Failure Mode and Effects Analysis for Analytical Quality by Design — ranking manufacturing process parameters by their risk to product quality
Every quantitative risk assessment starts with a complete, undistorted picture of the process. Before any parameter can be judged "critical" or "non-critical," the full manufacturing sequence — cell culture, purification, formulation, fill/finish — must be broken into discrete unit operations, and every input, in-process, and output parameter at each step must be captured as a candidate, without pre-judging which ones matter.
A biologics manufacturing process is a chain of unit operations, each transforming material closer to final product: cell culture expands a production cell line in a controlled bioreactor; purification (Protein A capture, polishing chromatography, viral filtration) removes host-cell impurities and viruses; formulation adjusts concentration, buffer, and excipients to the target drug product composition; fill/finish aseptically doses the formulated product into its final container.
Each unit operation is documented as a process flow diagram — boxes for steps, arrows for material flow — annotated with every parameter that an operator sets, controls, or monitors at that step: temperatures, pressures, flow rates, times, concentrations, mechanical forces. At this stage the goal is completeness, not judgment. A parameter omitted from the map can never be risk-ranked later, so the map is deliberately over-inclusive.
Ishikawa (fishbone) diagrams are a complementary brainstorming tool used alongside the process map: for each unit operation, potential contributors to variability are organized under the "6M" categories — Man, Machine, Material, Method, Measurement, Environment — ensuring the team does not overlook parameters tied to equipment calibration, raw material lot variability, or environmental conditions.
Process mapping also draws a line between process parameters (things an operator sets or a controller regulates, like temperature or flow rate) and material attributes (properties of the input materials themselves, like raw-material purity or cell bank viability). Both feed the same downstream FMEA, but they are tracked in separate inventories because their control mechanisms differ fundamentally: a process parameter is controlled by adjusting equipment, while a material attribute is controlled by supplier qualification, incoming testing, and specification limits on the raw material itself.
This simulation focuses on the process-parameter inventory, the twelve entries spanning the four unit operations, while acknowledging that a complete QbD risk assessment runs the same FMEA methodology in parallel over raw material and in-process material attributes.
Process mapping is run as a facilitated workshop, not a desk exercise. Process engineers who designed the unit operations, manufacturing staff who operate them day to day, QA representatives who own the quality system, and analytical scientists who know which quality attributes are sensitive to which inputs, all contribute — because each function sees different failure surfaces.
The output is a structured parameter inventory: one row per candidate parameter, tagged to its unit operation, with its normal operating range and the control system (automated setpoint, manual adjustment, in-process test) that currently governs it. This inventory becomes the input list for the next stage — failure mode brainstorming — and nothing is filtered out yet based on intuition about importance.
ICH Q9 frames risk assessment as a formal, iterative cycle: initiate the process, identify hazards, analyze and evaluate risk, control the risk, communicate results, and review as new data arrives. Process mapping is the "initiate" step made concrete — it defines the scope and boundary of everything that follows. A map that stops at the bioreactor and omits fill/finish silently excludes an entire unit operation from risk consideration, no matter how rigorous the later FMEA scoring is.
Because the map is the shared reference point for every downstream stage, it is version-controlled and reviewed alongside the process description in the regulatory dossier. Any later change to the manufacturing process — a new unit operation, a modified equipment train — triggers a re-walk of the map before the risk assessment is considered current, keeping the FMEA aligned with the as-built process rather than a snapshot from early development.
With the parameter inventory complete, the team works through each candidate and asks a single structured question: how could this parameter fail, and if it did, what would happen to the product? This is the core mechanism of Failure Mode and Effects Analysis (FMEA) — translating an abstract process input into a concrete failure scenario with a traceable quality consequence.
Each entry in the parameter inventory is expanded into a failure-mode statement with three parts: the parameter, the way it deviates (the failure mode), and the resulting effect on the product. For example: "Bioreactor pH" (parameter) → "pH drifts out of the controlled range" (failure mode) → "altered glycosylation profile, reduced biological activity" (effect).
