Risk Management for Drug Delivery Systems [Part One]

What does a combination product risk management process look like?

Let’s start with defining risk management.

Risk itself is a combination of a severity of a harm and the probability of that harm occurring. The industry denotes severity with a score that’s assigned to indicate the severity of each particular possible harm. The harm we refer to is defined as an injury or damage to the health of people or damage to property or the environment. So, we’re not just talking about patients or clinicians, but also whether harm can be done to the facility or the environment within which the product is being used. The probability of the hazardous situation is multiplied by the probability that a particular harm will result from the hazardous situation to get to the occurrence side of the equation.

For example, if there is a exposed needle, what’s the probability that that needle becomes exposed? If it is exposed, what’s the probability of that needle poking me? And, if it does, in fact, poke me, what’s the probability that that needle will cause a variety of different harms such as broken skin or the contraction of a harmful disease? Thus, the risk associated with an exposed needle is very much scaled depending on the harms in question.

Risk management is executed by following a set of procedures and practices to analyze, evaluate, control and monitor risk. There is an industry standard called ISO 14971 that specifies how to execute a risk management process for the development of medical devices. Regulatory bodies expect us to follow the standard, so risk management, executed according to this standard, is an obligation of all medical device developers.
The reason for this regulatory oversight is that risk management gives you the opportunity to predict the harms that are associated with the product and proactively take steps to limit the chance of those harms from occurring, better ensuring the safety of users.

Now, let’s use a real-life example of potential risk to explore how this equation is put into action.

I work out of Phoenix, AZ and, one summer morning, I was getting ready to walk my dog, Chester. I started putting on my shoes and I noticed something looked a bit weird inside my shoe. I looked down and there was a scorpion inside! Since proximity to a scorpion presents hazards, such as breaking my skin with its telson (the pointy end of its tail) or injecting me with its venom, this is a hazardous situation – more common in Arizona than other parts of the world, though still not an everyday occurrence (a first for me!).

If I were to have placed my foot in the shoe, it’s probably very likely that I would have been harmed by the scorpion in some way or another. Based on age, genetics, and health status, the harms one is likely to experience from a scorpion sting could vary among bleeding, swelling, numbness, and a painful burning sensation…or worse. A child or elderly person’s reaction could be more severe or problematic than the reaction to a scorpion sting of a healthy woman in her thirties. Another variable to consider is the type of scorpion in the shoe, which can dictate what type of harm I may or may not experience. Fun fact: Arizona has three common types of scorpions, and only one, the bark scorpion, is known to be venomous enough to produce the types of harms that are more worrisome.

So, while any scorpion can present risk of harm, the particular type of scorpion has an influence on the outcome of the risk, as well as the person being stung. This is the same type of scenario we see when we’re working with combination products. There are hazards and hazardous situations that are inherent to using a medical device (a scorpion). The hazards and harms are dictated by what type of medical device is in question and its particular design (a bark scorpion), by the drug that is inside it (its venom), and by the end user (the person getting stung!).

Similarly, when we are talking specifically about a drug delivery device in the medical device world, we are talking about both drug and device companies, who will collaborate to create this combination product. The drug side dictates the severity portion of the risk calculation and the probability that a hazardous situation will manifest into a harm. Whereas the device side only dictates the probabilities of the hazardous situation occurring. What that means is that pharma organizations and device organizations need to synchronize the risk management processes for the development of that specific combination product. This gets tricky because now we’re talking different organizations with different ideas of how to execute risk management, and the risk management standard, ISO 14971, allows for the use of a variety of different scales for defining harm and probabilities.

What SHOULD risk management look like for a combination product?

We start with risk analysis, identifying hazards and hazardous situations involved with use of the product and calculating that risk score – the severity of harm multiplied by the probability of harm. Then, we get into evaluating the risk, asking ourselves, “Given this risk we’ve just calculated, are we in a good place or not? Have we met our acceptability criteria, or do we need to do more work?”

The work to come is known as risk control. This is when you implement counteractive measures, such as design features and labeling, to get that risk to a desired level of acceptability. Once you go through the process of risk control, you then reevaluate the risk for what we call residual risks. Where does that put us in terms of the acceptability criteria that we’ve defined and what is the overall risk to the patient compared to the potential benefit it could provide? If we say, as a result of that evaluation, that we think the benefits of this product outweigh its residual risks then we can move forward with commercial launch or clinical use of the product, we summarize all of our risk management activities and evaluations in a risk management review and following that, we go into the life cycle management process of our risk management program with the commercial product.

What does that process look like in terms of deliverables?

As mentioned earlier, this is a combined effort of risk management between multiple organizations. The color codes in the above visual identify who’s doing what, with some specific call outs of exact drug team vs. device team responsibilities. Since the device team not only includes the internal Pharma device experts but also the OEMs manufacturing the device constituent parts, it is crucial to align the OEM’s existing standard operating procedures (SOPs) with the Pharma company’s risk management criteria and for both parties to be as transparent as possible (a good supplier agreement should take care of protecting everyone’s IP) for a smooth and complete process.

The first deliverable is the risk management plan, in which we define the who, what, where, when, and why of the risk management process to come. The drug team needs to address how they will handle drug product quality and the risk management process that’s typically outside of the combination product. The device team needs to make sure that the scope of risk management is not just the device, but also the device and its (most likely primary container inside the device) interaction with the drug product itself. For example, there could be instances where the drug product is not compatible with the material of the device, affecting the drug product quality. In addition, one of the key areas of risk management plans is defining responsibilities/ownership and deliverables, as well as how different involved parties will interact with each other. Another key element is defining the criteria that we use to estimate risk, to a degree driven at the combination product level. Both teams are expected to jointly create this risk management plan, ensuring alignment and expertise in the appropriate plan areas.

Below is a table that outlines some of the points made above.

The second deliverable, a hazard analysis, is the development of the information that will help calculate risk. The device team is responsible for defining those hazards and hazardous situations, whereas the drug team, because it’s drug product and user dependent, will define the harms and their severities.

From there you have the tools that you need to conduct a failure modes and effects analysis (FMEA), the actual risk assessment and third deliverable. Executing an FMEA is not a regulatory requirement, but it is the most common, recommended tool for performing that risk calculation and evaluating it against your acceptance criteria. The resulting outputs of the FMEA are risk scores for each hazard and hazardous situation, checked against the plan’s pre-established acceptance criteria.

For risk scores that exceed pred-defined acceptable levels, the device team will own the implementation of risk controls for any risk controls related to device design, while the drug team will implement controls relating to labeling. As controls are determined, the FMEA is reiterated to evaluate residual risk with the implementation of those controls.

The final risk management deliverable during development is a risk management summary report, before the team heads into post-market risk management planning and activities. This often incorporates the benefit-risk analysis, which requires the drug team to ultimately decide if the potential benefits of the combination product outweigh the remaining residual risks.

As a result of executing the risk management program, all of the risk management documentation that you’ve produced needs to be incorporated into a risk management file.

AUTHOR

Kelly Wedig, Principal Consultant, Suttons Creek –Kelly is a medical device engineer with 10+ years of experience in combination product research and development, post-market surveillance, and lifecycle management. Over her career, she has supported the development and management of various types of combination products including on-body injectors, prefilled syringes, auto-injectors, and nasal spray systems. She is enthusiastic about improving the lives of patients by delivering state-of-the-art medical products through innovation, collaboration, and quality. Kelly has a proven track record of being a reliable asset with excellent problem-solving skills, all of which lead to delivering results in a fast-paced, competitive, and highly regulated medical device industry.