Integrating Knowledge Management and Quality Risk Management

The session was facilitated by the Pharmaceutical Regulatory Science Team (PRST) in Technical University (TU) Dublin, which presented introductory material to highlight the emphasis on knowledge and KM in the draft International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH) ICH Q9(R1) guideline.1   An introduction to the RKI Cycle and considerations for RBDM in the pharmaceutical quality system (PQS) followed. Interactive exercises explored the knowledge inputs to QRM and the knowledge generated during QRM activities.

This article provides a summary of the presentations and concepts introduced in the session, data gathered during the session, and a preliminary analysis of these data. The genesis of the session was based on work by the PRST in TU Dublin, who identified through research studies the need to intentionally connect QRM and KM as united enablers of the PQS envisioned by ICH Q10.2

Benefits to connecting QRM and KM include supporting the primary objectives of ICH Q10, including achieving product realization, establishing and maintaining a state of control, and facilitating continual improvement. Additional benefits were identified in a survey of industry and regulatory authorities: 3 risk assessments that are more data-driven; better risk-based decisions; and increased ability to leverage prior knowledge.

In response, the RKI Cycle was developed by PRST researchers as a framework to unite QRM and KM.4 ^,5 This framework was previously introduced at an ISPE webinar in May 2021.6 Feedback post-seminar sought additional guidance to support operationalization of the framework.

Concurrently, ICH Q9 has been undergoing revision with the aim to provide clearer guidance on several topics, including RBDM. A draft revision of the updated guideline, ICH Q9(R1), has been issued for public review.7 This draft revision includes proposed new language on RBDM, as well as a significant increase in the expectations for the application of knowledge. It also includes an introduction to the concept of KM. The authors of this article propose that the RKI Cycle may offer benefits to the effectiveness of RBDM, as well as the other revision topics of ICH Q9(R1).8

The three-hour session in the ISPE Expert Xchange9 included 40 participants.

Knowledge and KM in the Draft ICH Q9(R1)

Kevin O’Donnell of the Health Products Regulatory Authority (HPRA, Ireland) and Rapporteur of ICH Q9(R1) presented on knowledge and KM concepts in the draft ICH Q9(R1) guidance7 that highlight the relationship between knowledge, risk, and RBDM. The theme of O’Donnell’s presentation was that knowledge informs decisions about risk, which is a key concept in the draft ICH Q9(R1).

O’Donnell noted this statement in the published ICH Informational Presentation on the revision:10 “The cross-references to ICH Q10 [in relation to KM] serve to highlight the importance of using available sources of knowledge ... and Knowledge Management in general during QRM activities.”

Notably, there are 23 references to the word “knowledge” in the draft ICH Q9(R1) guideline,1   and another 3 references to “knowledge management.” In the initial version of ICH Q9 released in 2005,11 there are only 11 references to “knowledge” and none to “knowledge management.” This increased frequency of reference to the terms in the draft ICH Q9(R1) guideline adds significant presence to the concepts of knowledge and KM.

An Introduction to the RKI Cycle

Martin Lipa, Pharmaceutical Regulatory Science Researcher with the PRST, presented “An Introduction to the RKI Cycle, Rethinking the Connection Be-tween QRM and KM,” which highlighted the purpose of QRM and KM as dual PQS enablers. Lipa noted that knowledge and risk have an inverse relationship such that the more one knows and understands, the less uncertainty there is, and this presents an opportunity for risk reduction. Lipa introduced a framework linking risk and knowledge, the RKI Cycle, as depicted in Figure 1.4

