Skip to main content

A Practical example of applying Quality Risk Management in GDP – Transportation Risks

Posted by: , Posted on: - Categories: Compliance matters, Good distribution practice

What is your biggest GDP risk?

If you had to think about the answer, then it is likely that you haven’t given it much thought. Quality Risk Management (QRM) is a requirement of Good Distribution Practice (GDP). It underpins good design and maintenance of a GDP quality system and provides an approach that enables the quality system to be safe for patients, efficient and effective through identification of risks, and facilitates proportionality of mitigation.

There are many texts that describe QRM principles and practices, and the only one I intend referring to here is ICHQ9 that provides a good explanation and is widely adopted in the pharmaceutical industry. A common problem that affects small to medium-sized distributors is putting the theory into practice, so to illustrate some of the QRM considerations and GDP expectations, I will focus on QRM as it applies to transportation which remains a significant weakness for many wholesalers, especially those that do not own their own fleet.

Quality Risk Management

A systematic process for the assessment, control, communication and review of risks to the quality of the drug (medicinal) product across the product lifecycle.

EU GDP Guidelines SI 2013/C343/01

First, a little theory

Distribution of medicines has inherent risks, and by applying QRM it is possible to identify and define the risks, possibly remove some of them and create the means to improve detection of risk events and thereby reduce their impact. It can also help identify what is an acceptable level of risk.

A summary of inherent risks and their criticality will assist managers to be mindful of risks in different areas of their organisation thereby showing consequential change in risk caused by an action, and can also provide a benchmark of current risk level. Many companies present such summaries as a spreadsheet which assists communication, an essential part of QRM. The summary should be regularly re‑evaluated and potential changes assessed during quality management review meetings.

Apart from the summary of inherent risks, individual quality risk assessments also feed into risk management. These can be both subject-based assessments, such as evaluation of risks associated with transportation, or incorporated into quality system processes, such as part of evaluation of a change control or a deviation. The latter helps to reduce total risk rather than resolve one issue but create a larger risk elsewhere. Quality risk management should therefore be embedded throughout the quality system and be at the forefront of the minds of all employees.

Quality Risk Management principles

Quality risk management should ensure that the evaluation of the risk to quality is based on scientific knowledge, experience with the process and ultimately links to the protection of the patient.

The level of effort, formality and documentation of the quality risk management process should be commensurate with the level of risk.

EU GDP Guidelines SI 2013/C343/01

Putting theory into practice

What follows is just one approach to illustrate the principles of QRM and will not be suitable for all distributors and circumstances.

Risk assessment

An assessment of your transport chains should help identify which parts are associated with greater risk, this can be performed either as a single approach for a route, or by grouping similar routes and transport modes into different transport lanes. For example, one lane may consist of ambient products by air freight to mainland Europe, the next lane include cold chain air freight to Europe, the next lane describe road freight to Europe using own transport, and a fourth describe road transport to Europe using a courier. Each of these lanes will have risk profiles common to all shipments within it but distinct from the other lanes. Separate types of risk should be identified, for example high and low product temperature excursions, security breach, damage in transit and failure to deliver in full and on time. We will take the first of these risks, high temperature, and explore it further.

Having identified that high temperature excursion is potentially a significant risk, we then predict the probability of the excursion, the impact of the excursion and the likelihood of detection. Probability will be affected by factors such as season, geographical differences and altitude. Initially, estimate of probability may by subjective based only on experience and knowledge within the organisation. As the model develops and temperature data is accumulated, the objectivity and quality of the estimate of probability will improve. Early subjective probability therefore requires a safety factor to be included in order to mitigate against initial weakness of data and knowledge.

Temperature data, showing highs of 36C. Alarms are set at 65 and -25.
Collection of good quality data contributes to informative decision making. Note the poor alarm settings

The next stage is to assess the impact of the temperature excursion. This takes two forms – impact on the shipment, and impact on specific products or product groups.

MHRA expectations in regard to control and monitoring of temperature during transportation

Impact on the shipment may include delay in onward supply and a possibility that the customer may refuse the load. For impact on specific products, the supplier or customer may assess impact of the temperature excursion on individual medicines in the load or profile them as products with equivalent temperature requirements, physical attributes, formulation and packaging. The acceptable temperature range relates to the labelled conditions for the specific product. MHRA expectations for this are defined below.

With respect to the transport of medicines, the European Guidelines on Good Distribution Practice for Medicinal Products clearly require that: The required storage conditions for medicinal products should be maintained during transportation within the defined limits as described by the manufacturers or on the outer packaging. It is the responsibility of the wholesale distributor to ensure that vehicles and equipment used to distribute, store or handle medicinal products are suitable for their use and appropriately equipped to prevent exposure of the products to conditions that could affect their quality and packaging integrity.

EU GDP Guidelines SI 2013/C 343/01 Chapter 9.2

It is rare to find sound scientific justification for acceptance of a load subject to an excursion, and in the uncommon instances where a supplier or customer contacts the marketing authorisation holder for stability information, it is often not directly comparable to the excursion experienced. Unfortunately, the most common reason for accepting a consignment with a temperature excursion is purely commercial, which may put patients at risk and undermines any risk management carried out by the company. In some cases of quality risk management, attempts were made to inappropriately apply mean kinetic temperature to underestimate impact rather than develop good control and preventive measures.

