Risk Management for Avoidance of Drug Shortages

To support development of the revision and rollout of ICH Q9(R1), ISPE formed teams to compile comments on the ICH Q9(R1) draft guideline and to prepare examples for potential inclusion in ICH training material. Presented here is a summary of the work from members of the ISPE team on risk management for drug shortage avoidance, initiated for potential inclusion in International Council for Harmonisation (ICH) training material. The team members who developed this approach came from diverse organizations, backgrounds, and expertise—not unlike a well-designed risk assessment team.

The application of formal risk management activities for drug shortage avoidance has historically been an internal industry business practice, with few published examples or clear industry standards. This article presents a general approach for assessing and mitigating the risk of drug shortages through a product’s supply chain and over the product’s lifecycle.

The approach is expected to be applicable over all pharmaceutical modalities (e.g., small molecules, biologics, cell and gene therapies), all stages of manufacturing (e.g., drug substance, drug product, packaging), and over the lifecycle of the product. It can be considered part of business continuity planning, as related to drug shortage prevention.5

Furthermore, the ISPE team believes that the approach presented here is consistent with recent expectations for risk management plans (RMPs) by the US Food and Drug Administration (FDA)6 and for shortage management plans (i.e., plan de gestion des pénuries - PGP) by France’s National Agency for Medicines and Health Products Safety (ANSM).7 The approach presented here is intended to be an example and is not the only way to address risk management for drug shortage avoidance.

Overview of the Risk Management Approach

The approach developed by the ISPE team to address risk management for drug shortage avoidance follows the general approach outlined in ICH Q9(R1) and is summarized in Figure 1. As described in ICH Q9(R1), considerations in risk management should include the appropriate level of formality and manage and minimize subjectivity.

• Initiate quality risk management process: Initiation of a quality risk management process begins with evaluation of the priority of products to inform the appropriate level of risk management. The evaluation of priority can include factors such as importance to the patient from a therapeutic perspective, regulatory requirements, and business significance. The scope of the evaluation can cover the entire supply chain for a product or be limited (e.g., single manufacturing site).
• Risk assessment: For each product labeled as a priority, a risk assessment is conducted: hazards are identified, potential risks are analyzed using the likelihood and potential impact of the hazards, and all are evaluated against predetermined criteria. Risks to supply continuity are addressed by identifying product/process and business/operational hazards and analyzing those hazards over the manufacturing operations and for the manufacturing materials and components. In the approach presented here, the potential hazards are considered using a generic approach that is applied to segments, or nodes, of the manufacturing process.
• Risk control: Following the assessment of risk, risk controls are established and are the output/results of the quality risk management process. Mitigation plans with preventive measures are developed and implemented as a part of business continuity planning to reduce the risk of supply disruptions.5 Preventive measures could include proactive or on-demand interventions. Because risk is never zero, there is a need for risk acceptance of residual risk after the mitigation efforts. Generally, there is a lower risk acceptance tolerance for higher-priority products.
• Risk communication: Risk communication occurs throughout the risk management process, including internal communication of the findings from the assessments and controls and external communication with health authorities, as appropriate. The risk management process helps provide a structured approach that enables more effective communications.
• Risk review: Over the lifecycle of the product, risks and preventive measures should be reevaluated on a periodic or event driven basis, with the risk assessment and risk controls being updated, as appropriate.

The next sections offer more detail on the individual steps of the risk management approach for drug shortage avoidance.

Steps of the Risk Management Approach

Initiate Quality Risk Management Process

Determination of products for risk assessment

Not all products have the same magnitude of impact when they become unavailable or have the same susceptibility to significant supply disruption. Accordingly, the appropriate level of risk management is optimally established based on the therapeutic importance of the product, related regulatory expectations, and potential business and operational considerations.

Prioritization for risk management activities ensures the most significant products have optimal supply resiliency support and that correlating investments are sustainable. Priority of individual products should be assessed periodically because clinical, regulatory, and business and operational perspectives will change over their lifecycle and the changes may not have a consistent trajectory.