• 1 a b International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use. Quality Risk Management–ICH Q9(R1), Step 2. Published November 2021. https://database.ich.org/sites/default/files/ICH_Q9%28R1%29_Step_2_Presentation_2021_1126.pdf
• 2International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use. ICH Harmonised Tripartite Guideline Q10: Pharmaceutical Quality System. Published June 2008. https://database.ich.org/sites/default/files/Q10%20Guideline.pdf
• 3Lipa, M. J., K. O’Donnell, and A. Greene. “A Survey Report on the Current State of Quality Risk Management (QRM) and Knowledge Management (KM) Integration.” Level 3 15, no. 3 (2021). https://arrow.tudublin.ie/level3/vol15/iss3/5/
• 4 a b Lipa, M. J., K. O’Donnell, and A. Greene, “Knowledge as the Currency of Managing Risk: A Novel Framework to Unite Quality Risk Management and Knowledge Management.” Journal of Validation Technology 26, no. 5 (2020).
• 5International Society for Pharmaceutical Engineering. Good Practice Guide: Knowledge Management in the Pharmaceutical Industry. North Bethesda, MD: International Society for Pharmaceutical Engineering (2021). https://ispe.org/publications/guidance-documents/good-practice-guide-knowledge-management-pharmaceutical-industry
• 6Lipa, M. J., and V. Mulholland. “Exploring the Risk-Knowledge Infinity Cycle (RKI Cycle) Across the Product Lifecycle.” ISPE Webinar 2021. https://ispe.org/webinars/exploring-risk-knowledge-infinity-cycle-rki-cycle-across-product-lifecycle
• 7 a b International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use. “Final Concept Paper ICH Q9(R1): Quality Risk Management.” Published November 2020. ttps://database.ich.org/sites/default/files/Q9-R1_Concept%20Paper_2020_1113.pdf
• 8Lipa, M. J., V. Mulholland, and A. Greene. “Improving Risk-Based Decision Making (RBDM) Effectiveness Through a Framework Which Integrates Knowledge and Risk.” Level 3 16, no. 2 (2022):0–26. https://arrow.tudublin.ie/level3/vol16/iss2/2/
• 9International Society for Pharmaceutical Engineering. ISPE Expert Xchange. https://ispe.org/expert-xchange
• 10International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use. Quality Risk Management, ICH Q9(R1): Step 2 document (presentation). ICH Quality Guidelines. Published November 2021. https://database.ich.org/sites/default/files/ICH_Q9%28R1%29_Step_2_Presentation_2021_1126.pdf
• 11International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use. ICH Harmonised Tripartite Guideline Q9: Quality Risk Management. Published November 2005. https://database.ich.org/sites/default/files/Q9%20Guideline.pdf

The RKI Cycle is based on the following key concepts:

• Knowledge is both an input to and an output from risk management.
• Knowledge has an inverse relationship with risk (for the purpose of these concepts, risk is used to describe collective actions associated with risk including risk analysis, control, communication, decisions).
• The concept of flow; knowledge flows effortlessly and on demand to inform risk, and risk informs new knowledge.
• The cycle is continuous and perpetual; knowledge is always evolving and should be continually applied to inform risk.
• The cycle applies across the product life cycle.

Lipa then described how the RKI Cycle could be applied to ICH Q10,2  by relating risk management and KM through a series of six steps (or “nodes”) on the cycle, as depicted in Figure 2.

Lipa concluded by sharing research findings that reported 90% of a targeted population composed of industry, regulator, and academia experts surveyed (n = 32) agreed that deploying such a framework would improve QRM/KM integration, resulting in the benefits of more data-driven risk assessments, better risk-based decisions, and increased ability to leverage prior knowledge.3

• 2
• 3

The Role of QRM in RBDM

Valerie Mulholland, Pharmaceutical Regulatory Science Researcher with the PRST, shared her perspectives in “Effective Risk-Based Decision Making in the PQS–The Next Horizon in QRM.” Mulholland cited the ICH Q9(R1) concept paper,7 noting its acknowledgment that “while there are references in ICH Q9 to decision-making, there is a lack of clarity on what good risk-based decision making actually means, how QRM may improve decision-making, or how risk-based decisions might be achieved.” In addition, “…there is a breadth of peer-reviewed research in this area, but the level of visibility (and uptake) of that research within the pharmaceutical industry may be improved.”

