July / August 2022

Integrating Knowledge Management and Quality Risk Management

Martin J. Lipa, PhD
Valerie Mulholland
Anne Greene, PhD
Integrating Knowledge Management and Quality Risk Management

ISPE held an Expert Xchange on 18 January 2022 entitled “Risk-Based Decision Making: Advancing the Integration of Quality Risk Management (QRM) and Knowledge Management (KM).” The session included presentations and interactive exercises that generated new and useful insights into the current effectiveness of the knowledge that flows into QRM and how a knowledge map can be used to diagnose opportunities to improve KM. The exercises also helped identify the types of knowledge generated during QRM. These insights demonstrated the opportunity to improve risk-based decision-making (RBDM) by uniting risk and knowledge through a suitable framework such as the Risk-Knowledge Infinity (RKI) Cycle.

The session was facilitated by the Pharmaceutical Regulatory Science Team (PRST) in Technical University (TU) Dublin, which presented introductory material to highlight the emphasis on knowledge and KM in the draft International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH) ICH Q9(R1) guideline.1   An introduction to the RKI Cycle and considerations for RBDM in the pharmaceutical quality system (PQS) followed. Interactive exercises explored the knowledge inputs to QRM and the knowledge generated during QRM activities.

This article provides a summary of the presentations and concepts introduced in the session, data gathered during the session, and a preliminary analysis of these data. The genesis of the session was based on work by the PRST in TU Dublin, who identified through research studies the need to intentionally connect QRM and KM as united enablers of the PQS envisioned by ICH Q10.2

Benefits to connecting QRM and KM include supporting the primary objectives of ICH Q10, including achieving product realization, establishing and maintaining a state of control, and facilitating continual improvement. Additional benefits were identified in a survey of industry and regulatory authorities: 3 risk assessments that are more data-driven; better risk-based decisions; and increased ability to leverage prior knowledge.

In response, the RKI Cycle was developed by PRST researchers as a framework to unite QRM and KM.4 ,5 This framework was previously introduced at an ISPE webinar in May 2021.6 Feedback post-seminar sought additional guidance to support operationalization of the framework.

Concurrently, ICH Q9 has been undergoing revision with the aim to provide clearer guidance on several topics, including RBDM. A draft revision of the updated guideline, ICH Q9(R1), has been issued for public review.7 This draft revision includes proposed new language on RBDM, as well as a significant increase in the expectations for the application of knowledge. It also includes an introduction to the concept of KM. The authors of this article propose that the RKI Cycle may offer benefits to the effectiveness of RBDM, as well as the other revision topics of ICH Q9(R1).8

The three-hour session in the ISPE Expert Xchange9 included 40 participants.

Table 1: Quotes from ICH Q9(R1) relating knowledge and KM to QRM and RBDM.
Section Reference in draft ICH Q9(R1) text (emphasis in bold added by the authors)
Introduction “In the development phase, quality risk management is part of building knowledge and understanding risk scenarios, so that appropriate risk control can be decided upon during technology transfer, for use during the commercial manufacturing phase. In this context, knowledge is used to make informed risk-based decisions, trigger re-evaluations, and stimulate continual improvements.”
Section 4.3, Subjectivity
in QRM

“While subjectivity cannot be completely eliminated from quality risk management activities, it may be controlled by addressing bias, the proper use of quality risk management tools, and maximising the use of relevant data and sources of knowledge.”

“Decision makers should… assure that a quality risk management process is defined, deployed and reviewed and that adequate resources and knowledge
are available.”

Section 5.1, Formality in QRM

“The term ‘uncertainty’ in quality risk management means lack of knowledge about risks. The level of uncertainty that is associated with the area being risk assessed informs how much formality may be required to manage potential risks. Systematic approaches for acquiring, analysing, storing and disseminating scientific information are essential for generating knowledge, which in turn informs all quality risk management activities. Uncertainty may be reduced via effective knowledge management, which enables accumulated and new information (both internal and external) to be used to support risk-based decisions throughout the lifecycle.”

“Regardless of how much formality is applied, the robust management of risk is the goal of the process. This should be based on evidence, science and knowledge, where risk scores, ratings or assessments are supported by data or by an appropriate justification or rationale.”

