowledge mapping to benefit change control, technology transfer, deviation management and investigations, and CQV (commissioning, qualification, and validation). This demonstrates other areas of opportunity and potential further study.
Figure 5 shows an additional seven processes that could benefit from knowledge mapping. In addition, the following applications/processes received one vote each from participants during the survey, identifying additional opportunities:
- Assessing standard operating procedures
- Audit program
- Continuous improvement
- Continued process verification
- Data analysis
- Environmental monitoring
- Gaps in subject matter expert knowledge
- Global supply chain
- IT compliance
- New equipment/laboratory project
- New facility design
- Post-market surveillance
- Product teams that share knowledge across multiple sites
Exploring RKI Cycle Node 4
Node 4 of the RKI Cycle is labeled “acquire, grow, capture and retain new knowledge” (see Figure 2). The scope of this knowledge is not exclusive to QRM knowledge; node 4 is the primary injection point of product and process knowledge because it is acquired during development and commercial manufacturing from many diverse processes.
The focus for this workshop was primarily the knowledge generated by the QRM process to explore what knowledge is generated (node 3) and how it flows into KM (node 4). Recognizing the RKI Cycle is a continuum connecting knowledge and risk, the analysis of node 4 is tightly linked to node 3. Node 3 represents the generation of the knowledge from the QRM processes (i.e., new knowledge from QRM and “what has one learned”), whereas node 4 is the intake of this knowledge into KM (i.e., as a means to ensure this knowledge is available in the future to those that need it).
Knowledge as an Output from QRM
In regulatory guidance, it is evident that knowledge is an expected output from QRM, both from the QRM process activities (e.g., risk assessment results) and the knowledge created as a result of the risk management process (e.g., additional studies). For instance, ICH Q8(R2)
WHO Guidelines on Quality Risk Management–Annex 2
KM Process Model
The presenters provided a simplified version of the KM process model (Figure 6)
The KM process model illustrates that many processes—inclusive of QRM—generate knowledge that should flow into KM, and subsequently use (ap-ply) knowledge available through KM—also inclusive of QRM. The authors believe that herein lies the opportunity regarding QRM knowledge flowing in through node 4: How this knowledge can be captured and made available for the future to better inform the next risk assessment, to optimize risk controls, and to enhance risk communications—all to support RBDM and the opportunity to minimize the risk of harm to the patient.
Exercise 2: Exploring Knowledge Generated During QRM
The authors believe that current QRM activities typically focus heavily on risk assessment (as part of node 2). Although risk control, risk communication, and risk review are also part of the QRM process, these activities should evolve and be enhanced as knowledge grows, and the RKI Cycle provides a methodology to ensure this. In addition, the recurrent nature of the RKI Cycle also promotes a reevaluation of the risk assessment as knowledge grows.
Exercise 2 was designed to explore this premise with a view to informing future research, while also providing a networking opportunity for the participants. To this end, the facilitators set up three breakout topics for six teams (two teams per topic). The participants were asked to answer the following questions:
- What knowledge is created during a QRM exercise?
- What is the role of KM in risk review?
- What is the role of KM in risk communication?
The feedback from the participants is summarized in the following sections and will inform ongoing research on the operationalization of node 4.
| “Explicit knowledge through identifying studies that may need to take place to inform rating decisions.” |
| “Transforming tacit into explicit knowledge—documenting for the first time some tacit knowledge from SMEs.” |
| “Knowledge to inform stakeholders/decision-makers/senior management, informing investigations, strategies.” |
| “Life-cycle knowledge/system health; keeping knowledge contemporary.” |
| “Information to be leverage for new product introduction; predictive analysis.” |
| “Gaps in control strategies; gaps in knowledge that become substrate for further study.” |
| “Knowledge to better understand the compliance and supply chain risks.” |
What knowledge is created during QRM activities?
Table 2 presents the combined output from the two teams assigned to this question. The responses are unaltered quotations from participants, aside from removing duplication, making grammatical edits, and grouping related remarks.
The breakout teams also shared the following comments:
- “Knowledge mapping process can also highlight where the weaknesses might lie within business processes.”
- “A risk that it is more difficult to actually digest all this ‘new’ information [explored during quality risk assessment (QRA)] and communicate it effectively.”
- “The issue of confidentiality of this information can be a key issue. Making it visible and accessible can be a problem. Need to be careful about the level of availability/liability issues of data/knowledge that has not been reviewed by the ‘sponsor.’”
- “Also need to consider what might be available for auditors and inspectors to review [of the additional knowledge captured during QRA].”