Considerations for product prioritization include, but may not be limited to:

• Therapeutic importance: patient population, indication, dosage form, alternative therapy, generic availability, emergency use, product seasonality
• Regulatory requirements: part of a national stockpile, on a governmental prioritization list
• Business/operational considerations: market share, revenue position, failure-to-supply agreements, operational interconnections to other products, time/complexity to manufacture resupply

• 5Hustead, D. L. “Business Continuity Planning to Prevent Drug Shortages.” Pharmaceutical Engineering (January/February 2021).
• 5
• 6US Food and Drug Administration. “Risk Management Plans to Mitigate the Potential for Drug Shortages: Draft Guideline for Industry.” May 2022. www.fda.gov/regulatory-information/search-fda-guidance-documents/risk-management-plans-mitigate-potential-drug-shortages
• 7Agence nationale de sécurité du médicament et des produits de santé. “Disponibilité des médicaments : l’ANSM publie les lignes directrices pour l’élaboration des plans de gestion des pénuries.” Mar 2022 Actualité - Disponibilité des médicaments : l’ANSM publie les lignes directrices pour l’élaboration des plans de gestion des pénuries. https://ansm.sante.fr/actualites/decision-du-21-07-2021-fixant-les-lignes-directrices-pour-lelaboration-des-plans-de-gestion-des-penuries-en-application-de-larticle-r-5124-49-5-du-code-de-la-sante-publique

This prioritization exercise should include individuals with the appropriate knowledge, such as those in medical, regulatory affairs, supply chain, and marketing.

Many products cannot clearly be designated high priority or low priority. In such cases, the relative priority of the product should guide the decision process for the appropriate levels or layers of risk reduction to be applied. Discretionary risk management activities may always be applied to low-er-priority products to ensure greater reliability and supply resiliency across the portfolio.

Determination of sites and markets for risk assessment

Pharmaceutical supply chains typically are highly complex; that complexity can make the task of an end-to-end risk assessment for drug availability seem overwhelming. A risk assessment can be conducted for only a portion of the supply chain (e.g., for a single facility or destination market), although an end-to-end assessment can provide a more holistic overview of potential risks and reveal interdependencies. To help structure the risk assessment approach, the ISPE team recommends characterizing the supply chain using manufacturing nodes for the assessment.

Typical pharmaceutical manufacturing steps include drug substance, drug product, and packaging, illustrated as nodes in Figure 2. For the purposes of the risk assessments in this approach, a node is inclusive of transportation from the end of the previous manufacturing step to the current step. Although the product is ultimately distributed to the patient, pharmacy, or hospital, the control of product by the pharmaceutical manufacturer usually ends at transfer of the product to a distributor. Transportation from the packaging site to the distributor is included as a non-manufacturing node called “final product distribution logistics” in Figure 2.

Actual pharmaceutical supply chains are much more complex than the linear description in Figure 2. A hypothetical example of a typical pharmaceutical supply chain for a major product is shown in Figure 3. Because each manufacturing location can have unique risks, the ISPE team recommends that each manufacturing site be considered a separate node in the risk analysis. It may be possible to use a common risk assessment for similar products or the same manufacturing sites. For example, drug products with similar storage conditions that have a common site, materials, and equipment for packaging will likely have identical risks at the packaging node.

When multiple manufacturers contribute to the drug’s supply chain, an important consideration for regulatory compliance is which manufacturers need to perform risk assessments. US law requires manufacturers of covered drug products and manufacturers of associated active pharmaceutical ingredients (APIs) to establish “redundancy risk management plans.”2 Covered drug products are considered those that are life-supporting or life-sustaining, or intended for use in the prevention or treatment of a debilitating disease or condition (including those used in emergency medical care or during surgery), or those that are critical to the public health during a public health emergency. The associated FDA draft guidance for risk assessments6 defines different levels of stakeholders (i.e., primary, secondary, other) and explains that primary and secondary stakeholders are required to prepare RMPs for covered products.

In France, the expectation is that drug product manufacturers prepare a shortage management plan (PGP) for designated products,7 including evaluation of drug substance, drug products, and critical components. Designated products are defined as drugs or classes of drugs of major therapeutic interest (MITMs) for which interruption of treatment is likely to endanger the prognosis of patients in the short or medium term, and/or increase the severity or potential progression of disease.

Good communication between manufacturing sites is essential in effective risk management, regardless of who prepares the risk assessments at each node. Although the FDA draft guidance calls for the primary stakeholder (e.g., application holder) to communicate as much of their risk assessment as possible with secondary stakeholders, the ISPE Q9(R1) team believes that two-way communication is essential.