Section 5.2 regarding Risk-
Based Decision Making

“Approaches to risk-based decision-making are beneficial, because they address uncertainty through the use of knowledge, facilitating informed decisions by regulators and the pharmaceutical industry in a multitude of areas, including when allocating resources. They also help recognize where uncertainty remains, so that appropriate risk controls (including improved detectability) may be identified to enhance understanding of those variables and further reduce the level of uncertainty.”

“As all decision making relies on the use of knowledge, see ICH Q10 for guidance in relation to Knowledge Management. It is important also to ensure the integrity of the data that are used for risk-based decision making.”

Chapter 6 on Product Availability

“An effective pharmaceutical quality system drives both supply chain robustness and sustainable GMP compliance. It also uses quality risk management and knowledge management to provide an early warning system that supports effective oversight and response to evolving quality/manufacturing risks from the pharmaceutical company or its external partners.”

“Approval and oversight of outsourced activities and material suppliers is informed by risk assessments, effective knowledge management, and an effective monitoring strategy for supply chain partner performance.”

Chapter 7, definition of
Risk-Based Decision Making
“Risk-based Decision Making: An approach or process that considers knowledge about risks relevant to the decision and whether risks are at an acceptable level.”
Annex II.9 on the application
of QRM to Supply Chain Control
“With regard to product availability risks related to quality/manufacturing issues, life cycle oversight of the supply chain includes maintaining current knowledge of quality/manufacturing hazards and prioritizing efforts to manage such risks. Understanding hazards to quality/manufacturing is critical to maintaining supply predictability. When risks are well understood and minimized, a higher confidence in product availability can be attained.”

Knowledge and KM in the Draft ICH Q9(R1)

Kevin O’Donnell of the Health Products Regulatory Authority (HPRA, Ireland) and Rapporteur of ICH Q9(R1) presented on knowledge and KM concepts in the draft ICH Q9(R1) guidance7 that highlight the relationship between knowledge, risk, and RBDM. The theme of O’Donnell’s presentation was that knowledge informs decisions about risk, which is a key concept in the draft ICH Q9(R1).

O’Donnell noted this statement in the published ICH Informational Presentation on the revision:10 “The cross-references to ICH Q10 [in relation to KM] serve to highlight the importance of using available sources of knowledge ... and Knowledge Management in general during QRM activities.”

Notably, there are 23 references to the word “knowledge” in the draft ICH Q9(R1) guideline,1   and another 3 references to “knowledge management.” In the initial version of ICH Q9 released in 2005,11 there are only 11 references to “knowledge” and none to “knowledge management.” This increased frequency of reference to the terms in the draft ICH Q9(R1) guideline adds significant presence to the concepts of knowledge and KM.

An Introduction to the RKI Cycle

Martin Lipa, Pharmaceutical Regulatory Science Researcher with the PRST, presented “An Introduction to the RKI Cycle, Rethinking the Connection Be-tween QRM and KM,” which highlighted the purpose of QRM and KM as dual PQS enablers. Lipa noted that knowledge and risk have an inverse relationship such that the more one knows and understands, the less uncertainty there is, and this presents an opportunity for risk reduction. Lipa introduced a framework linking risk and knowledge, the RKI Cycle, as depicted in Figure 1.4

Figure 1: The RKI Cycle [4]. (Used with permission. © 2020 Lipa & O’Donnell. All rights reserved.)


F igure 2: The RKI Cycle applied to ICH Q10 [4]. (Used with permission. © 2020 Lipa & O’Donnell. All rights reserved.)

The RKI Cycle is based on the following key concepts:

  • Knowledge is both an input to and an output from risk management.
  • Knowledge has an inverse relationship with risk (for the purpose of these concepts, risk is used to describe collective actions associated with risk including risk analysis, control, communication, decisions).
  • The concept of flow; knowledge flows effortlessly and on demand to inform risk, and risk informs new knowledge.
  • The cycle is continuous and perpetual; knowledge is always evolving and should be continually applied to inform risk.
  • The cycle applies across the product life cycle.

Lipa then described how the RKI Cycle could be applied to ICH Q10,2  by relating risk management and KM through a series of six steps (or “nodes”) on the cycle, as depicted in Figure 2.

Lipa concluded by sharing research findings that reported 90% of a targeted population composed of industry, regulator, and academia experts surveyed (n = 32) agreed that deploying such a framework would improve QRM/KM integration, resulting in the benefits of more data-driven risk assessments, better risk-based decisions, and increased ability to leverage prior knowledge.3

Figure 3: Characteristics of RBDM from HROs [13]. (Used with permission. © 2021 Mulholland & Greene. All rights reserved.)