- “Are we good at disseminating these details in QRM documents (QRM tools/meeting minutes)? Maybe good at flow/dissemination but doesn’t always meet the knowledge quality criteria in the knowledge transfer; not always good at sharing this. Sometimes the context and ‘metadata’ about the issue under review is not embedded in the knowledge capture, makes it difficult to reuse.”
What is the role of KM in risk review?
Table 3 presents the combined output from the two teams assigned to this question.
| “KM to risk review–similar devices and production CAPAs.” |
| “PPQ – annual product review to capture KM to feed into QRA.” |
| “Answer is dependent on the question you ask?” |
| “QRM is built in PQS. Risk review happens in change control, new product introduction, etc. Periodic risk review is codified in a formal SOP for some of the attendees but not all. Formal and informal tools are used for risk review. There are many challenges with risk review, keeping the risk assessment living, updating regulatory submissions where needed. Risk review is still immature in most companies because of historical knowledge of system and processes lies with the individual and is not well-documented.” |
What is the role of KM in risk communication?
Table 4 presents the combined output from the two teams assigned to this question. The responses are unaltered, aside from removing duplication, making grammatical edits, and grouping related remarks.
| “Challenge: Getting the decision-maker(s) get enough information to justify the decision without being too much.” |
| “For explicit knowledge you build systems to know where [to find] things (you want to make sure you have the right system to get the right data you need); the longer you need the explicit knowledge, the more formal it should be so you have additional context and rationale.” |
| “Tacit knowledge is difficult: hard to put everyone’s brain into system (key area of opportunity?).” |
| “Instances where companies are hurting because the experts have left: Don’t just document the results but the rationale. A process map is very helpful.” |
| “Using lessons learned—there is a lack of using this; you do a lessons learned at the end of the process, but no one looks for the lessons when you start a new project (this was a highly agreed discussion!).” |
| “With CROs there is so much turnover (even in the middle of a study) and that impacts the ability to capture the lessons as well as prior history of the study.” |
| “KM facilitates the sharing of key data and ensure visibility and relationship to risk.” |
| “KM provides awareness of the level of risk and the consequences of the risks.” |
| “KM provides another knowledge source document that can be referred to and facilitates informed decisions.” |
| “KM focuses the KM group’s attention to high-risk gaps, where the knowledge needs to be accessible, where the knowledge can be located.” |
| “Risk communication needs to understand the audience and stakeholders and their knowledge.” |
| “KM provides a framework for risk communication.” |
| “KM summarizes the site’s knowledge communicating risk.” |
Conclusion
There are substantial benefits, and an emerging expectation, in using knowledge to inform risk management and RBDM. Both the RKI Cycle and KM can play a major role in providing the best knowledge to make the best decision in the interest of the patient. Tables 5 and 6 summarize the insights gained during the two exercises.
| Examining industry and regulatory guidance reveals many types of knowledge relevant to risk assessment. |
|
A knowledge map of the knowledge inputs to QRM suggests:
|
| There was strong agreement that knowledge mapping can help one think more expansively about QRM knowledge. |
| Knowledge mapping has potentially a high degree of utility for QRM, with agreement that knowledge mapping can better recognize gaps in explicit knowledge and tacit knowledge, can be used as a job aid or checklist to support QRM, and can highlight opportunities to improve KM. |
| Many additional opportunities for knowledge mapping were identified by the participants, led by the opportunities of change control, technology transfer, deviation management/investigations, and CQV. |
| Knowledge is an output from QRM. |
| Diverse knowledge is created during QRM activities, including explicit and tacit knowledge, which informs future studies, helps others understand the past, and helps inform decision-makers. Such a knowledge mapping process can also be helpful to highlight where weakness may lie in a business process. |
| KM can benefit risk review through linking to knowledge on similar products, devices, CAPAs, current manufacturing, SMEs, historical knowledge, etc. |
| KM can benefit risk communication by informing decision-makers, protecting tacit knowledge from employee turnover, sharing data and relationship to risk, increasing awareness of the level of risk and consequence of risks, helping focus attention on high-risk gaps where knowledge needs to be accessible, and providing a framework for risk communication. |
| KM contributes to transparency and evidence-based QRM and RBDM. |
Taken in aggregate, these insights confirm the potential for the RKI Cycle to be an integral part of the solution in better uniting risk and knowledge to lead to more effective RBDM. The exercises during the session, in particular the knowledge mapping exercise associated with node 1, provide tangible means as to how the RKI Cycle can be operationalized in support of RBDM. Exercise 2 will inform ongoing research for the operationalization of node 4.
This session also revealed the opportunity for several potential next steps, including building awareness of and competency in knowledge mapping, extending knowledge mapping to additional applications (e.g., change management, technology transfer), the opportunity to improve risk communication and risk review through KM practices, and continued definition of steps to further operationalize the RKI Cycle.
