As we move into our fourth year since the issuance of the FDA’s guidance on a risk-based approach to cGMPs,¹ the industry has slowly begun to modify its approach to product and process development. The transition, while difficult, presents us with the opportunity to integrate a much broader business sensibility into our thinking, both strategically and tactically. The reality is the world is getting smaller. As countries across the globe establish the capability and — more importantly — the credibility to manufacture or support the development of drugs for the U.S. market, we as an industry cannot afford to disregard these options when conducting our own strategic planning.

We will discuss how the current FDA guidance for product development can integrate the concept of business continuity into the planning process, affording organizations the ability to lay the foundation for flexibility in the operating plan, if the situation warrants it. To illustrate this point, this article will focus on the validation aspect of developing an aseptically processed product and its implications in integrating a business continuity plan.

RISK MANAGEMENT
Embracing risk as a key component in the product development process is not new. Compromises due to resource, time, or financial constraints are part of every organization’s development program. What sets the current agency expectations apart from the historical paradigm is a structured approach to risk management as the program moves from the bench to the shop floor. A framework for integrating risk management as part of the product development phase is described in the ICH Q8 guidance and is commonly termed the quality by design approach, or QbD.² The framework for evaluating risk has been described in the ICH Q9 guidance.³ Together, these two approaches form the basis for risk management as an integral part of the product developmentlifecycle.

BUSINESS CONTINUITY
Business continuity differs fundamentally from risk management in that risk management focuses upon potential threats to a process or product, while business continuity focuses upon the impact of these threats on an organization’sability to execute the process or manufacture product. A comparison of risk managementand business continuity management is shown in Table 1.

In today’s global economy, both disciplines are essential to ensuring the health and well-being of an organization. Aseptic processes in particular cannotafford to overlook the importance of adequate risk management and business continuityplanning because of the significant regulatory constraints associated with theirbusiness, and the time and capital required to transfer processes.

INTEGRATING RISK MANAGEMENT AND BUSINESS CONTINUITY MANAGEMENT PRINCIPLES
The challenges organizations face today stem from integrating the principles of ICH Q8 and Q9 into their normal product development process. We dealt with the adaptation of these principles in the development of an aseptic facility design in a previous column (The Impact of the FDA’s Adoption of Risk Management on the Design and Qualification of Aseptic Facilities, October 2007).⁵ The same considerations apply when integrating the tools of risk management into the development of an aseptic process. While there are myriad processes that can influence the success of a development programand an organization’s ability to weather a disaster, we’d like tofocus upon one of the most critical and expensive steps in the development ofan aseptic product: the validation exercise. The latest guidance from FDA advocatesintegrating risk management assessments as part of the process capability argumentfor product quality. The following illustrates the application of risk managementassessments as part of the qualification and validation process for aseptic productsand sterile APIs.