To determine their regulatory obligations, contract manufacturing organizations (CMOs) of drug substances need to know from the drug product manufacturers how their drug substances are used. Similarly, drug product manufacturers need to understand the manufacturing risks from their drug substance CMOs. Two-way communication between CMOs and their clients can lead to holistic and comprehensive risk management approaches.

Prepare for the risk management process

Good preparation is essential for a meaningful and fair risk assessment. Before starting any risk assessment exercise, a clear problem statement or risk question should be posed; for example, “For this particular manufacturing site, what potential hazards might have a significant impact on the availability of a drug substance?” Additionally, the assumptions and constraints should be identified; for example, if the assessment will include the risks from steps managed under CMOs.

Next, the level of formality should be determined, which will inform the amount of detail and documentation associated with the risk assessment. Typically, the degree of formality is commensurate with the criticality of the matter being addressed. Assessment tools with clear definitions of risk levels should be chosen, then aligned with the level of formality.

Examples of assessment tools for quality risk management are provided in Annex I of ICH Q9(R1).4 Finally, the individual or team designated as the approver, or decision-maker, of the risk management activity should be determined prior to starting the risk assessment process.

The risk assessment team should be cross-disciplinary, diverse, and include subject matter experts (SMEs) from a broad array of functions throughout the organization, such as manufacturing, medical affairs, procurement, quality, regulatory affairs, sales and marketing, supply chain, technical and manufacturing operations, customer relations, external business partnerships, and legal.3

The setting for risk assessments should facilitate continuity of information flow, such as in-person meetings or appropriate online tools (e.g., electronic whiteboards). Ideally, the risk assessment team should be led by a skilled facilitator who understands the technical content of the discussion but can remain neutral. It also can be beneficial to have an objective observer from outside the team to provide an independent voice and challenge assumptions. Use of a skilled facilitator and an objective observer can help reduce subjectivity.

Subjectivity can lead to decision-making based on individual biases and opinions rather than the collective facts and data. The strategies discussed in this section can help reduce subjectivity, but it can never be eliminated. Training can help the risk assessment participants identify and minimize subjectivity. Finally, the decision-maker or approver of a risk assessment should ensure that subjectivity is appropriately managed.

• 2
• 6
• 7
• 4
• 3

Review of the RMPs for drug shortage avoidance should occur both on a periodic and event-driven basis.

Risk Assessment

Hazard identification

For the analysis at each node, the ISPE team employed an approach commonly used to address quality issues called an Ishikawa diagram (also called a cause-and-effect or fishbone diagram),8 shown in Figure 4. The hazard is defined as supply disruption leading to the patient not receiving their medication, which can, in turn, lead to patient harm, such as disease progression or life-threatening situations. This Ishikawa diagram lists potential hazards (i.e., the causes) that could lead to supply interruption (i.e., the effect). The factors in Figure 4 are grouped into categories of potential causes represented by lines leading into the spine. The categories include traditional ones (i.e., material, method, measurement, machine) and some that were added or modified for this specific purpose (i.e., management, major event, market).

Figure 4 is a generic diagram, intended to be used as a starting point for the hazard identification step of a risk assessment for drug shortage avoidance. Not all potential hazards will be applicable to all products, and additional hazards may apply. Furthermore, many other risk assessment tools other than the Ishikawa diagram can be used for assessment of hazards to drug availability, like a preliminary hazard analysis.

Risk analysis

The Ishikawa diagram in Figure 4 can be used as a risk assessment tool and starting point for the risk analysis. Using a group of knowledgeable SMEs in an environment to minimize subjectivity, this assessment tool can be applied at each node of the manufacturing process to identify which potential hazards are most likely to cause a supply disruption, based on the likelihood of occurrence of the hazard.

The ISPE team does not recommend a detailed spreadsheet be made that includes every potential hazard at each node and justification as to why each hazard was or was not relevant. Such efforts could be overwhelming and add little value to the process considering the complexity of pharmaceutical supply chains. Rather, it is recommended to focus on the hazards that are most likely to lead to supply interruption.

