Defining Levels of Protection Within API Facility Design
Defining Levels of Protection Within API Facility Design
PHARMACEUTICAL ENGINEERING
The Official Magazine of ISPE API Facility Design
November/December 2008, Vol. 28 No. 6
This White
Paper presents A Risk-Based Approach to Defining
the Briefly
Exposed (Briefly Levels of Protection within API
Open) concept
in the context of Facility Design: The Concept of Briefly
Intermediate and
API processing
based on
Exposed (Briefly Open)
adopting a risk-
based approach
as outlined in
by Stan Newberger and Dr. Trish Melton
the API
Baseline Guide.
T
Introduction Figure 1 (with FDA agreement), was at-
his White Paper is written in support of tempting to give manufacturers an option of
the ISPE Baseline Guide on Active utilizing the Protected category (Level II), which
Pharmaceutical Ingredients (API), in allows for drug substance protection in certain
which a new concept, Briefly Exposed circumstances without having to use the more
(Briefly Open) was introduced. The discussion highly restrictive Controlled condition (Level
will expand on the concept, provide further III). Experience shows that many manufactur-
clarification, and demonstrate how to use the ers did not take advantage of this Protected
concept in practice. This White Paper will focus category in practice, because they felt that
on the Briefly Exposed (Briefly Open) concept there would be greater risk associated with it.
in the context of Intermediate and API process- This low use of Level II indicated a lack of
ing based on adopting a risk-based approach. understanding of the risks which were or were
not present.
Background The FDA suggests that manufacturers un-
The ISPE Baseline Guide: Active Pharmaceu- derstand the ultimate risk to the patient and
tical Ingredients, published in June 2007, is a focus on the areas of greatest patient risk.
revision and update to the ISPE Baseline During the design of API facilities, there needs
Guide: Bulk Pharmaceutical Chemicals, pub- to be an awareness of which areas represent the
lished in June 1996. In the original Guide, the greatest risk to the API and the greatest risk to
concept of a process step being a critical process the patient. This risk-based approach was inte-
step either due to chemistry or due to physical grated into the new Baseline Guide and a third
contamination was presented. The tools to con- condition was added to the former Table 2-1:
trol physical contamination also were given Briefly Exposed (Briefly Open). It is shown as
and presented as the Levels of Protection. It Figure 2.9: Recommended Levels of Protection
was recognized that the Levels of Protection, - Figure 2.
identified and defined in Chapter 2 of the This new concept allows manufacturers an-
original Guide as Level I General, Level II other degree of freedom in their operations.
Protected, and Level III Controlled, also are They will be able to briefly open their processes
related to the criticality of the step. With that for various reasons (sampling, adding ingredi-
as a basis, Table 2-1 Recommended Level of ents) for short time periods and under certain
Protection was developed - Figure 1. circumstances and to apply the most appropri-
Figure 1 recognizes two conditions: Not Ex- ate levels of protection (Level I, II, or III) based
posed (Closed) or Exposed (Open). There is not on risk mitigation. An assessment of the risk to
an intermediate condition of opening a process the API and ultimately to the patient is an
for a short amount of time (Briefly Open). appropriate method for manufacturers to es-
tablish what those circumstances are.
The original Guide and the revised Guide both define three
different Levels of Protection: Level I General, Level II
Protected, Level III Controlled. The definitions of each of
these Levels of Protection are in Chapter 2 of the Guides.
Each of these levels will have a specific economic and opera-
tional impact on the manufacture of the API. Each also will
introduce a different risk of contamination to the API or
intermediate. Table 2-1 (1996 Guide) and Figure 2.9 (2007
Figure 1. Recommended Level of Protection (BPC Baseline Guide, Guide) give the manufacturer a way to determine the appro-
Table 2-1). priate Level of Protection depending on whether the opera-
External Contamination tion is occurring during a critical or non-critical unit opera-
Potential contamination may contact the API or intermedi- tion as well as the degree of exposure of the operation.
ate from sources that are either internal or external to the The main difference between the original version of the
processing equipment. It is expected that risks to the API and Levels of Protection Table and the newer version is the
intermediate from both of these sources will be managed and addition of a Briefly Exposed (Briefly Open) option. In addi-
appropriately mitigated. tion, the new Guide clarifies that criticality should be re-
External contamination comes from the external environ- viewed at the unit operation level. This approach highlighted
ment to which the API or intermediate is exposed. An opera- the usefulness and usability of the Level II category of
tion is exposed (open) if the API or intermediate is exposed to protection when a manufacturer is able to fully define the risk
the environment during the processing step, or not exposed scenario.
(closed) if the API or intermediate is not exposed to the
environment. Why Briefly Exposed?