The Role of QRM in RBDM

Valerie Mulholland, Pharmaceutical Regulatory Science Researcher with the PRST, shared her perspectives in “Effective Risk-Based Decision Making in the PQS–The Next Horizon in QRM.” Mulholland cited the ICH Q9(R1) concept paper,7 noting its acknowledgment that “while there are references in ICH Q9 to decision-making, there is a lack of clarity on what good risk-based decision making actually means, how QRM may improve decision-making, or how risk-based decisions might be achieved.” In addition, “…there is a breadth of peer-reviewed research in this area, but the level of visibility (and uptake) of that research within the pharmaceutical industry may be improved.”

Mulholland explored the concept of RBDM in the draft ICH Q9(R1) guideline7 which defines RBDM as “An approach or process that considers knowledge about risks relevant to the decision and whether risks are at an acceptable level.”

Mulholland discussed the concept of formality, one of four primary revision topics of ICH Q9(R1),7 in relation to RBDM. Potential criteria for improved formality in decision-making criteria, based on learnings from NASA, could include complexity, uncertainty, high-stake situations, multiple objectives, and diverse stakeholders.12 Mulholland suggested multiple potential methodologies and tools for both low-formality and high-formality scenarios, noting that while ICH Q9(R1) refers to formality, it does not provide guidance as to methodologies or tools that could be used.

Mulholland shared the results from a poll conducted at the opening of the Expert Xchange session, which asked participants whether they had a formal definition for RBDM in their PQS. Only 19% indicated they have a formal definition, 38% said there is no formal definition, and 44% reported they are not sure or do not know.

Participants were asked whether their organizations have formal procedures or tools to support RBDM in their PQS: 14% reported no formal tools for RBDM, 63% indicated they had some formal tools adequate for low-complexity RBDM, and 23% reported they had tools adequate for high-complexity RBDM.

The presentation then introduced additional insights, including recently published research examining the definition and characteristics of RBDM from a variety of high-reliability organizations (HROs), which resulted in identifying 21 characteristics of RBDM,13 as illustrated in Figure 3.

Of the 21 characteristics, only 5 are commonly addressed by QRM processes, whereas up to 8 additional characteristics could be addressed with KM processes.

Mulholland concluded by recognizing the role of knowledge in decision-making, whether it be for complex scenarios or more predictable and rule-based situations. Furthermore, it was suggested that effective RBDM is often based on the use of effective QRM and KM, and that decision-makers need to fully understand complexity and uncertainty when making important decisions with respect to risk.

Exploring RKI Cycle Node 1

Node 1 of the RKI Cycle is premised on the assumption that “best available knowledge flows into QRM.” The presenters noted that an array of guidance, including ICH Q8(R2), Q9, and Q10, 14 ,11 , 2  and World Health Organization guidelines on QRM,15 establishes a clear expectation that knowledge informs risk and should be used together to inform decision-making in order to protect the patient. The presenters suggested that at the outset of a quality risk assessment (QRA) exercise, one must be able to answer three fundamental questions:

  1. What could go wrong?
  2. How likely is it to happen?
  3. If it does happen, will you be able to detect it?

In addition, based on practices beyond the pharmaceutical industry,16 a fourth question was posed:

  1. How sure are you [of the answers to 1–3]? How sure do you need to be? Is the result suitable?

Figure 4: Potential information and knowledge inputs into QRM for a commissioning and qualification scenario (not exhaustive). 18
PQS Knowledge Project Capability QRM Knowledge
  • Applicable legislation, laws, environmental health and safety (EHS), etc.
  • Guidance/best practice documents
  • Pharmacopeial and test standards
  • Submitted/approved regulatory filings
  • Change management strategy
  • PQS procedures – process under analysis
  • Quality records
  • Maintenance records
  • Validation procedures and policies
  • Supplier management/procurement policies and procedures
  • CAPA data – complaints/audits/deviations/trends
  • Annual product review (APR) management reviews
  • Business strategy/priority for product
  • Contracts/scope/turn-over-packages
  • Commissioning and qualification (C&Q) plans/schedules
  • Capabilities and resources
  • Laboratory support capabilities
  • Training procedures and policies
  • Good engineering practice
  • Roles and responsibilities
  • EHS documents – safety data
  • Conflicting objectives/requirements
  • KM outputs (legacy requirements)
  • Risk management knowledge
  • Risk management procedures and policies
  • Defined risk question/scope
  • Trained risk management practitioners/facilitators
  • Specify a timeline, deliverables, and appropriate level of decision-making for the risk management process
Product Knowledge Process Knowledge
  • Life cycle documents
  • Specs/acceptance criteria – product
  • Specs/acceptance criteria – materials
  • Design/validation documents – measurement and analysis systems
  • History of product issues (product under analysis or related)
  • Supply chain (product and materials)
  • Toxicology data/acceptable daily exposure (ADE) value
  • Information and/or data on the potential hazard, harm, or human health impact relevant to the risk assessment
  • Degradation pathways/stability data
  • Process user requirements
  • Specifications/acceptance criteria – process
  • Design/validation documents
  • Facility and utilities
  • Process and equipment
  • Process controls
  • Measurement and analysis systems
  • Software systems
  • Cleaning
  • History of problems with process/outputs
  • Drawings
  • Calibration requirements
  • QRM documents from design/previous stages
  • System integration requirements
  • Equipment manuals/technical specifications
  • Materials of construction
  • Process capability/performance indices
  • Routes for contamination/cross contamination
  • Cleaning process performance capability
  • Training and competence in process
  • Prior knowledge/lessons learned – current or other locations

Linking to the intent of node 1 to apply the “best knowledge to QRM,” the presenters posed these questions:

  1. How will you ensure you apply the best knowledge, experience, know-how, expertise, and prior knowledge to perform an optimal risk assessment and support the best possible risk-based decision?
  2. Is the most current knowledge visible, available, and accessible on demand?
  3. Is the knowledge of sufficient quality for use?
  4. What are you missing?

The presenters then introduced the concept of knowledge mapping5 ,17 as a means to help answer these questions and address the intent of node 1.

Knowledge Inputs to QRM

A key input to a knowledge map is understanding the knowledge inputs to a process. For example, taking a typical commissioning and qualification scenario, the authors identified potential sources of knowledge to support the associated QRM (and consequentially RBDM).18 The facilitators compiled the knowledge inputs identified from these sources into an aggregated list, representing 57 potential inputs from 9 guidelines. These were assigned into six categories and are shown in Figure 4. Although not a fully definitive or exhaustive review, given the scope and relevance of the guidance documents reviewed, the facilitators propose this list represents a significant portion of the information and knowledge inputs to the QRM process.

Exercise 1: Knowledge Map Case Study

As an illustration, the presenters introduced a knowledge mapping case study for the installation of an autoclave. Most (52) of the aggregated list of 57 knowledge inputs in Figure 4 were considered relevant to the risk assessment of an autoclave installation. A subset of these inputs was selected to illustrate the knowledge mapping process.

The instructions for knowledge mapping were introduced using a simplified knowledge map template,18 which assessed knowledge type (explicit or tacit), knowledge flow, and knowledge quality.

Explicit knowledge was defined as codified knowledge (i.e., something written down in a document, a video, or an image), whereas tacit knowledge was defined as the knowledge in people’s heads (i.e., know-how, experience, expertise).

Knowledge flow was defined as to whether the knowledge was available and accessible on demand. Knowledge quality was defined as the knowledge being reliable for intended use, having sufficient context and rationale, and being complete and accurate.18 Qualitative descriptions were provided for each of three levels of flow and quality, ranging from poor to marginal to excellent.

The facilitators presented an example and mapped five knowledge inputs, covering both types of explicit and tacit knowledge. The first three knowledge inputs were mapped using an interactive poll designed to solicit perspectives from the participants to illustrate the current state of process knowledge on design and validation documents for facilities and utilities; prior knowledge/lessons learned from attendees or other sites; and routes for contamination/contamination control.

Two additional inputs were mapped in the session through an exchange of dialogue between facilitators (Mulholland as QRM expert and Lipa as KM expert), designed to illustrate to the participants the deeper thinking and discussions that should occur during a knowledge mapping exercise. These inputs were product/process knowledge; QRM documents from product/process development; and process knowledge: system integration requirements (e.g., manufacturing execution systems, electronic batch records, building management system).