Risk analyses often include a quantitative calculation of the likelihood of occurrence of the hazard and the significance of its effect. However, such a calculation for drug shortages can be challenging because there are numerous factors involved in any potential hazard that can affect the extent or duration of the supply disruption, and its subsequent impact for patients. Consequently, it may be beneficial to use more qualitative ratings (e.g., high, moderate, low) to categorize the potential impact of the identified hazards. Examples of scenarios and their associated ratings based on past experience can help provide consistency between the risk assessments performed for different products or by different teams.

Risk evaluation

The quantitative risk score or qualitative risk rankings are compared against predetermined criteria to make decisions. The threshold for applying risk reductions could be dependent upon the risk priority, as part of the business continuity plan. [5]. Lower-priority products can tolerate a higher level of risk before triggering risk reduction activities.

Existing mitigations are considered part of the risk evaluation: for example, stockpiling, manufacturing redundancy, and reserve capacity. The expected time needed to recover from a potential hazard leading to a supply disruption should also be considered as part of the risk evaluation.

An example output from a simplified risk evaluation for an aseptic filling operation is presented in Table 1. Only the potential hazards that have a moderate or high inherent level of risk are included. A risk level is determined based on current mitigations, such as stockpiling or alternate sources. If a moderate or high level of risk exists after current mitigations, further mitigations could be merited, as discussed in the following section.

Low = unlikely failure
Moderate = possible failure
High = actual or likely failure

Risk Control

Risk reduction

Robust risk reduction of potential drug shortages is most successfully achieved with layers of preparedness, including the organizational, operational, and product-specific levels over multiple areas of pharmaceutical manufacturing, as described in the ISPE Drug Shortages Prevention Model.9

Organizational- and operational-level risk reduction activities are typically expansive, multidisciplinary undertakings that cut across products and operations. For example, organizational aspects could include investment in workforce capability and quality culture, whereas operational aspects could include supply, demand, and quality monitoring systems with early warning capability for rapid identification of disruptive events. 

• 8Ishikawa, K. Guide to Quality Control. Asian Productivity Organization, 1976.
• 9International Society for Pharmaceutical Engineering. 2023 ISPE Drug Shortages Prevention Model. North Bethesda, MD: International Society for Pharmaceutical Engineering, 2023. https://ispe.org/publications/guidance-documents/2023-ispe-drug-shortages-prevention-model

Risk management for the avoidance of drug shortage is increasingly a regulatory expectation, as evidenced by recent laws in the US and France and the inclusion of this topic in ICH Q9(R1).

ISPE has several programs and initiatives that can help assure continued supply of quality product and contribute to organizational and operational preparedness, including:

• ISPE Drug Shortages Prevention Model9
• ISPE Advancing Pharmaceutical Quality, which is a comprehensive program for assessing and improving an organization’s quality management maturity, including guides on Change Management System,12 Corrective Action and Preventive Action (CAPA) System,10 Management Responsibilities and Management Review,11 Process Performance and Product Quality Monitoring System,13 and Cultural Excellence14
• ISPE Pharma 4.0^TM, which enables organizations to leverage the full potential of digitalization to provide faster innovations for the benefit of patients15
• ISPE Product Quality Lifecycle Implementation (PQLI®), which works at the nexus of pharmaceutical manufacturing and regulation to bring forward solutions that help advance new regulatory and technology approaches16

Product-specific risk reduction plans rely on the general organizational- and operational-level risk reduction measures. Proactive product-specific interventions and/or on-demand interventions can be applied to minimize disruptive events, as described next.

Proactive product-specific interventions:

• Early alert system: Embedded data collection and analysis to rapidly identify and facilitate response to potential or actual supply disruptions
• Stockpiling: Reserve stores of critical components and drug substances for further processing and/or reserves of finished drug product that could provide coverage for an extended period
• Safety stock: Term often used to describe an inventory buffer of drug product (i.e., shorter-term stockpiling)
• Flexible manufacturing: Manufacturing technology that allows for faster relocation (e.g., transportable modular manufacturing units) or rapid increase in scale (e.g., continuous manufacturing)
• Manufacturing diversity or redundancy: Increased assurance of supply continuity through a strategic geographical supply chain footprint, appropriate CMO alliances, and/or backup manufacturing lines and/or manufacturing sites, that ideally can be used with minimal or no regulatory impact
• Reserve capacity: Unused equipment time or operational shifts that can be expanded, typically with minimal to no regulatory impact
• Regulatory preparedness: Preagreement with regulators (e.g., postapproval change management protocol [PACMP]) to accelerate chemistry, manufacturing, and controls (CMC) filings for anticipated regulatory changes, such as for increased manufacturing scale or batch size or alternative manufacturing sites

