ISPE 专家圆桌讨论 QRM 与知识管理结合，以 ICH Q9(R1) 支撑供应可靠性

To explore how organizations can cultivate this cultural excellence, Maria Amaya, PhD (North America Lead of External Advocacy at Roche/Genentech) and Sebastian Schiffer (Quality Policy Advisor at Roche) sat down with three distinguished industry leaders:

Joseph Famulare, former Deputy Director of the US Food and Drug Administration’s (US FDA) Center for Drug Evaluation and Research Office of Compliance, former Vice President of Global Quality and Compliance at Roche/Genentech, and past ISPE International Board of Directors Chair.
Marty Lipa, PhD, pioneer of knowledge management strategies at Merck and co-founder of the RKI Institute.
Kevin O’Donnell, PhD, Market Compliance Manager and Senior GMP Inspector at the Health Products Regulatory Authority (Ireland) and rapporteur for the landmark ICH Q9 (R1) revision.

Their discussion provides a practical roadmap for transforming routine compliance into a mature, predictive, and patient-centric quality culture.

1. The ICH Q9(R1) Evolution: Product Availability as a Patient Right

The release of ICH Q9(R1) represents a milestone in how the industry views supply reliability. The expert working group took the unprecedented step of explicitly embedding product availability into the first core principle of Quality Risk Management. By stating that risks to quality include scenarios where supply disruptions lead to potential patient harm, the guideline directly links quality and manufacturing factors to supply reliability.

"We elevated its importance," explains O’Donnell. "The entire concept of product availability is now vital enough to be explicitly mentioned in the very first principle of QRM in ICH Q9(R1)".

To make this guidance actionable at the operational level, ICH Q9(R1) introduces Section 6.1, focusing specifically on product availability risks across three foundational manufacturing pillars:

Process variability and state of control
Facilities and equipment health (addressing aging infrastructure through robust preventative maintenance and other activities)
Oversight of suppliers, contractors, and outsourced activities

Rather than treating these pillars as separate technical checklists, organizations must understand that process control, facility health, and supplier oversight are direct determinants of supply continuity. When these pillars fail, drug shortages can occur, resulting in risk to patients.

2. Deciphering Supply Chain Complexity: Lessons from National Aeronautics and Space Administration (NASA)

A major hurdle in proactive risk management is the sheer complexity of end-to-end supply chains. When supply networks are highly globalized and intricately "coupled", where step B must tightly follow step A, it becomes exceptionally difficult to model where weaknesses lie or to predict cascading failures.

To address this, O’Donnell suggests looking outside the pharmaceutical sector to an organization that has mastered complexity modeling: NASA. In the early 1990s, NASA began deeply analyzing system complexity and "coupling" within space missions to systematically identify, rate, and mitigate catastrophic risks. Applying a similar rigor to pharmaceutical supply chains, mapping where complexity enters the system and assigning low, medium, or high complexity ratings, remains a critical industry gap that tools like Shortage Prevention Plans should begin to bridge.

However, simplification is not always possible. Joe Famulare recalls an initiative during the COVID-19 pandemic where a joint task force initially sought to simplify supply lines by reshoring manufacturing domestically. "We quickly realized there are inherent limitations to that approach," Famulare notes. "Ultimately, we had to recognize that there will always be a baseline level of supply chain complexity you simply have to work within. Mitigation is only part of the solution; you still have to actively manage and deal with that complexity".

3. Putting on “Knowledge Goggles”: Shifting Risk Reviews from Reactive to Proactive

If QRM is the engine for evaluating and mitigating risk, knowledge management (KM) is the fuel that powers it. "Risk management is an exercise in applying what you know," says Lipa. "Knowledge is the inverse of uncertainty".

To leverage KM effectively, Lipa encourages organizations to think across three distinct pathways:

Pathway 1: Connecting people to people
Pathway 2: Connecting people to the precise information and knowledge they need to do their jobs
Pathway 3: Vertically integrating the data, information, and knowledge pyramid to drive informed decision-making

A critical barrier to this integration is that 80 percent of an organization's knowledge exists as tacit knowledge, the unwritten, experiential know-how of personnel, while only 20 percent is captured as explicit, written documentation. This means a vast reservoir of operational wisdom goes untapped during risk assessments.

To capture this tacit knowledge, Lipa advocates for putting "knowledge goggles" on formal risk reviews. Instead of simply checking boxes, a robust risk review should be treated as a formal mechanism to re-evaluate and reinterpret risk by asking four core questions:

What knowledge (insights, issues, and experiences) has been gained since the last review?
What prior assumptions might now be invalid based on this new learning?
Where has uncertainty been reduced, or potentially increased?
What similar risks might exist across our broader manufacturing network?

Furthermore, existing tools within the PQS, such as the Product Quality Review (PQR), can be repositioned from reactive, annual summaries into forward-looking, proactive risk review tools. Rather than compiling a retrospective report simply to satisfy GMP regulations, teams should leverage PQR data to ask: What is the likelihood of process drift, an out-of-specification batch, or a supply disruption in the coming year?