Mulholland explored the concept of RBDM in the draft ICH Q9(R1) guideline7 which defines RBDM as “An approach or process that considers knowledge about risks relevant to the decision and whether risks are at an acceptable level.”

Mulholland discussed the concept of formality, one of four primary revision topics of ICH Q9(R1),7 in relation to RBDM. Potential criteria for improved formality in decision-making criteria, based on learnings from NASA, could include complexity, uncertainty, high-stake situations, multiple objectives, and diverse stakeholders.12 Mulholland suggested multiple potential methodologies and tools for both low-formality and high-formality scenarios, noting that while ICH Q9(R1) refers to formality, it does not provide guidance as to methodologies or tools that could be used.

Mulholland shared the results from a poll conducted at the opening of the Expert Xchange session, which asked participants whether they had a formal definition for RBDM in their PQS. Only 19% indicated they have a formal definition, 38% said there is no formal definition, and 44% reported they are not sure or do not know.

Participants were asked whether their organizations have formal procedures or tools to support RBDM in their PQS: 14% reported no formal tools for RBDM, 63% indicated they had some formal tools adequate for low-complexity RBDM, and 23% reported they had tools adequate for high-complexity RBDM.

The presentation then introduced additional insights, including recently published research examining the definition and characteristics of RBDM from a variety of high-reliability organizations (HROs), which resulted in identifying 21 characteristics of RBDM,13 as illustrated in Figure 3.

Of the 21 characteristics, only 5 are commonly addressed by QRM processes, whereas up to 8 additional characteristics could be addressed with KM processes.

Mulholland concluded by recognizing the role of knowledge in decision-making, whether it be for complex scenarios or more predictable and rule-based situations. Furthermore, it was suggested that effective RBDM is often based on the use of effective QRM and KM, and that decision-makers need to fully understand complexity and uncertainty when making important decisions with respect to risk.

Exploring RKI Cycle Node 1

Node 1 of the RKI Cycle is premised on the assumption that “best available knowledge flows into QRM.” The presenters noted that an array of guidance, including ICH Q8(R2), Q9, and Q10, 14 ^,11 ^, 2  and World Health Organization guidelines on QRM,15 establishes a clear expectation that knowledge informs risk and should be used together to inform decision-making in order to protect the patient. The presenters suggested that at the outset of a quality risk assessment (QRA) exercise, one must be able to answer three fundamental questions:

1. What could go wrong?
2. How likely is it to happen?
3. If it does happen, will you be able to detect it?

In addition, based on practices beyond the pharmaceutical industry,16 a fourth question was posed:

4. How sure are you [of the answers to 1–3]? How sure do you need to be? Is the result suitable?

Linking to the intent of node 1 to apply the “best knowledge to QRM,” the presenters posed these questions:

1. How will you ensure you apply the best knowledge, experience, know-how, expertise, and prior knowledge to perform an optimal risk assessment and support the best possible risk-based decision?
2. Is the most current knowledge visible, available, and accessible on demand?
3. Is the knowledge of sufficient quality for use?
4. What are you missing?

The presenters then introduced the concept of knowledge mapping5 ^,17 as a means to help answer these questions and address the intent of node 1.

Knowledge Inputs to QRM

A key input to a knowledge map is understanding the knowledge inputs to a process. For example, taking a typical commissioning and qualification scenario, the authors identified potential sources of knowledge to support the associated QRM (and consequentially RBDM).18 The facilitators compiled the knowledge inputs identified from these sources into an aggregated list, representing 57 potential inputs from 9 guidelines. These were assigned into six categories and are shown in Figure 4. Although not a fully definitive or exhaustive review, given the scope and relevance of the guidance documents reviewed, the facilitators propose this list represents a significant portion of the information and knowledge inputs to the QRM process.

