Why do we not risk assess?

I have recently been thinking about difficulties companies face with Quality Risk Management. It seems to me that businesses can de-prioritise quality inspections because the regulatory requirements and the business’ objectives do not, on the face of it, align. This misalignment ensures that systemic weaknesses can develop in the assessment process which can manifest as human failings when assessments are carried out (or not), masking the underlying system problems.

It may not be immediately apparent that the regulatory requirement for a Quality Risk Management Process is actually much more aligned with business objectives than many first believe. Risk Management strategies are now a business ‘way of life’ and are routinely incorporated in the decision making, projects and processes of successful companies.

Of course, this article could just as easily be referring to ‘why do we not do self-inspections?’ or ‘why do we not record our ad hoc training opportunities?’ and a host of other things. Sometimes laziness (or indeed other human failings) can be just that, laziness, and it should be called out for what it is. But, by only reacting to the surface level, there is a big danger of scapegoating the individual concerned and not uncovering a problem that will occur again and again.

In my experience, lack of risk assessments is a common problem. I have seen it as a GDP Inspector, as a Consultant and as a Responsible Person. You may also have seen it too. So, let’s have a look at some of the reasons why, the potential underlying cause and some thoughts that may help you resolve them.

Laziness

Almost top of the list but although a surface level problem, in my experience, not usually the underlying reason. Determining that staff are lazy is often a misinterpretation of a situation where staff are not suitably guided and maybe do not really understand the requirement. Looking for the root cause must be a key focus here.

‘I didn’t know we had to’

Section 1.5 of GDP suggests Quality Risk Management ‘should’ be done with the level of effort commensurate with the level of risk. Is this being interpreted incorrectly due to the lack of a ‘must be done’.

A little more reading on pages 60-61 and 66-70 of the Green Guide (Rules and Guidance for Pharmaceutical Distributors 2022) introduces examples that indicate the need to do this.

A useful interpretation of ‘should’, as compared to ‘must’, would be to consider all those things described as ‘should’ are to be done to remain compliant; unless there is another better way of achieving the same result.

Once again, we have a surface level problem of pleading ignorance and a search for the underlying cause will be useful.

‘I know the outcome will be bad (ie. a high risk)’

It is natural to be fearful of a bad outcome. You may see staff delaying doing the risk assessment until some remedial measures have been put in place, resulting in a risk assessment with a more palatable outcome.

Do not be tempted to put measures in place that will avoid a bad outcome without fully appraising the risk. Those measures may not be the best options and could have little effect on the risk or, worse still, increase the risk.

The best approach here is to recognise, at management level, that we have potential quality risks in distribution; in just the same way the company consider financial risks, health and safety risks, commercial risks and marketing risks. We recognise that we may have to put in considerable effort to resolve these risks. This effort needs to be carefully thought through, based on the real/potential root cause. Only a thorough risk assessment can ensure the corrective measures are appropriate.

‘I already know what is high risk and can resolve this without writing it down’

We naturally conduct risk assessments in our day-to-day activities without having to complete a record of the assessment. It can seem unnatural to then have to formalise this. This reason probably goes hand-in-hand with the previous reason ‘knowing the outcome will be bad’. It can be difficult to see our potential failings laid bare in black and white.

Remember though, that formalising a risk assessment can ensure you are clear about what you need to achieve. You now have quantifiable evidence on which to carry out your action plan. The licence holder may need to provide resource and a clearly defined and risk assessed plan will be more likely to sway the licence holder.

Again, different personalities and work methods might struggle to break the habit. This can be encouraged by the manager setting a good example. The wider use of risk management strategies in the business can make good examples.

‘I don’t know where to start’

Most of us have been there. Some develop their approach when young, such as tackling GCSE revision. Others build an effective strategy later in their career and reach their goals.

Maybe compare this with the conundrum ‘how do you eat an elephant?’. The answer is either ‘get more people to help you’ or ‘eat it one piece at a time’.

Using this type of strategy can take years to develop, especially for those who are uncomfortable asking for help or who are easily daunted by a huge workload. Setting a good example should be a key role of the manager, recognise that staff will need support for an unfamiliar task, no matter how much training they have had.

‘We don’t have a written procedure’

So, the correct response here is to write that process; but this is also not easy.

The important thing is to remember that the first draft of a process is likely to be missing some finer points. Seek help from others. Aim for a written procedure that requires processes to be examined for Critical Control Points (CCPs). Then ensure the next step is to examine those CCPs for what might go wrong; always taking into account the root cause.

Quantify the risk in terms of severity, likelihood (or frequency/probability) and how easy it would be to detect when this failure has occurred. The action plan must address the root cause and should be a workable plan.

‘The written procedure is too difficult’

As stated above, the first draft is probably not your final written procedure. Consider if you are still in this development stage. Revise the written procedure with those who will be following it.

Have you found some of these to be familiar reasons why you or your colleagues do not risk assess? Starting to understand the reasons why can be halfway towards solving the problem.

Resources

ICH Harmonised Guideline: Quality Risk Management Q9(R1)
ICHQ9R1
At the time of writing, this revision is still in draft.

Rules and Guidance for Pharmaceutical Distributors 2022
The MHRA have suggested a revised guide will be published in 2025. Until then, you will find this 2022 version helpful.

SeerPharmaUK one day training course – Quality Risk Management in Distribution
Quality Risk Management in Distribution course
SeerPharmaUK offer a range of training courses as well as bespoke training. Visit our training page for more details or contact us directly for more information about how we can help.

Learn from the people who know

SeerPharmaUK offer a range of training courses as well as bespoke training. Visit our training page for more details or contact us directly for more information about how we can help.