After chairing a session on risk at the recent Pharma Integrates 2017, Martin Lush, Global Vice President, NSF Pharma Biotech and Medical Devices, was compelled to put “pen to paper” to get people thinking and debating this issue before it’s too late!
How the pharmaceutical industry manages risk is appalling. There you go. I’ve said it. I’ve taken a risk. Why? Because we need a serious debate on where we are, and where we need to be because what we’re doing now isn’t good enough.
Maintaining the status quo isn’t an option. If you want to become Risk Smart, read on. Try the quiz and follow the links to some free Risk Smart resources. Not interested? That’s fine. Survival isn’t compulsory.
Some thoughts to get the debate started
- Although ICH Q9 (Quality Risk Management) is 12 years old it’s poorly applied. Why?
- As an industry we don’t manage risk. We just react with obligatory ‘risk assessments’ when things go wrong. We do too little, too late. We react rather than prevent. Why?
- Sometimes risk assessments are used to justify what’s wrong. On other occasions they are used to stop doing what is right. Why?
- The quality of risk assessments depends on two things. The quality of data going in (garbage in garbage out) and the quality of people around the table. Without good data and people with profound knowledge of products, processes and patients, risk assessments are not worth the paper they’re written on. Those involved must alsohave excellent critical thinking skills and the ability to make decisions under pressure in G.U.R.O.T. fashion. See the resource library later
Our industry is risk averse. But there is a price to pay. Being risk averse can be dangerous
- Chasing the ‘zero risk’ game smothers creative and critical thinking at a time we need them most.
- Risk aversion creates the dangerous illusion of certainty when there is none.
- Risk aversion adds complexity at a time simplicity is vital. You can’t simplify and strip out cost with being Risk Smart
- The crux is this. The urge towards safety can be good but, if left unchecked, can lead to disaster
So where are you? How are you doing? Answer the following with a simple yes or no. Please share with colleagues
- Does your company take a ‘zero risk’ approach to most things?
- Is risk defined as the consequence of severity of harm, probability of occurrence and likelihood of detection?
- When taking steps to reduce risk do you add more complexity. More checks, moredouble signatures, more detailed instructions more risk assessments, more everything?
- Is Failure Mode Effect Analysis your ‘go to’ risk assessment tool?
- Do you rely on the RPN (risk priority number) to make your decision?
- Is risk a dirty word? Does it convey danger rather than opportunity
If you have more y’s than n’s you should rethink your attitude to risk and its management. And quickly. I’m not saying take more risks. After all, if we get things wrong we kill people. What I’m promoting is being ‘Risk Smart’. In times of massive uncertainty we all have very tough choices to make. They all come with risk attached. We have to be Risk Smart
Five Steps to becoming ‘Risk Smart’
- Stop defining risk in terms of severity of harm and probability of occurrence. This implies risk is painful, dangerous and something to be avoided. As leaders you must feel safe with risk. Just view risk as managing and being comfortable with uncertainty (variability). This raises an important question Is ICH Q9 fit for purpose?
- Deleting severity and probability from our risk vocabulary sounds like I’m questioning the value of ICH Q9. I actually like Q9. It’s logical and pretty straight forward but it is far from state of the art. I just think we need to revisit it and ask some critical questions. How else can we improve? We can’t accept the status quo. We must always challenge it. Let’s start the debate
- Why has ICH Q9 been so poorly applied?
- Why is Q9 typically used reactively not proactively as it was intended?
- How can we use any risk management process without in depth understanding of our products and process, probability and frequencies?
- How can the process be improved using the latest research and best practices relating to the psychology of risk, risk based decision making and the use of big data for risk profiling?
- What’s wrong with developing a risk algorithm? Why can’t we leverage what insurance companies do every day?
- What other questions do you think we need to address?
2. Replace ZERO RISK with ‘Risk Smart’.
Zero risk is a dangerous illusion. It doesn’t exist. Just remember the role intelligent risk management has played in every human advance. We’re here today because our predecessors took Risk Smart decisions. Being Risk Smart doesn’t mean gambling with patient safety. It’s just a trigger to remind us of reality. Risk is everywhere. In every decision we make and in every problem we solve. Risk Smart companies will succeed. Those trapped by institutional risk aversion will not. In the final analysis leaders at every level must feel safe with risk
3. Don’t base decisions on RPN scores alone.
Start educating your people in risk based decision making and critical thinking skills. These must be perfected and habituated. See the resource library below for simple links to great Risk Smart resources
4. Create a ‘Fail Fast’ culture.
In times of uncertainty the ability to fail fast and make Risk Smart decisions will be the difference between success and failure. Failing fast means bringing problems and failures to the surface and fixing then quickly. To fail fast you must have
- Great communication with the shop floor, where the action takes place
- Highly motivated Risk Smart first line managers available at the work place. Not in meetings. They must be available
- A simple Deviation Management system that allows incidents to be investigated within minutes. Not days
- A culture that sees deviations as learning opportunities, not inconveniences
5. Educate, educate, educate.
Being Risk Smart requires profound knowledge of the psychology of risk aversion, the science of risk based decision making and probability. When faced with assessing risk numbers help navigate the wash of sentiment that results in a risk adverse decision. Acquiring statistical literacy is a vital component to Risk Smart decisions.
To help you become Risk Smart immerse yourself in the following
- ‘Risk Strategy’. Understanding Risk to Improve Strategic Decisions by Jamie MacAlister.
- ‘Reckoning with Risk’. Learning to Live with Uncertainty by Gerd Gigerenzer
- ‘Risk Savvy’. How to Make Good Decisions by Gerd Gigerenzer
- ‘Risk Intelligence’. How to live with uncertainty by Dylan Evans
Your Risk Smart Resources:
Here are some short (6 minute) videos on Decision Making under Pressure. Use these to help educate others:
If you want to Fail Fast you will find these useful
I stole the title of this Post from Jim Collins author of How the Mighty Fall. In it Jim describes the characteristics of companies that succeede, and then disappeared. Risk Smart companies excelled. Those who either ignored risk or managed it poorly didn’t.
In this world of uncertainty we have to stick together.We’re all facing similar challenges and risks. We all stand to win or lose. Let’s help each other to challenge the status quo and become Risk Smart for the sake of our patients.