Risk Management – “Plans Are Nothing, But Planning Is Everything”

In a previous (excellent) article in this blog series, Ben Locwin a seasoned academic summarised nicely the three main roles and responsibilities [for sponsors] of the proposed revision (R2) to ICH E6 (GCP):

  • Quality Risk Management (QRM)
  • Risk-based Monitoring (RBM)
  • CRO Oversight [some sponsors may equate the term CRO with risk too]

All three of these topics involve managing risk and I see the latter two being aspects of the former.


What is ‘risk’ ?

The first problem we need to overcome is the word “risk” itself, which seems to be an emotive word for most of humankind. Wikipedia informs us that “Risk is the potential for gaining or losing something of value”, but in our professional setting many people’s instinct is to focus on how to avoid any loss.

Before founding Wider Perspectives, a company focussed on Clinical Quality [Risk] Management, amongst other roles I worked as an internal management consultant evaluating business risk within a Fortune 500 health insurance corporation. This was a highly acquisitive company and the rationale for business risk management (BRM) was simple. If we understood all the risks in our (new) businesses we could focus our efforts more effectively to ensure a smoother business performance to the benefit of our shareholders. Yet whenever we walked the management team of a new acquisition through the steps of risk identification, evaluation and control, a preoccupation with avoiding what could go wrong often got in the way of maximising business opportunities through accepting inherent risks and then managing them carefully.


How does ICH E6 Rev 2 come into play?

It’s been several years since the regulators first encouraged pharma to adopt risk-based approaches and whilst much has been written about RBM, including the progress and experience of the TransCelerate companies, the majority of this conservative industry is still either thinking about it, talking about it, or taking its first tentative steps along the way. So how does any of that relate to ICH E6 Rev 2? Well, with the imminent adoption of this revision, regulatory agencies around the world will quickly have an expectation that clinical trial sponsors have actually used QRM (incorporating RBM) in compiling their data for submissions. Now is the time for all of us to act.

It seems that whilst most people working in clinical trials have an inherent appreciation of many of the risks involved, the disciplined process of documenting the evaluation of these (likelihood, impact and detectability) along with controlling them (reduction/mitigation or acceptance) appears more difficult.  Defining Quality Tolerance limits seems to be especially challenging in some organizations, where lengthy debate about the plans, has delayed significantly the implementation of risk management in practice. Perhaps this is to be expected amongst people with scientific backgrounds for whom the search for accuracy and precision is deeply ingrained. Defining a “tolerance limit” for quality can be deeply contentious for some, as it is seen as acceptance of a level of GCP compliance below perfection (or full compliance).


Quality risk management – What’s more important – a great plan, or great plan management?

Clearly, we should always aim for perfect GCP compliance in our trials, but I believe the regulatory intent underpinning ICH E6 Rev 2 is that we should be better at focussing on what is truly important to subject welfare and the credibility of the trial data. Some of the semi-automated processes I’ve witnessed in recent years that result in huge appendices to Clinical Study Reports detailing every minor protocol deviation contribute more to noise than useful signals (a ratio discussed in Ben Locwin’s article), but the problem originates in the initial design and definitions which needed to be smarter.

Any experienced clinical researcher will tell you how few (clinical trial) projects ever run exactly according to plan and our regulators know that too. The key is not just to have a plan (some CROs now have a bewildering array of them for each project), but to constantly monitor progress against your overall quality plan and to keep adjusting course towards the final goal, whilst documenting all of your interventions.

If you (or your colleagues) are anxious about getting your plans right, then I refer you to the words of one of the most successful planners in history, author of Operation Overlord (the D-Day landings), Gen. Dwight D Eisenhower who said “Plans are nothing, but planning is everything.” His wisdom lies in the recognition that a plan will seldom be perfect, but having practised planners, with a framework for reference, means they can quickly adapt for most eventualities.



Plan, act, re-plan,act, learn, explain, build evidence, repeat….

What I believe we as an industry need to be better at doing, is being able to demonstrate to our regulators how we recognised the [GCP] deviations from our plotted course, what we did about it and what effect our efforts actually had i.e. tell the story of our work (warts and all) positively. This will require our regulators to play their part too. After all, whilst criticising pharma’s protocols for becoming too complex and muddled, these regulators have overseen approvals of such protocols and may even have contributed through requests for additional data to achieve approvability. So in this new risk-based future for clinical trials, I hope to see both industry and the regulators living by what ICH E6 Rev 2 advocates, with clear, concise, consistent, simplified and feasible protocols, designed correctly from the outset.

I would also welcome more emphasis from regulatory inspectors themselves on holding investigators to account for meeting all their ICH E6 responsibilities first time around, rather than criticising the QC step that is the monitor/ sponsor responsibility for oversight. Hopefully, we can all re-learn clinical research together in the coming months.  In that way we maximise the potential to gain from at least some of the risks we all know are out there in the clinical trials arena.


We have to learn by doing

Finally, may I conclude with my belief that the best way to learn about risk management is through experience in doing – “So let’s get on with it” – but then I should confess that as a child I did learn to swim by being thrown into the deep end of the swimming pool, albeit with a float strapped to my back for risk mitigation!

Risk Management concepts are simple, but the implementation within the clinical trial setting can quickly become bewildering, so it can help to have an experienced ‘coach’ to lead you through the process at first.  TRI has brought together the perfect match of capable professionals with cutting edge tools and a thorough understanding of the field. Give them a call and get started, or check your current progress, today.


Mr. Peter Brummitt

In my second article entitled “Is there a cake in the fridge?” we will explore some more of the mind-set shifts that need to accompany ICH E6 Rev 2 and of the new skill sets required for central and site monitors implementing risk management.