On-demand product-specific interventions (often requiring regulator cooperation):

• Real location: Movement of materials from one market to another to compensate for a surge in demand (e.g., from a localized endemic)—if executed for product already manufactured; this approach may need agreement from regulators if the product appearance or label is not the same between markets
• Substitution: Alternate strength of the same product, which could be coupled with reallocation—requires discussion with regulators and possible communication with health care providers and patients
• Other regulatory assistance: Event-specific response—facilitated by early and transparent communication with the relevant health authority for event-specific responses such as import/export facilitation, regulatory discretion, accelerated reviews, or inspections17^, 18

In general, manufacturers should use the proactive product-specific interventions listed previously to ensure supply resiliency and reduce the likelihood of drug shortages. The extent to which the proactive product-specific interventions should be applied is dependent upon complex factors, considering patient needs, regulatory requirements, and business and operational considerations.

For critical medicines in urgent health conditions, such as endemic or pandemic situations, government agencies may also conduct their own stock-piling efforts. Although regulators are often able to make exceptions for urgent situations, the on-demand regulatory interventions listed previously should only be considered as a last resort for unplanned events.

The FDA draft guideline for RMPs recommends that manufacturers include plans to repair the supply chain after a disruption.6 Although anticipating all potential supply disruption scenarios is not possible, it can be useful to pre-plan multiple product-specific mitigation pathways and to understand their timelines and the efforts required for implementation. Simulated supply disruptive event exercises can help inform where risk reduction efforts may need to be adjusted. Ultimately, the product-specific mitigation pathways chosen during a supply disruption will depend on the specific circumstances.

Risk acceptance

Because some level of risk is always present, risk acceptance is an essential step of any risk management process. The designated approver of the risk management activity should understand and agree on residual risk. Generally, the priority of the product will guide the appropriate level of risk acceptance. While it is not typically required to document the residual risks, doing so can be helpful for future risk review efforts.

Risk Communication

Risk communication related to product availability should occur in multiple directions. Internally, it is important for all stakeholders (i.e., development, manufacturing, supply chain, compliance, regulatory) to understand the potential risks to product supply, know the mitigation plan, and align on acceptance of residual risks. Externally, suppliers and CMOs may need to be apprised of how their decisions can impact availability of finished products to patients.

The FDA draft guideline recommends that manufacturers of the final drug product share as much of their RMPs as possible with their CMOs. The ISPE Q9(R1) team believes that this information sharing should be reciprocal to facilitate coordinated risk mitigation plans for drug shortage avoidance. For example, preparation for potential increase in drug substance supply could be achieved through redundant capacity at a current CMO, by addition of an additional CMO or in-house manufacturing site, or by increased stockpiling.

Many health authorities have requirements for reporting actual or potential drug shortages.1 It is best to be transparent and early when discussing drug shortage issues with regulators and to have detailed information about the timing and magnitude of the shortage, ideas for mitigating the shortage, communication plans to health care providers and/or patients, and to share any ongoing actions.9^, 18 Although health authorities can optionally use enforcement discretion or regulatory flexibility to help mitigate shortages, it is the manufacturer’s responsibility to assure availability of product; they should not rely on regulators’ actions to resolve or avoid shortage issues.

In the past, communication of risks and mitigations related to drug supply have typically only occurred during a shortage or near-miss event. These communications will likely happen more frequently in the future, based on recent guidelines and the inclusion of the topic in ICH Q9(R1).4 For example, the French law requires communication of a manufacturer’s PGP on a yearly basis; FDA can review RMPs upon inspection.6^, 7

Risk Review

Review of the RMPs for drug shortage avoidance should occur both on a periodic and event-driven basis. The ISPE Q9(R1) team supports a risk-based approach for determining the frequency of the risk review, considering priority factors such as patient needs, regulatory requirements, and business and operational considerations. Events that could trigger a reassessment and revision of the RMP for drug availability include but may not be limited to an actual shortage or near-miss event, change in supplier, unfavorable internal audit or health authority inspection, natural disasters, and geopolitical events.