Exercise 1: Knowledge Map Case Study

As an illustration, the presenters introduced a knowledge mapping case study for the installation of an autoclave. Most (52) of the aggregated list of 57 knowledge inputs in Figure 4 were considered relevant to the risk assessment of an autoclave installation. A subset of these inputs was selected to illustrate the knowledge mapping process.

The instructions for knowledge mapping were introduced using a simplified knowledge map template,18 which assessed knowledge type (explicit or tacit), knowledge flow, and knowledge quality.

Explicit knowledge was defined as codified knowledge (i.e., something written down in a document, a video, or an image), whereas tacit knowledge was defined as the knowledge in people’s heads (i.e., know-how, experience, expertise).

Knowledge flow was defined as to whether the knowledge was available and accessible on demand. Knowledge quality was defined as the knowledge being reliable for intended use, having sufficient context and rationale, and being complete and accurate.18 Qualitative descriptions were provided for each of three levels of flow and quality, ranging from poor to marginal to excellent.

The facilitators presented an example and mapped five knowledge inputs, covering both types of explicit and tacit knowledge. The first three knowledge inputs were mapped using an interactive poll designed to solicit perspectives from the participants to illustrate the current state of process knowledge on design and validation documents for facilities and utilities; prior knowledge/lessons learned from attendees or other sites; and routes for contamination/contamination control.

Two additional inputs were mapped in the session through an exchange of dialogue between facilitators (Mulholland as QRM expert and Lipa as KM expert), designed to illustrate to the participants the deeper thinking and discussions that should occur during a knowledge mapping exercise. These inputs were product/process knowledge; QRM documents from product/process development; and process knowledge: system integration requirements (e.g., manufacturing execution systems, electronic batch records, building management system).

Knowledge Map Results and Key Insights

Almost all attendees provided responses for the first three knowledge inputs. Although the sample size was small, the results are in line with Lipa’s previous experience. The authors propose the following insights:

• The flow and quality of explicit knowledge are markedly higher than that of tacit knowledge.
• Although results for explicit knowledge flow and quality fared better than that of tacit knowledge, there is clearly an opportunity for improvement, as on average just over half of respondents rated flow and quality as excellent, with a substantial percentage rated as only marginal or poor.
• Tacit knowledge flow received the lowest ratings, suggesting this may be an area for focus and improvement.
• Participants rated communication and lessons learned between sites as poor.
• There was a concerning marginal/poor rating of both tacit and explicit knowledge flow and quality, given the process importance of the equipment application and its role in the contamination control strategy, suggesting that even for critical processes, there may be gaps in information quality and reliability.

Knowledge Mapping: Potential Value for QRM

At the completion of the activity, the participants were asked to reflect on the utility of knowledge mapping as demonstrated through the case study exercise. They were asked the following questions via a survey about knowledge mapping.

In response to the first question, “Does knowledge mapping help you think more expansively about QRM knowledge?,” 97% of participants agreed or strongly agreed that it does.

Additional responses to other questions suggest that knowledge mapping has a significant potential utility in supporting QRM: 93% agreed that knowledge mapping can help recognize gaps in explicit knowledge; 86% agreed that knowledge mapping can help recognize gaps in tacit knowledge; 83% agreed that knowledge mapping can be used as a template or checklist to support QRM; and 97% agreed that knowledge mapping can highlight opportunities to improve KM.

