Critical Parameters of Managing Contract Risks

Dec. 14, 2010
Three experts share their views and best practices of risk-based contract partnerships.

In November 2010, hosted a webinar on “Minimizing Risks in Contract Partnerships,” with an eye towards how drug sponsors can use current principles of risk management (as spelled out in ICH and other regulatory documents) to strengthen contract manufacturing partnerships. Speakers included consultant Russ Somma of SommaTech LLC, Richard Poska, director of global pharmaceutical regulatory affairs with Abbott, and Franco Pasquale, senior manager for Roche/Genentech’s contract manufacturing operating unit. (The on-demand program is available here.)

Somma set the stage with a theoretical look at how ICH Q8, Q9, and Q10 guidelines should serve as the foundation for contract partnerships. “Any contract effort has to be grounded in the ICH guidelines,” he said. “The development aspects needed to support a regulatory submission are very similar to those which are key to forming a sound relationship with partners.” Somma calls it a “knowledge approach” to outsourcing, as shown in Figure 1 (whose origins he credits to FDA’s Moheb Nasr).
Figure 1 (left). A Knowledge Approach to Contract PartnershipsQ8, Somma explained, relates to “collecting the product knowledge needed to cast a partnership”; Q9 to “application of our sourcing needs using our knowledge base”; and Q10 to “the maintenance of our product, process and the partnership through the lifecycle of the product.” These aspects of Q10 Somma calls the “enablers”—“I always look at that as the maintenance of the partnership or the Quality System,” he said. “And to me, that’s the safety net of the entire operation.”What is the benefit of the knowledge approach? “The top line is its focus on product lifecycle,” he said. “That’s where everything has to be. It has to be about lifecycle, about your knowledge of where the product is and where it’s going. You have to share that knowledge, and to do so you need a design space which has been defined . . . essentially the design space becomes a function of the risk management and control strategy.”Understanding risk as defined by ICH Q9 is perhaps the most important aspect of achieving product and process knowledge, and quality, between partners, Somma said. Determining what is critical to a product or process “is a function of risk,” he said, something that both parties in a partnership must agree upon.


Abbott’s Poska spoke on “Regulatory CMC Risk Assessment Between Contract Partners,” sharing key elements and best practices of Abbott’s work with its long-term contract partners. Initial considerations for any partnership must be based upon compatibility, he began. Do contract partners share the same general corporate philosophies, whether for product development or commercial manufacture? On this point, Poska said proper due diligence is critical.

An approved and shared understanding of the target product profile is another fundamental aspect of forging a partnership, and can be used as a “contract” in terms of expectations for a product’s performance, and “forms a basis for control strategy and specifications.”

Potential partners, Poska noted, must also have a very clear understanding of the documentation challenges that lie ahead, whether for investigational or commercial product applications: “How much information of the knowledge and design space that’s been included in the regulatory filing has been shared with your contract house? If they’re the ones that are going to be doing the troubleshooting, that’s pretty critical information to know what’s been investigated, to help them solve problems much quicker, within the confines of your regulatory filing.”

Documentation must also be considered from a more practical, system compatibility standpoint, he noted. Does the contract partner share the same platforms? Is there a reluctance on the sponsor’s part to share IT platforms? Questions such as these can make or break partnerships and projects, and are important to consider at the very beginning of contract discussions, Poska said.

Poska, too, focused on the ICH documents and how all parties must understand them and recognize their importance. “Does everybody speak the same ‘language’ and have the same expectations?” In other words, he said, does everyone involved in a partnership have the same understanding of control strategies, CQA, CPP, CPC, Design Space, DOE, and PAT.

There is an “alphabet soup” of terms and phrases, he noted, and it’s absolutely necessary to make sure that partners have the same understanding of these terms. “And the other thing is, how do you know?” he asked. “You have to be able to somehow verify that you and someone you’ll be working with speak the same language.”

Finally, Poska reiterated Somma’s point about partners having a mutual understanding of criticality. “We talk about critical being a function of risk,” he said. “It’s very important to have a shared understanding of criticality and the assumption of risk, and have an agreed upon risk tolerance between your company and the contract house. That can’t be overemphasized.”


To complete the program, Roche/Genentech’s Pasquale presented a nuts-and-bolts view of his company’s approach to CMO management. The approach has evolved over the last year or two, he noted, driven by the company’s operational excellence group with input from the Quality and Manufacturing units. Pasquale presented numerous examples of tools, dashboards, and scoring systems that he and colleagues use to categorize potential risks, and then to monitor those risks for current partners. CMOs “are an extension of our manufacturing network,” Pasquale noted, but given that it’s impossible to have a constant presence at the contract manufacturer, a formal, risk-based approach is required to managing partner activities and performance. For any given tool, questions and concerns regarding CMOs are primarily lumped into three buckets: implementation, management, and decommissioning (Figure 2). Initial assessment tools are fairly straightforward. Questions are structured to be answered yes or no, Pasquale stated, with yes a “good” and no a “bad” answer. They can then be easily logged in spreadsheet form. For example, “Does the CMO have an adequate procedure for conducting smoke studies within an aseptic fill screen?” A no answer represents a risk. After all questions have been completed, the spreadsheet provides a general tally of risks.
Figure 2 (above). Roche CMO Risk Management Process (General Example)The no answers (i.e., the risks) are then given ratings for severity as well as probability (that is, how likely the risk is to occur). Severity and probability scores are then multiplied and an overall risk score is arrived at.Different assessors, of course, have different interpretations of how severe or likely a risk might be, thus scores may different from person to person. As such, Roche provides assessors detailed definitions of what each score is, and examples of what they are—for example, what a typical “catastrophic event” might be.While decisions regarding contract partners can’t always be quantified and remain completely objective, this scoring system, Pasquale noted, allows for a very “rational” approach for assessing whether a CMO should be contracted with and what type of oversight it requires.
About the Author

Paul Thomas | Senior Editor