Knowledge Map Results and Key Insights

Almost all attendees provided responses for the first three knowledge inputs. Although the sample size was small, the results are in line with Lipa’s previous experience. The authors propose the following insights:

  • The flow and quality of explicit knowledge are markedly higher than that of tacit knowledge.
  • Although results for explicit knowledge flow and quality fared better than that of tacit knowledge, there is clearly an opportunity for improvement, as on average just over half of respondents rated flow and quality as excellent, with a substantial percentage rated as only marginal or poor.
  • Tacit knowledge flow received the lowest ratings, suggesting this may be an area for focus and improvement.
  • Participants rated communication and lessons learned between sites as poor.
  • There was a concerning marginal/poor rating of both tacit and explicit knowledge flow and quality, given the process importance of the equipment application and its role in the contamination control strategy, suggesting that even for critical processes, there may be gaps in information quality and reliability.

Knowledge Mapping: Potential Value for QRM

At the completion of the activity, the participants were asked to reflect on the utility of knowledge mapping as demonstrated through the case study exercise. They were asked the following questions via a survey about knowledge mapping.

In response to the first question, “Does knowledge mapping help you think more expansively about QRM knowledge?,” 97% of participants agreed or strongly agreed that it does.

Additional responses to other questions suggest that knowledge mapping has a significant potential utility in supporting QRM: 93% agreed that knowledge mapping can help recognize gaps in explicit knowledge; 86% agreed that knowledge mapping can help recognize gaps in tacit knowledge; 83% agreed that knowledge mapping can be used as a template or checklist to support QRM; and 97% agreed that knowledge mapping can highlight opportunities to improve KM.

Figure 5: Additional applications for knowledge mapping.

Finally, the participants were asked what other three applications (e.g., processes) might benefit from knowledge mapping. Figure 5 suggests recognition of the opportunity for knowledge mapping to benefit change control, technology transfer, deviation management and investigations, and CQV (commissioning, qualification, and validation). This demonstrates other areas of opportunity and potential further study.

Figure 5 shows an additional seven processes that could benefit from knowledge mapping. In addition, the following applications/processes received one vote each from participants during the survey, identifying additional opportunities:

  • Assessing standard operating procedures
  • Audit program
  • Continuous improvement
  • Continued process verification
  • Data analysis
  • Environmental monitoring
  • Gaps in subject matter expert knowledge
  • Global supply chain
  • IT compliance
  • New equipment/laboratory project
  • New facility design
  • Post-market surveillance
  • Product teams that share knowledge across multiple sites

Exploring RKI Cycle Node 4

Node 4 of the RKI Cycle is labeled “acquire, grow, capture and retain new knowledge” (see Figure 2). The scope of this knowledge is not exclusive to QRM knowledge; node 4 is the primary injection point of product and process knowledge because it is acquired during development and commercial manufacturing from many diverse processes.

The focus for this workshop was primarily the knowledge generated by the QRM process to explore what knowledge is generated (node 3) and how it flows into KM (node 4). Recognizing the RKI Cycle is a continuum connecting knowledge and risk, the analysis of node 4 is tightly linked to node 3. Node 3 represents the generation of the knowledge from the QRM processes (i.e., new knowledge from QRM and “what has one learned”), whereas node 4 is the intake of this knowledge into KM (i.e., as a means to ensure this knowledge is available in the future to those that need it).

Knowledge as an Output from QRM

In regulatory guidance, it is evident that knowledge is an expected output from QRM, both from the QRM process activities (e.g., risk assessment results) and the knowledge created as a result of the risk management process (e.g., additional studies). For instance, ICH Q8(R2)14 says pharmaceutical development “provides an opportunity to present the knowledge gained during application of scientific approaches and QRM.” It also states, “appropriate use of QRM principles can be helpful in prioritising the additional pharmaceutical development studies to collect such knowledge.”

WHO Guidelines on Quality Risk Management–Annex 215 says that “the QRM approach may be used to…facilitate the transfer of process knowledge and product development history to ease product progression throughout its life-cycle and to supplement already available knowledge about the prod-uct.” Also, “early in development, the purpose of the QRM process may be to acquire sufficient product and process knowledge to assess risks associated with [the process].” The WHO Guidelines also say, “a crucial aspect of product development and QRM is the maintenance of an effective and secure knowledge management and documentation system.”