Where external contamination can impact the impurity Exposed (Open) and Not Exposed (Closed) are definitive
profile of the API or intermediate, it is termed critical. terms. The process is either open or its not. However, is the
Therefore, this use of the word critical is analogous to the use risk of contamination the same when a vessel is open for eight
of the word when referring to critical parameter or critical hours, as it is when it is opened for one hour, as it is when it
unit operations. is opened for a few seconds? Obviously, the risk will be
different in each case. The risk to the API or intermediate also
Levels of Protection will be different in each case depending on which method of
The concept of Levels of Protection was introduced as a tool protection is utilized. Ultimately, the risk to the patient could
in the original Guide to aid in determining how extensive the also be different depending on all of the above as well as the
protection from the environment, and potential contami- intended patient use.
nants, an API or intermediate would need, i.e., does it need Recognizing that a very brief (brief time) opening of a
the same amount of protection: process to perform a specific activity could present an eco-
nomic and operational advantage over a completely closed
From the moment the process starts until the very end? process, and recognizing that a very brief (brief time) opening
Through every step (critical step versus non-critical step)? of a process within either a non-critical or a critical unit
operation could be protected to allow a low risk to the API or
intermediate, the Briefly Exposed (Briefly Open) option was
added.
The Guide states that Briefly Exposed (Briefly Open)
refers to an opening of a few seconds. The few seconds is the
time that it is envisioned to open a port on the process vessel
and to either add an ingredient or to take a sample quickly.
If the operation is not a part of a critical unit operation, Figure
2.9 (Figure 2) shows that this could be accomplished with a
Level I General level of protection. If the operation is a part
of a critical unit operation, Figure 2.9 (Figure 2) shows that
this could be accomplished with a Level II Protected level of
protection.
The Briefly Exposed (Briefly Open) option was added
because it is presumed to be a very low risk option that will
have a positive impact on the manufacture of APIs from an
Figure 2. Recommended Levels of Protection (API Baseline
Guide, Figure 2.9). economic and operational perspective. However, each manu-
<insert briefly open exposure risk <insert a <insert how this <insert how this <calc <insert action>
typically how contamination could description of the situation could situation is score>
enter the process> impact on the occur> detected>
process>
Scoring System
SEV: 1 to 5 based on impact on product quality; 1 is OCC: 1 to 5 based on likelihood of contamination DET: 1 to 5 based on ability for the contamination
low and 5 is high during failure mode (exposure); 1 is low and 5 is high to be detected; 1 is easily and 5 is not detected
Table B. Briefly Open (Exposed) FMEA Template.
If the example scenario is used with Figure 3 and Table A, on the failure effect. The scoring system for this type of
then the following is the result: analysis is shown in Table B. Severity is linked to the
impact of the contamination on the process and therefore
Decision 1 there is a risk of external contamination. process criticality as previously discussed.
Decision 2 the risk is of a low probability due to time- Causes for each identified failure mode, the cause should
scale of exposure. be explained. This needs to be a realistic scenario.
Decision 3 the risk has a high impact due to unit Occurrence (OCC) score a numerical score is assigned
operation criticality. based on how likely the cause would be to occur. The
scoring system for this type of analysis is shown in Table
Based on these decisions the appropriate level of protection B.
is Level II. In this case, the hand-hole is protected during Controls identify the current controls in place which
exposure through use of a portable enclosure which sur- would detect the failure mode.
rounds the hand-hole. The operator uses a standard SOP Detection (DET) score a numerical score is assigned
which outlines how he must minimize contamination, e.g., based on the controls and the ability for the failure mode
clean gloves, clean paper overalls with no pockets. to go undetected. The scoring system for this type of
analysis is shown in Table B.
Tool 2 FMEA1 Risk Priority Number (RPN) this is a calculation: RPN =
Failure Mode and Effect Analysis (FMEA) is a structured SEV OCC DET.
method for identifying and analyzing failure modes/defects
within a process, system, or product. It is usually completed At this stage, the failure modes can be ranked according to
on a component by component basis and produces a Risk RPN score. During facility design, the FMEA can be used as
Priority Number (RPN) that allows prioritization of any a design tool looking at the risks and associated risk priority
subsequent action planning. number in the proposed facility design.
The FMEA technique develops mitigating actions to elimi-
nate and/or reduce failure modes and/or their impact and/or Phase Two
increase detectability. It can be used to review potential After the Risk Priority Number (RPN) has been calculated,
scenarios which deliver external contamination into a pro- the second part of the analysis can begin.
cess and therefore identify the appropriate level of protection
for a unit operation. Action plan based on the RPN, define which failure
modes require action and then define the action plan.
Phase One Rescoring based on the action plan, review whether the
The initial part of the process involves failure mode or defect Severity (PS), Occurrence (PO), and Detection (PD) score
identification, description, and then scoring. In terms of the has or will alter and calculate an updated Risk Priority
application of the FMEA technique to the assessment of Number (PRPN).
external contamination risks via a briefly open operation, the
following terms can be defined: The reduction in risk priority number will be an indication of
the mitigation of the risk. In terms of the briefly exposed
Failure mode all the various ways that external contami- scenario, it should indicate whether Level II or III solutions
nation can enter a process during the briefly exposed are required to reduce the risk priorty number to an appropri-
scenario should be listed essentially these are all the ate level.
things that could go wrong. If the example scenario is used with Table B, the following
Failure effect for each identified failure mode, the conse- results are shown. Table C highlights a number of failure
quence needs to be described in terms of the potential modes for this situation: when the contamination is likely to
impact should contamination enter the process. impact the process and therefore the product and ultimately
Severity (SEV) score a numerical score is assigned based the patient.