As shown in Figure 1, risk review could lead to a modification of the risk assessment or risk control steps. The information generated during the risk management activities includes important knowledge that can be useful for future decision-making and to support the risk review process. Knowledge management and quality risk management work together as enablers of the pharmaceutical quality system, as described in ICH Q10.19, 19

Conclusion

Risk management for avoidance of drug shortage is increasingly a regulatory expectation, as evidenced by recent laws in the US and France and the inclusion of this topic in ICH Q9(R1). In this article, the ISPE Q9(R1) team provided a comprehensive approach for analysis of risks to drug availability across the supply chain and over a product’s lifecycle, using ICH Q9(R1) approaches. The approaches outlined in this article are expected to be appropriate to address recent regulatory expectations. Regardless of the regulatory requirement, understanding and mitigating vulnerabilities in supply chains is important for the pharmaceutical industry and ultimately for patients worldwide.

• 9a9b
• 12International Society for Pharmaceutical Engineering. ISPE PQLI® Guide: Part 3—Change Management System as a Key Element of a Pharmaceutical Quality System. North Bethesda, MD: International Society for Pharmaceutical Engineering, June 2012. https://ispe.org/publications/guidance-documents/product-quality-lifecycle-implementation-guide-change-management-system
• 10International Society for Pharmaceutical Engineering. ISPE APQ Guide: Corrective Action and Preventative Action (CAPA) System. North Bethesda, MD: International Society for Pharmaceutical Engineering, November 2020. https://ispe.org/publications/guidance-documents/corrective-action-preventive-action-capa-system
• 11International Society for Pharmaceutical Engineering. ISPE APQ Guide: Management Responsibilities and Management Review. North Bethesda, MD: International Society for Pharmaceutical Engineering, July 2021. https://ispe.org/publications/guidance-documents/apq-guide-management-responsibilities-review-mrr
• 13International Society for Pharmaceutical Engineering. ISPE PQLI® Guide: Part 4—Process Performance & Product Quality Monitoring System. North Bethesda, MD: International Society for Pharmaceutical Engineering, June 2013. https://ispe.org/publications/guidance-documents/product-quality-lifecycle-implementation-guide-process-performance-product-quality
• 14International Society for Pharmaceutical Engineering. ISPE APQ Guide: Cultural Excellence. North Bethesda, MD: International Society for Pharmaceutical Engineering, November 2022. https://ispe.org/publications/guidance-documents/apq-guide-cultural-excellence
• 15Woelbeling, C. “ISPE Pharma 4.0TM SIG & Its Working Groups.” Pharmaceutical Engineering 41 (March/April 2021):14–20.
• 16Moore, C. M. V., N. S. Cauchon, G. M. Dahlgren, M. L. Hoffman, M. B. Parlane, R. W. Quan, W. J. Roth, and E. Zavialov. “PQLI®: Advancing Innovation and Regulation.” Pharmaceutical Engineering 41 (September/October 2021):40–47.
• 17US Food and Drug Administration. “Strategic Plan for Preventing and Mitigating Drug Shortages.” Published October 2013. www.fda.gov/files/drugs/published/Strategic-Plan-for-Preventing-and-Mitigating-Drug-Shortages.pdf
• 18Tolomeo, D., K. Hirshfield, and D. L. Hustead. “Engage with Health Authorities to Mitigate and Prevent Drug Shortages.” Pharmaceutical Engineering 40 (July/August 2020):36–41.
• 18
• 6a6b
• 1
• 4
• 7
• 19International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use. “ICH Harmonised Tripartite Guideline Q10: Pharmaceutical Quality System.” Published June 2008. https://database.ich.org/sites/default/files/Q10%20Guideline.pdf
• 19International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use. “ICH Harmonised Tripartite Guideline Q10: Pharmaceutical Quality System.” Published June 2008. https://database.ich.org/sites/default/fi les/Q10%20Guideline.pdf

Acknowledgements

The authors would like to thank Mette Kraemmer and Alice Redmond who provided feedback on the development of the risk assessment approach discussed in this article.