Risk-based quality management – the new magic phrase  in clinical research

The concept risk management has been discussed in the context of clinical research now for several years. On this subject, various guidelines have been published which were met by varying degrees of interest in the specialist community.

Among the best known guidelines are:

Risk-based Quality Management becomes a legal obligation

Also the new EU Clinical Trials Regulation No. 536/2014⁴ clearly shows a trend away from a “one size fits all” strategy for the planning and performing of a clinical trial: by introducing the “low intervention trial” category, the regulation diverges from a standardized procedure for all clinical trials.

This new approach takes into account that the risk profile and practical requirements of a first-in-man study significantly differ from those of a phase IV trial with an authorized drug.

Similarly, the regulation describes that the extent and type of actions regarding e.g. adverse event reporting (article 41), handling of investigational drugs (article 51), monitoring (article 48) und trial master file (article 57) should be tailored towards the particularities of the trial.

In its consultation document “Risk proportionate approaches in clinical trials”⁵ which was open for consultation until the 31st of August 2016, the EMA Expert Group gives advice on the implementation of the Clinical Trials Regulation No. 536/2014. Among other things, the paper gives examples on how a risk-based approach can be applied for “low intervention” trials with respect to the above mentioned areas of clinical research.

Most importantly, the risk-based quality management approach will also be incorporated within the “bible of clinical research”, i.e. in an addendum to the ICH Guideline for Good Clinical Practice (ICH-GCP). The draft version of the revised ICH-GCP Guideline⁶ has already completed the public consultation process. However, according to this years’ EUCROF Conference on Clinical Research, the final version of the guideline which was originally planned for November 2016 may take as long as mid-2017.

The addendum takes the subject risk management to the next level, and keep in mind that both, by the “old” (current) legislation (AMG §40(1)) and by the new Clinical Trials Regulation (article 47) the principles of Good Clinical Practices of ICH are legally binding. Thus, the implementation of a risk-based quality management for a clinical trial no longer remains within the judgement of the sponsor but actually becomes a legal obligation.

Even more: the final clinical study report in future has to include a description of the performed risk assessment and quality management approach as well as a description of important deviations from the predefined quality standards. And, last but not least, auditors and inspectors – who base their valuation mainly on ICH-GCP guidelines – will also take this aspect into account for their judgement.

An individualized quality management system for each clinical trial

The objective of the revised ICH GCP Guideline is clearly defined: each clinical trial should have a corresponding quality management system which covers the trial as a whole – from its design, conduct, analysis and report to its archiving process.

Experts advise that the system should involve an interdisciplinary team from medicine, project management, data management, biostatistics, IT and pharmacovigilance. Further, they recommend that the design of the quality management system should be adjusted to the relevance of the collected data and the inherent risks of the trial.

However, the thereby used risk-based approach is nothing new but is known from the industrial sample-based quality control (e.g. ISO norms) as well as from the development of IT systems (e.g. GAMP-5). For a successful implementation of a risk-based quality management approach for your trial, comply with the following steps:

Critical steps for a successful implementation of a risk-based quality management approach

Step 1: identification of critical processes and data

In a first step, it is necessary to analyze the characteristics and special features of your trial protocol, patient population, test product, participating sites etc. Thereby you can identify “critical” parameters and procedures in your study, i.e. features that are crucial for the safety of your patients and the reliability of your study results.

In general, critical data include e.g. the (main) target parameters, serious adverse events, data for randomization and blinding, the availability of an informed consent, and the compliance with the patient selection criteria.

Step 2: identification of risks

Once critical characteristics and processes have been defined, you need to analyze their potential risks for the study participants and the validity of your data. Risk relevant aspects can depend on properties of the recorded data, on specific activities during the data collection and on specialties of the protection for your study participants.

Identify the potential hazards of your trial by asking “what could go wrong?”.

Step 3: evaluation of risks

Now that you have identified the potential risks in your study, you need to evaluate them: assess the probability of their occurrence, their implications and the probability of detecting the resulting damage.

Ask yourself how likely it is that a specific risk will pop up. If the risk actually turns up, what is the potential damage? And is there a chance to detect the occurrence on time or even at all?

Step 4: risk control

On the basis of your risk evaluation, in a next step you need to decide which risks are negligible, i.e. acceptable, and which risks demand for a controlling process. Clearly define the risk level which is still acceptable and from which point on you will initiate preventive or corrective actions in order to reduce or eliminate the hazard.

If you decide on risk minimizing actions, don’t forget to document them e.g. in the protocol, the monitoring plan, contractual agreements on functions and responsibilities, and the training plan. In case that during the trial a risk exceeds the defined risk level, the process automatically asks for the determination of corrective actions.

Step 5: risk communication

Always make sure to continuously document and communicate all risk-based quality management related activities. Only then you can guarantee for transparency and common processes that facilitate the smooth conduct of your study.

Step 6: risk review

Risk control is a crucial process throughout your entire study – from its design and conduct to its analysis and final study report. It is important to continuously review and, if necessary, adapt your predefined risks, their evaluation and their corresponding risk tolerance levels. Naturally, during the course of the trial new risks might arise, other risks might become less relevant or might need an adaptation of their risk acceptance level.

Step 7: reporting

As mentioned above, in the final clinical study report describe the specifically performed quality management approach and clarify important deviations from your predefined tolerance limit.

Think risk-based all the way!

At the moment, many sponsors and CROs are on the way to develop their system for the implementation of a risk-based quality management. Certainly it has always been a goal to minimize potential risk in clinical trials. And errors occurring during the course of the study have been followed by a CAPA (Corrective and Preventive Action) process already in the past.

However, unlike the procedure up until now, the described risk-based approach is based on a systematic, structured and documented examination method which takes place in the run-up to the beginning of the study. To summarize with a quotation: “Think risk-based all the way!”⁷!

Different templates are available, e.g. by TransCelerate⁸ and ECRIN⁹ that might help you with the definition of critical data and processes as well as risk indicators for your clinical trial. However, it will be a challenge to deal with the (different) subjective evaluations of the risks’ seriousness, the risks’ probabilities and the probabilities of error detection.

The above mentioned interdisciplinary “risk expert group” will be essential for a consolidated outcome. It is essential to recognize, to minimize and to control the most important risks – we have to live with the additional existing risk of potentially neglecting risks that have been evaluated as less important or irrelevant.

Picture: @Gajus /Fotolia.com