Potential briefly exposed scenario: crystallizer unit operation, addition of 100g of seed to the vessel via the manually opened hand-hole
Debris above the exposed hand-hole Debris enters 5 Shedding materials 3 Operator likely to 1 15 Ensure temporary 5 1 1 5
the process used in general see if anything cover over the
facility and debris drops into the hand-hole is in
falls in during 5 hand-hole place
second opening
Operator contamination as he opens Contamination 5 Operator has 3 Likely 5 75 Operation SOP 5 1 1 5
the hand-hole and inserts the seed enters the process contamination on contamination states that
hands which will be small operator must
comes off during 5 and not easy wear gloves to
second operation to see conduct operation
5 Operator drops 4 Operator likely to 1 20 Operation SOP 5 1 1 5
something in the see if anything states that
hand-hole by drops into the operator must wear
mistake in rush to hand-hole a clean disposable
complete operation suit (one use)
Potential contamination from the Contamination 5 General 3 Cleaning SOP in 1 15 None check 5 3 1 15
equipment used to weigh the seed enters the dispensing place including dispensing SOP is
process room used cleaning labels being followed
Potential contamination from the Contamination 5 Disposable 1 SOP in place 1 5 None check 5 1 1 5
equipment used to weigh the seed enters the equipment meant to to ensure new charging SOP is
process be used once only receptacle used being followed
Risk summary: The action plans reduce the risk priority numbers to an acceptable level. All the action plans will protect the unit operation and are all Level II solutions.
Table C. Briefly Open (Exposed) FMEA Example.
All the actions proposed to mitigate the risks are to put tion where there is the potential for external contamination
protection in place during the dispensing and charging opera- by considering it to be a critical control area. The technique
tion, in other words give the situation Level II protection. is in two parts:
HACCP Tool
Process/Facility: <insert process or facility> Unit Operation: <insert name>
Hazard CCA CCP (Y/N) Critical Control Limit (CCL) Hazard Identification Control Mechanism
Measure Target
<insert a description of the <describe the <confirm <insert the <insert the <insert the control <insert description of how
contamination hazard > critical whether this measure and target value> mechanism to be applied> the control action will be
control area(s) hazard is a units> applied >
affected by this critical control
hazard> point or not>
HACCP Summary
<insert summary comments on the status of the HACCP and impact on outcome in terms of risk to the patient>
Table D. HACCP Tool.1
Hazard - it is usual to brainstorm the potential hazards If the example scenario is used with Table D, then the
which could occur within each CCA. In the case of review- following is the result. Table E highlights a number of
ing a process exposure to external contamination, the hazards for this situation: when the contamination is likely
hazards relate to the ways in which external contamina- to impact the process and therefore the product and ulti-
tion could enter the process. mately the patient.
CCA - it is usual to collate together common hazards All the control limits proposed to mitigate the risks are to
across a number of CCAs. For example, the dispensing of put protection in place during the dispensing and charging
raw materials may impact a number of different reactor operation, in other words, give the situation Level II protec-
modules. tion.
CCP (Y/N) - by asking two key questions, the Critical
Control Points (CCPs) can be defined for each potential Risk versus Cost Benefits
hazard. A yes (Y) or no (N) should be inserted although The risk-based approach under discussion is an objective way
for reviews, it would be usual to omit the non CCPs. to balance risk versus cost, i.e., risk to patient versus cost to
- Question 1 Does a control measure exist for this manufacturer and ultimately the patient. It is appropriate to
hazard within this unit operation? consider this balance. No process is 100 percent risk free to
- Question 2 Is control at this unit operation necessary be so would be cost prohibitive. However, risk to patient has
to prevent, eliminate, or reduce the risk of the hazard to be appropriately managed and mitigated.
to the product and therefore the patient? The tools in this White Paper are an attempt to stop
Critical Control Limit (CCL) - as previously defined, these manufacturers being too risk adverse and to using Level III
are limits within which a hazardous situation needs to be Controlled, as a solution to all product exposure scenarios.
controlled in order to safeguard product quality. For each The cost of reactor modules, for example, can be significantly
CCL, there should be a defined measure with units and a different and there should be a clear business rationale for
target range, minimum and/or maximum. this additional expenditure, i.e., to protect the patient.
Hazard identification the way that the normal operation Table F illustrates the relative differences in the cost of the
of the process will highlight the hazard, should it occur, different types of spaces.
should be identified. It is important that manufacturers realize the significance
Control mechanism the way that the normal operation of of the decision to use the different levels of protection and to
the process will be used to bring the CCL back into the use data and objective reasoning to be risk appropriate.
accepted range should be identified. This is the method by
which the design will incorporate adherence to the CCL Level of Protection Level I Level II Level III
when the hazard occurs. Relative Cost 1X 1.2X !.7X
HACCP summary - each time the HACCP is reviewed, the
Table F. The relative differences in the cost of the different types
analysis and summary of the probable outcome for the of spaces (cost data courtesy of CE&IC API database) .
process and product should be interpreted.