• 7 a b c
• 12Mulholland, V., and A. Greene. “Quality Risk Management: Seeking the Diamonds: Making the Case for Improved Formality in QRM Decision-Making.” Level 3 15, no. 2 (2020): 18. https://arrow.tudublin.ie/level3/vol15/iss2/18/
• 13Mulholland, V., A. Greene, and M. J. Lipa. “Steps Beyond Risk Assessment in QRM: RBDM, The Next Horizon.” Level 3 16, no. 1 (2021). https://arrow.tudublin.ie/level3/vol16/iss1/2/
• 14International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use. ICH Harmonised Tripartite Guideline. Pharmaceutical Development Q8 (R2). https://database.ich.org/sites/default/files/Q8%28R2%29 Guideline.pdf
• 11
• 2
• 15World Health Organization. WHO Guidelines on Quality Risk Management. Annex 2. WHO Technical Report Series No. 981. 2013: 61–92. https://www.who.int/publications/m/item/trs-891---annex-2-who-guidelines-on-quality-risk-management
• 16Wall, K. D. “The Kaplan and Garrick Definition of Risk and Its Application to Managerial Decision Problems.” July 2011.
• 18 a b c d
• 5
• 17American Productivity and Quality Center. “Great Process Improvement Begins With Knowing Your Knowledge Gaps.” Accessed 7 December 2021. https://www.apqc.org/blog/great-process-improvement-begins-knowing-your-knowledge-gaps

Finally, the participants were asked what other three applications (e.g., processes) might benefit from knowledge mapping. Figure 5 suggests recognition of the opportunity for knowledge mapping to benefit change control, technology transfer, deviation management and investigations, and CQV (commissioning, qualification, and validation). This demonstrates other areas of opportunity and potential further study.

Figure 5 shows an additional seven processes that could benefit from knowledge mapping. In addition, the following applications/processes received one vote each from participants during the survey, identifying additional opportunities:

• Assessing standard operating procedures
• Audit program
• Continuous improvement
• Continued process verification
• Data analysis
• Environmental monitoring
• Gaps in subject matter expert knowledge
• Global supply chain
• IT compliance
• New equipment/laboratory project
• New facility design
• Post-market surveillance
• Product teams that share knowledge across multiple sites

Exploring RKI Cycle Node 4

Node 4 of the RKI Cycle is labeled “acquire, grow, capture and retain new knowledge” (see Figure 2). The scope of this knowledge is not exclusive to QRM knowledge; node 4 is the primary injection point of product and process knowledge because it is acquired during development and commercial manufacturing from many diverse processes.

The focus for this workshop was primarily the knowledge generated by the QRM process to explore what knowledge is generated (node 3) and how it flows into KM (node 4). Recognizing the RKI Cycle is a continuum connecting knowledge and risk, the analysis of node 4 is tightly linked to node 3. Node 3 represents the generation of the knowledge from the QRM processes (i.e., new knowledge from QRM and “what has one learned”), whereas node 4 is the intake of this knowledge into KM (i.e., as a means to ensure this knowledge is available in the future to those that need it).

Knowledge as an Output from QRM

In regulatory guidance, it is evident that knowledge is an expected output from QRM, both from the QRM process activities (e.g., risk assessment results) and the knowledge created as a result of the risk management process (e.g., additional studies). For instance, ICH Q8(R2)14 says pharmaceutical development “provides an opportunity to present the knowledge gained during application of scientific approaches and QRM.” It also states, “appropriate use of QRM principles can be helpful in prioritising the additional pharmaceutical development studies to collect such knowledge.”

WHO Guidelines on Quality Risk Management–Annex 215 says that “the QRM approach may be used to…facilitate the transfer of process knowledge and product development history to ease product progression throughout its life-cycle and to supplement already available knowledge about the prod-uct.” Also, “early in development, the purpose of the QRM process may be to acquire sufficient product and process knowledge to assess risks associated with [the process].” The WHO Guidelines also say, “a crucial aspect of product development and QRM is the maintenance of an effective and secure knowledge management and documentation system.”

KM Process Model

The presenters provided a simplified version of the KM process model (Figure 6)4 to introduce the participants to the model and the underlying intent that KM is intended to enable knowledge to flow to the right person, at the right time, to inform the best decision.

