On May 26, ISPE issued a supplementary document to the Commissioning and Qualification (Second Edition), titled QRM Addendum: C&Q Delivery Process. The publication addresses inconsistent industry-wide implementation of Quality Risk Management (QRM) observed over recent years, while further clarifying core C&Q definitions, risk assessment methodologies, and alignment mechanisms with ICH Q12.
C&Q Beyond Paper-Based Compliance
ISPE states that although the 2019 release of Commissioning and Qualification (Second Edition) has gained widespread industry recognition, ISPE’s industrial surveys uncovered prominent gaps across organizations:
- Substantial discrepancies in QRM deployment practices;
- Divergent interpretations of foundational terms including CQA, CPP, CA and CDE;
- System Risk Assessment (SRA) activities deviating from core objectives, failing to focus on loss of control over Critical Process Parameters (CPPs);
- Insufficient alignment with the Established Conditions (ECs) framework defined in ICH Q12.
ISPE developed this appendix to ensure C&Q activities inherently safeguard product quality and patient safety, rather than devolving into purely paper-driven compliance exercises.
Integration of ICH Q12: Distinction Between CPPs and Established Conditions (ECs)
The guidance prominently incorporates the ICH Q12 Established Conditions (ECs) construct, which refers to parameters committed within regulatory submissions and subject to continuous regulatory oversight. A critical distinction is delineated: ECs are not equivalent to CPPs.
ECs represent non-negotiable regulatory baselines, whereas CPPs directly govern product quality attributes. During User Requirement Specification (URS) development, all parameters classified as ECs shall be explicitly flagged as mandatory minimum requirements to be rigorously enforced.
Mandatory Requirements for System Risk Assessment (SRA)
The document underscores core SRA principles:
- SRAs shall center on loss of control of CPPs, rather than enumerating all potential equipment failure modes;
- Risk Priority Number (RPN) calculations are not required; risk tiers (High / Medium / Low) shall be determined by Subject Matter Experts (SMEs) drawing on institutional knowledge and operational experience;
- Failure Mode and Effects Analysis (FMEA) is more appropriate for maintenance system development, and not recommended as the primary risk assessment tool during C&Q execution.
QA Oversight: Line-by-Line Approval of All Engineering Documentation Is Not Required
A core philosophy articulated in the appendix establishes Good Engineering Practice (GEP) as the foundational framework for C&Q, with Engineering Quality Processes (EQP) serving as the bridging mechanism between GEP and the Pharmaceutical Quality System (PQS). The Quality Assurance (QA) function is tasked with oversight and formal approval of critical project milestones, rather than exhaustive line-by-line review of every engineering document.
Recurring Root Causes of Ineffective QRM-Driven C&Q Implementation
The guidance enumerates prevalent failure factors that undermine QRM-based C&Q delivery, including:
- Overly verbose URS documents incorporating granular design specifications and procurement stipulations;
- Failure to accurately identify CPPs, or inappropriate attempts to declassify identified CPPs;
- Misapplication of FMEA methodologies to SRAs, shifting focus away from CPP control integrity;
- Unstructured change control processes triggering repetitive testing throughout the C&Q lifecycle;
- Non-compliant Good Documentation Practice (GDP) for engineering records, with failure to uphold the ALCOA data integrity principles;
- Lack of cross-functional trust between QA and engineering teams, resulting in redundant testing activities.