The effect is always phrased in terms a patient or regulator would recognize — not "the sensor reads out of range" but "the drug product may not meet its potency specification." This discipline forces the team to trace every mechanical or process deviation all the way to its impact on a Critical Quality Attribute (CQA), which is the entire point of the exercise: FMEA exists to connect process behavior to product quality, not to catalog engineering trivia.
Multiple failure modes can exist for a single parameter (e.g., temperature can excurse high or low, each with different effects), and in a full assessment every plausible mode is captured. For clarity this simulation tracks one representative, worst-credible failure mode per parameter.
A traceability matrix is built connecting each failure mode to the CQA(s) it threatens: identity, purity, potency, safety (sterility, endotoxin), and stability. This matrix later justifies why a given parameter deserves scrutiny — a parameter whose failure modes trace to no CQA is, by definition, not quality-critical, no matter how operationally inconvenient its failure might be.
This stage produces a purely qualitative view of risk: a story for every parameter about what could go wrong and why it would matter. Quantifying how likely and how detectable each story is comes next, in the Severity/Occurrence/Detection scoring stage.
Across the twelve parameters mapped in this simulation, failure modes cluster into a small number of recurring patterns that generalize well beyond this specific process: setpoint excursions (temperature, pH, pressure drifting outside a controlled band), mechanical or equipment faults (seal force, filter integrity, mixing hardware underperforming), and material or timing errors (insufficient mixing time, incorrect fill volume). Recognizing these categories helps a team brainstorm efficiently — once a category is identified for one parameter, the team asks whether the same category applies to others at the same or a different unit operation.
Fishbone (Ishikawa) analysis is often re-applied at this point, this time populated with the specific candidate failure modes rather than generic categories, to check whether any plausible cause (a specific pump, a specific raw material lot, a specific seasonal humidity swing) has been missed before scores are assigned.
Two quality problems recur in brainstorming sessions run without discipline: double-counting, where the same underlying failure is logged as multiple entries under slightly different wording (inflating the apparent size of the risk inventory without adding information), and vagueness, where a failure mode is stated too generically to be scorable — "equipment malfunction" rather than "seal force below 4.5 kN, allowing headspace ingress." A well-run brainstorming session enforces a consistent statement template — parameter, deviation direction, mechanism, effect — precisely to prevent both failure patterns before the inventory moves into scoring.
ICH Q9 Quality Risk Management formalizes FMEA scoring along three independent axes, each rated on a calibrated 1–10 ordinal scale: Severity (how bad is the effect if it happens), Occurrence (how likely is the failure mode to happen), and Detection (how likely are current controls to catch it before it affects the patient). The three scores are deliberately kept separate before being combined, so the team reasons about each dimension on its own terms.
Ordinal scores are meaningless unless every scorer shares the same definition of a "7" versus an "8." Before scoring begins, the team agrees on written anchor definitions for each axis — typically drafted at the 1, 5, and 10 points and interpolated between them. Severity anchors range from "no detectable effect on quality" to "product is unsafe or non-efficacious, potential patient harm." Occurrence anchors range from "failure mode essentially never observed, no known mechanism" to "failure mode expected on most batches without intervention." Detection anchors range from "controls will almost certainly catch the deviation before release" to "no means currently exists to detect the deviation."
Each failure mode is then scored independently by multiple team members before group discussion — reducing anchoring bias, where the first person to speak sways the room. Disagreements greater than 2–3 points on any axis are discussed until the group reaches a documented consensus score.
S·O·D scoring is a structured expert-elicitation exercise, not a physical measurement, and its limitations are well documented in the quality risk management literature. Ordinal 1–10 scales are not true interval scales — the "distance" between a 3 and a 4 is not necessarily the same as between an 8 and a 9 — yet the RPN calculation in the next stage multiplies them as if they were. Different S/O/D combinations can also produce identical RPN values with very different risk profiles (e.g., S=9,O=2,D=2 and S=2,O=9,D=2 both give RPN=36, but a high-severity/low-occurrence risk usually warrants different mitigation than a low-severity/high-occurrence one).