The KM process model illustrates that many processes—inclusive of QRM—generate knowledge that should flow into KM, and subsequently use (ap-ply) knowledge available through KM—also inclusive of QRM. The authors believe that herein lies the opportunity regarding QRM knowledge flowing in through node 4: How this knowledge can be captured and made available for the future to better inform the next risk assessment, to optimize risk controls, and to enhance risk communications—all to support RBDM and the opportunity to minimize the risk of harm to the patient.

Exercise 2: Exploring Knowledge Generated During QRM

The authors believe that current QRM activities typically focus heavily on risk assessment (as part of node 2). Although risk control, risk communication, and risk review are also part of the QRM process, these activities should evolve and be enhanced as knowledge grows, and the RKI Cycle provides a methodology to ensure this. In addition, the recurrent nature of the RKI Cycle also promotes a reevaluation of the risk assessment as knowledge grows. 19

Exercise 2 was designed to explore this premise with a view to informing future research, while also providing a networking opportunity for the participants. To this end, the facilitators set up three breakout topics for six teams (two teams per topic). The participants were asked to answer the following questions:

1. What knowledge is created during a QRM exercise?
2. What is the role of KM in risk review?
3. What is the role of KM in risk communication?

The feedback from the participants is summarized in the following sections and will inform ongoing research on the operationalization of node 4.

• 14
• 15
• 4
• 19Lipa, M. J., P. Kane, and A. Greene. “Advancing Competency in Managing Risk and Knowledge: Steps Toward Operationalisation of the Risk-Knowledge Infinity Cycle (RKI Cycle)–Part 1: Improving effectiveness of Risk-Based Decision Making (RBDM).” Technological University Dublin. 2022. doi: 10.21427/JV8W-0272.

What knowledge is created during QRM activities?

Table 2 presents the combined output from the two teams assigned to this question. The responses are unaltered quotations from participants, aside from removing duplication, making grammatical edits, and grouping related remarks.

The breakout teams also shared the following comments:

• “Knowledge mapping process can also highlight where the weaknesses might lie within business processes.”
• “A risk that it is more difficult to actually digest all this ‘new’ information [explored during quality risk assessment (QRA)] and communicate it effectively.”
• “The issue of confidentiality of this information can be a key issue. Making it visible and accessible can be a problem. Need to be careful about the level of availability/liability issues of data/knowledge that has not been reviewed by the ‘sponsor.’”
• “Also need to consider what might be available for auditors and inspectors to review [of the additional knowledge captured during QRA].”
• “Are we good at disseminating these details in QRM documents (QRM tools/meeting minutes)? Maybe good at flow/dissemination but doesn’t always meet the knowledge quality criteria in the knowledge transfer; not always good at sharing this. Sometimes the context and ‘metadata’ about the issue under review is not embedded in the knowledge capture, makes it difficult to reuse.”

What is the role of KM in risk review?

Table 3 presents the combined output from the two teams assigned to this question.

What is the role of KM in risk communication?

Table 4 presents the combined output from the two teams assigned to this question. The responses are unaltered, aside from removing duplication, making grammatical edits, and grouping related remarks.

Conclusion

There are substantial benefits, and an emerging expectation, in using knowledge to inform risk management and RBDM. Both the RKI Cycle and KM can play a major role in providing the best knowledge to make the best decision in the interest of the patient. Tables 5 and 6 summarize the insights gained during the two exercises.

Taken in aggregate, these insights confirm the potential for the RKI Cycle to be an integral part of the solution in better uniting risk and knowledge to lead to more effective RBDM. The exercises during the session, in particular the knowledge mapping exercise associated with node 1, provide tangible means as to how the RKI Cycle can be operationalized in support of RBDM. Exercise 2 will inform ongoing research for the operationalization of node 4.

This session also revealed the opportunity for several potential next steps, including building awareness of and competency in knowledge mapping, extending knowledge mapping to additional applications (e.g., change management, technology transfer), the opportunity to improve risk communication and risk review through KM practices, and continued definition of steps to further operationalize the RKI Cycle.