KM Process Model

The presenters provided a simplified version of the KM process model (Figure 6)4 to introduce the participants to the model and the underlying intent that KM is intended to enable knowledge to flow to the right person, at the right time, to inform the best decision.

The KM process model illustrates that many processes—inclusive of QRM—generate knowledge that should flow into KM, and subsequently use (ap-ply) knowledge available through KM—also inclusive of QRM. The authors believe that herein lies the opportunity regarding QRM knowledge flowing in through node 4: How this knowledge can be captured and made available for the future to better inform the next risk assessment, to optimize risk controls, and to enhance risk communications—all to support RBDM and the opportunity to minimize the risk of harm to the patient.

Exercise 2: Exploring Knowledge Generated During QRM

The authors believe that current QRM activities typically focus heavily on risk assessment (as part of node 2). Although risk control, risk communication, and risk review are also part of the QRM process, these activities should evolve and be enhanced as knowledge grows, and the RKI Cycle provides a methodology to ensure this. In addition, the recurrent nature of the RKI Cycle also promotes a reevaluation of the risk assessment as knowledge grows. 19

Exercise 2 was designed to explore this premise with a view to informing future research, while also providing a networking opportunity for the participants. To this end, the facilitators set up three breakout topics for six teams (two teams per topic). The participants were asked to answer the following questions:

  1. What knowledge is created during a QRM exercise?
  2. What is the role of KM in risk review?
  3. What is the role of KM in risk communication?

The feedback from the participants is summarized in the following sections and will inform ongoing research on the operationalization of node 4.

  • 14
  • 15
  • 4
  • 19Lipa, M. J., P. Kane, and A. Greene. “Advancing Competency in Managing Risk and Knowledge: Steps Toward Operationalisation of the Risk-Knowledge Infinity Cycle (RKI Cycle)–Part 1: Improving effectiveness of Risk-Based Decision Making (RBDM).” Technological University Dublin. 2022. doi: 10.21427/JV8W-0272.
Figure 6: KM process model. (Used with permission. © 2020 Lipa & O’Donnell. All rights reserved.)

Table 2: Breakout summary: Knowledge created during QRM activities.
“Explicit knowledge through identifying studies that may need to take place to inform
rating decisions.”
“Transforming tacit into explicit knowledge—documenting for the first time some tacit
knowledge from SMEs.”
“Knowledge to inform stakeholders/decision-makers/senior management, informing
investigations, strategies.”
“Life-cycle knowledge/system health; keeping knowledge contemporary.”
“Information to be leverage for new product introduction; predictive analysis.”
“Gaps in control strategies; gaps in knowledge that become substrate for further study.”
“Knowledge to better understand the compliance and supply chain risks.”

What knowledge is created during QRM activities?

Table 2 presents the combined output from the two teams assigned to this question. The responses are unaltered quotations from participants, aside from removing duplication, making grammatical edits, and grouping related remarks.

The breakout teams also shared the following comments:

  • “Knowledge mapping process can also highlight where the weaknesses might lie within business processes.”
  • “A risk that it is more difficult to actually digest all this ‘new’ information [explored during quality risk assessment (QRA)] and communicate it effectively.”
  • “The issue of confidentiality of this information can be a key issue. Making it visible and accessible can be a problem. Need to be careful about the level of availability/liability issues of data/knowledge that has not been reviewed by the ‘sponsor.’”
  • “Also need to consider what might be available for auditors and inspectors to review [of the additional knowledge captured during QRA].”
  • “Are we good at disseminating these details in QRM documents (QRM tools/meeting minutes)? Maybe good at flow/dissemination but doesn’t always meet the knowledge quality criteria in the knowledge transfer; not always good at sharing this. Sometimes the context and ‘metadata’ about the issue under review is not embedded in the knowledge capture, makes it difficult to reuse.”

What is the role of KM in risk review?

Table 3 presents the combined output from the two teams assigned to this question.

Table 3: Breakout summary: The role of KM in risk review.
“KM to risk review–similar devices and production CAPAs.”
“PPQ – annual product review to capture KM to feed into QRA.”
“Answer is dependent on the question you ask?”
“QRM is built in PQS. Risk review happens in change control, new product introduction, etc. Periodic risk review is codified in a formal SOP for some of the attendees but not all. Formal and informal tools are used for risk review. There are many challenges with risk review, keeping the risk assessment living, updating regulatory submissions where needed. Risk review is still immature in most companies because of historical knowledge of system and processes lies with the individual and is not well-documented.”