4. The Contract Development and Manufacturing Organizations (CDMO) Frontier: Overcoming Knowledge Leakage and Supplier Silos

In an industry heavily reliant on outsourcing, technology transfers to CDMOs represent a primary point of supply chain vulnerability. McKinsey data reveals that external tech transfers to CMOs take an average of 5.8 months longer than internal transfers, with the "lack of availability of manufacturing process details" cited as the number one pain point.

"Tech transfer is, at its core, a knowledge transfer exercise," Lipa emphasizes. Yet, valuable process knowledge frequently "leaks" during this transition because organizations focus on static documentation rather than capturing fluid, tacit knowledge, or fail to define operational boundaries unless something goes wrong.

To prevent this knowledge leakage, Lipa recommends several practical, low-effort interventions:

Explicit Knowledge Transfer Plans: Establish clear processes for knowledge transfer, retention, and ownership directly within commercial agreements or quality agreements.
Pre-Job Briefs and After-Action Reviews: Borrowing from the safety industry, bookend critical activities (like PPQ batches) with 15-minute reflection sessions. A simple, joint review of what was supposed to happen versus what actually happened has been shown to significantly reduce deviations.
Active On-Site Mentorship: Equip on-site personnel with open-ended questions to actively capture the "why" behind operational behaviors, rather than merely monitoring compliance.

The critical danger of communication silos between sponsors and CDMOs was starkly illustrated during the global nitrosamine crisis (2018–2020). The European regulatory lessons-learned report revealed that a lack of process understanding and poor communication regarding process changes and impurity profiles between contractors and marketing authorization holders directly led to widespread contamination and subsequent global drug shortages. This crisis underscored that sharing risk and process details is not just a commercial preference, it is a public health necessity.

5. Culture and Leadership: Dissolving the “Watermelon Effect”

Ultimately, the effectiveness of any QRM or KM system is determined by the culture established by senior leadership. Under ICH Q10, senior management bears ultimate responsibility for the PQS, meaning they must set a corporate tone where quality and supply reliability are prioritized.

However, traditional corporate dashboards often suffer from what Farmulare describes as "the 'watermelon effect'—green on the outside, but hiding a true red on the inside," where quality metrics appear green on the surface but conceal deep, unaddressed systemic operational issues beneath. This occurs because teams, knowing that leadership reacts negatively to "red" indicators, will consciously or unconsciously massage data or delay escalating negative trends.

To dissolve this psychological barrier, O’Donnell highlights a creative approach proposed by Kelly Waldron, PhD: shifting quality dashboards to a monochromatic color scheme, such as different shades of blue. By removing the visceral, threat-inducing emotiveness of the color red, organizations can foster a healthier, more transparent communication culture where early warning signals are escalated and discussed openly before they manifest as supply disruptions.

As Joe Famulare concludes: "A healthy culture must be honest, frank, and open about what the data is telling you... Bringing forward a negative trend, a systemic problem, or an escalating issue should be welcomed and openly discussed".

6. Risk Communication: The Missing Link in QRM

While risk assessment and mitigation often take center stage, risk communication remains one of the least developed elements of the QRM framework. The experts noted that despite its inclusion in ICH Q9, it is frequently absent from formal company procedures and specialized training programs. This gap creates a critical vulnerability when organizations must convey complex risk profiles across the enterprise or to external partners.

Improving how risks are communicated to diverse stakeholders—including patients, the public, and the broader industry—is essential, particularly when dealing with supply reliability.1 O’Donnell points out that while regulators have established effective tools for internal communication and coordination, such as the PIC/S rapid alert system, translating that clarity to public-facing communications remains a challenge. Communicating risk in a manner that assures those communications will be understood is challenging, especially when dealing with a diverse set of stakeholders. There is a need for both regulators and manufacturers to refine how they articulate the significance of supply risks and provide stakeholders with information they need, without causing unnecessary alarm or confusion.

A striking contrast exists between the definitive, "black and white" nature of regulatory inspection reports and the often "massaged" messaging found in internal corporate communications. The panel emphasized that for QRM to be effective, internal communication must mirror the honesty of an inspector's report. Organizations must move away from sugar-coating negative trends and move toward a culture of clear, transparent escalation.

Ultimately, the pharmaceutical industry should treat past crises like COVID-19 as blueprints for improvement. By learning how communication channels succeeded or failed during the pandemic, the industry can better prepare for future threats, ensuring that risk information flows quickly and accurately to those who need it most. "Within regulatory agencies, experience unfortunately dictates improvement," notes Famulare. "I believe there have been notable improvements based on the lessons learned from the Heparin crisis and what the industry went through with COVID-19."

Weaving the Safety Net: Two Sides of the Same Coin

To protect patients from the sometimes-devastating impacts of drug shortages, QRM and KM must no longer operate in isolated corporate lanes—they are two sides of the same coin. As highlighted by the ISPE Drug Shortages Prevention Model and upcoming assessment and prevention tool, true resilience depends on cultural excellence: senior management actively sponsoring both quality and shortage prevention, and every worker at every level taking ownership. By treating knowledge as the "currency" of managing risk and leveraging senior management reviews as active forums for transparent risk communication, pharmaceutical manufacturers can weave a resilient safety net that safeguards supply reliability globally.