Increasing the likelihood of detection provides for earlier excursion warning, may help prevent an excursion and gives greater assurance that temperature conditions have been maintained. In circumstances where each shipment is not monitored for temperature, a very robust validation is required with clearly defined limits of validation, and where these are breached then the whole load is compromised. In practical terms it is normally easier to monitor temperature throughout the load or as monitoring combined with vehicle temperature mapping. Technological advances have provided easy and inexpensive means to relay temperature at receipt or as live data. It is important to ensure appropriate alerts are set, which was not the case in the temperature trail illustrated above - lack of alarm triggering led to incorrect assurance that stock was within acceptable temperature range and an inaccurate assessment of risk.

Risk Control

The control of risk involves accepting levels of risk or reducing it to an acceptable level, again based on sound scientific reasoning. Approaches taken may include avoidance of distributing specific products or to specific territories outside the capability of the distributor, making local deliveries at cooler times during hot summer days, or outsourcing of shipping to couriers better suited for controlling transport temperature, especially cold-chain. With any risk control measure, the company needs to ensure new risks are identified and any related risk assessment is re-evaluated.

One commonly seen example of poor risk control is use of the EX-WORKS model as a substitute for GDP, whereby a customer collects the stock and the supplier feels no obligation to assess or control the transport. Although this approach may be appropriate in regard to incoterms, GDP expectations clearly state that the supplier is responsible for delivery of their medicine to the delivery address of the customer. In this scenario, the supplier generally has no understanding or interest in how their product reaches the customer, including how many vehicles are involved for a journey, the number of stops en route, and how the medicines will be handled. In one example, two boxes of high value cold chain product fell out from the back of a van onto a motorway and fortunately were picked up by Police, who delivered them to the customer. The supplier had abdicated GDP responsibility through the EX-WORKS model and didn’t even raise a deviation. This abdication of responsibility by the supplier is not acceptable and, in this case, has increased their inspection risk rating. Having stock moved from one vehicle to another in a public car park also occurs with some transport chains and provides high risk in regard to control of temperature and the security of both the medicines and the drivers. It normally compromises the documented chain of custody, and may be poorly controlled where a chain of independent transport companies are used.

Lorries travelling along a motorway

As part of the risk control measures, risk reduction looks at ways of reducing or removing risk. In the simplest situation, our example of medicines travelling as UK road freight, occurrence of high temperature may be due to inappropriate vehicle design. Dark solid-sided vans with solid bulkhead and no compartment cooling are more likely to get hot in summer whereas curtain-sided trailers will be at high risk of temperature excursions due to poor thermal protection of curtains. These trailers are also at high risk for low temperature excursions and theft, and consequently are being replaced by higher specification vehicles in fleets. Efforts to introduce the industry chosen solution of temperature-controlled vehicles takes time and money, and in such instances, companies should implement appropriate risk mitigating measures during the fleet replacement period.

Risk communication

This includes communication of risk information within and outside of the organisation. In our transportation example, staff in Customer Services or Finance should not select use of a courier based purely on low price but should draw from approved couriers where there has been formal quality risk assessment. A written agreement between supplier and third-party courier provides a route of communication between both parties and can incorporate risk-mitigation measures such as restriction on uncontrolled further sub-contracting and minimum specification of vehicles and drivers used.

Where new fleet is being selected, user requirement specification should incorporate areas of risk such as design criteria and functionality. Good specification design documents support risk communication between different departments e.g. Finance, Transportation, Warehousing, Quality.

Risk review

Quality Risk Management is dynamic and should adapt as circumstances within or external to the company change. It should be reviewed routinely and after any significant event or deviation

Common weaknesses seen with GDP quality risk management

  • The degree of urgency directly relates to the criticality of risk. This is not the case where, for example, a major deviation requires rigorous redesign of a process that cannot be resolved quickly. In such instance it may be necessary to put in place interim risk measures until the original issue is resolved
  • Risk assessments are not reviewed
  • QRM is used as an excuse to avoid developing appropriate mitigation
  • QRM is not understood by managers

Good practices seen

  • QRM is fully integrated throughout the quality system
  • QRM is actively used to drive continuous improvement, reduce risks and deviations and improve understanding of risks
  • the QRM processes used are easy to understand and apply

It is acknowledged that transport and transportation provide a significant proportion of cost of a medicine, especially for low value lines. Good design and application of QRM helps off-set some of this cost.

I will shortly take a further look at QRM and transport within the Security series of GDP posts.


Don’t miss the next post, sign up to be notified by email when a new post comes out on the Inspectorate blog.



Sharing and comments

Share this page


  1. Comment by Bob Hayes posted on

    Good blog, Terry. I'm particularly pleased to see the clear link between good risk management and continuous improvement.
    It is a worry that a significant number of companies do not have a robust QRM process in place, understood and in use.

  2. Comment by David Eley posted on

    Thank-you Terry. a very useful article that should lead to a more widely used system of risk assessment for distribution lanes and QRM principles in general

  3. Comment by Chandramohan Thiruvamkulam posted on

    This article can be used as a baseline to perform continuous QRM for GDP related process and I find it very helpful.

  4. Comment by udayavani posted on

    nice article

  5. Comment by Denis posted on

    Hi, Terry.
    Interesting article. With your permission, I would like to translate it into Russian language. Do you mind?

    • Replies to Denis>

      Comment by Janet Symes posted on

      Thank you for your feedback. Quality risk management and supply chains are not restricted to geographical boundaries but are something that brings us together. Please include a link to the original version with the translation.

  6. Comment by Vijay Patil posted on

    Nicely explained in practical way!

  7. Comment by Dipak Patel posted on

    Very helpful and well explained. Thank You Terry!

  8. Comment by johfert Bristomm posted on

    it is very comprehensive for this article and also discusses in this article quality risk management. I would like to thank Terry for this article.