What is the role of KM in risk communication?

Table 4 presents the combined output from the two teams assigned to this question. The responses are unaltered, aside from removing duplication, making grammatical edits, and grouping related remarks.

Table 4: Breakout summary: The role of KM in risk communication.
“Challenge: Getting the decision-maker(s) get enough information to justify the decision without being too much.”
“For explicit knowledge you build systems to know where [to find] things (you want to make sure you have the right system to get the right data you need); the longer you need the explicit knowledge, the more formal it should be so you have additional context and rationale.”
“Tacit knowledge is difficult: hard to put everyone’s brain into system (key area of opportunity?).”
“Instances where companies are hurting because the experts have left: Don’t just document the results but the rationale. A process map is very helpful.”
“Using lessons learned—there is a lack of using this; you do a lessons learned at the end of the process, but no one looks for the lessons when you start a new project (this was a highly agreed discussion!).”
“With CROs there is so much turnover (even in the middle of a study) and that impacts the ability to capture the lessons as well as prior history of the study.”
“KM facilitates the sharing of key data and ensure visibility and relationship to risk.”
“KM provides awareness of the level of risk and the consequences of the risks.”
“KM provides another knowledge source document that can be referred to and facilitates informed decisions.”
“KM focuses the KM group’s attention to high-risk gaps, where the knowledge needs to be accessible, where the knowledge can be located.”
“Risk communication needs to understand the audience and stakeholders and their knowledge.”
“KM provides a framework for risk communication.”
“KM summarizes the site’s knowledge communicating risk.”


There are substantial benefits, and an emerging expectation, in using knowledge to inform risk management and RBDM. Both the RKI Cycle and KM can play a major role in providing the best knowledge to make the best decision in the interest of the patient. Tables 5 and 6 summarize the insights gained during the two exercises.

Table 5: Summary of insights for exercise 1 (RKI Cycle node 1).
Examining industry and regulatory guidance reveals many types of knowledge relevant to risk assessment.

A knowledge map of the knowledge inputs to QRM suggests:

  • A significant opportunity to better manage the flow and quality of explicit knowledge to better inform QRM
  • A significant opportunity to better manage the flow and quality of tacit knowledge to better inform QRM
  • Requirements for KM can be informed through insights gained during knowledge mapping
There was strong agreement that knowledge mapping can help one think more expansively about QRM knowledge.
Knowledge mapping has potentially a high degree of utility for QRM, with agreement that knowledge mapping can better recognize gaps in explicit knowledge and tacit knowledge, can be used as a job aid or checklist to support QRM, and can highlight opportunities to improve KM.
Many additional opportunities for knowledge mapping were identified by the participants, led by the opportunities of change control, technology transfer, deviation management/investigations, and CQV.

Table 6: Summary of insights for exercise 2 (RKI Cycle node 4).
Knowledge is an output from QRM.
Diverse knowledge is created during QRM activities, including explicit and tacit knowledge, which informs future studies, helps others understand the past, and helps inform decision-makers. Such a knowledge mapping process can also be helpful to highlight where weakness may lie in a business process.
KM can benefit risk review through linking to knowledge on similar products, devices, CAPAs, current manufacturing, SMEs, historical knowledge, etc.
KM can benefit risk communication by informing decision-makers, protecting tacit knowledge from employee turnover, sharing data and relationship to risk, increasing awareness of the level of risk and consequence of risks, helping focus attention on high-risk gaps where knowledge needs to be accessible, and providing a framework for risk communication.
KM contributes to transparency and evidence-based QRM and RBDM.

Taken in aggregate, these insights confirm the potential for the RKI Cycle to be an integral part of the solution in better uniting risk and knowledge to lead to more effective RBDM. The exercises during the session, in particular the knowledge mapping exercise associated with node 1, provide tangible means as to how the RKI Cycle can be operationalized in support of RBDM. Exercise 2 will inform ongoing research for the operationalization of node 4.

This session also revealed the opportunity for several potential next steps, including building awareness of and competency in knowledge mapping, extending knowledge mapping to additional applications (e.g., change management, technology transfer), the opportunity to improve risk communication and risk review through KM practices, and continued definition of steps to further operationalize the RKI Cycle.