The revised ICH Q9(R1) guideline (2023) explicitly cautions against over-reliance on a single numerical RPN and encourages supplementing or replacing rigid multiplication with structured qualitative judgment, risk matrices, or weighted scoring where appropriate — using RPN as one input among several rather than an automatic decision rule. This simulation uses RPN as a transparent teaching tool while acknowledging these caveats.
In practice, S·O·D scoring is completed in facilitated sessions of roughly ten to twenty failure modes per meeting, with a neutral facilitator (often a quality risk management specialist) keeping the group anchored to the written scale definitions rather than gut feel. Each score is captured with a short written rationale — "Occurrence = 4: two deviations of this type observed in the last 24 manufacturing batches" — so that an auditor or a future team member can understand why a number was chosen, not just what the number is.
The Detection axis deserves particular scrutiny during this workshop: it should reflect the current, validated control (an installed sensor with an alarm, a release specification with a defined test method) rather than a theoretical or planned future control. Scoring Detection optimistically based on controls that do not yet exist is one of the most common ways an FMEA understates real risk.
With Severity, Occurrence, and Detection scored independently for every failure mode, the Risk Priority Number condenses them into a single ranking metric: RPN = S × O × D, ranging from 1 (best case, 1×1×1) to 1000 (worst case, 10×10×10). Sorting every parameter by RPN turns twelve independent expert judgments into a prioritized action list — exactly what a QbD control strategy needs before it can allocate finite monitoring and characterization resources.
RPN is calculated for every failure mode in the inventory and the full list is sorted descending. In this simulation, the twelve parameters range roughly from an RPN in the 70s (e.g., buffer osmolality, fill volume accuracy under baseline scoring) up to the 180s (headspace oxygen, whose combination of moderate-to-high severity, moderate occurrence, and comparatively weak detection produces the highest computed risk).
The ranking itself is dynamic, not fixed: improving Detection — for example by adding an in-line oxygen sensor or a tightened in-process test — mechanically lowers RPN for that parameter without touching Severity or Occurrence at all. This is precisely why Detection is scored and tracked separately: it is usually the axis most within the control of process and analytical engineering to improve, whereas Severity is often fixed by biology and Occurrence is fixed by the underlying equipment and material variability.
A high RPN does not automatically mean "add a specification" — it means "investigate first." Parameters at the top of the ranked list are prioritized for one or more of three actions: (1) tightened in-process control and continuous monitoring if the risk driver is Occurrence or Detection; (2) further Design of Experiments (DoE) characterization if the underlying relationship between the parameter and the CQA is not yet quantitatively understood, which is really an Occurrence/Severity uncertainty problem in disguise; or (3) formal classification as a Critical Process Parameter with a narrowed proven acceptable range once the DoE work confirms the relationship.
Parameters with moderate RPN are typically monitored under standard statistical process control without the same intensity of characterization, and low-RPN parameters are documented with wide operating ranges and periodic verification only. RPN ranking is what allows a QbD program to spend its DoE and PAT budget on the handful of parameters that matter most, rather than treating all twelve as equally deserving of investment.
When the driver of a high RPN is uncertainty about Occurrence — the team does not know how tightly the parameter is actually controlled in practice, or how sensitive the CQA truly is to it — the correct response is not to guess a tighter range but to run a multivariate Design of Experiments (DoE). A response-surface or factorial DoE varies the top-ranked parameters simultaneously across a wide range, measures the resulting CQAs, and produces a statistically defined relationship between the parameter and product quality.
This DoE output does two things at once: it quantitatively confirms (or overturns) the CPP designation implied by the RPN ranking, and it defines the actual proven acceptable range (PAR) that the control strategy will specify — turning an ordinal risk score into a validated, continuous operating boundary.
Because RPN is a simple product of three scores, it is highly sensitive to whichever axis is easiest to move — and Detection is usually that axis. Adding an in-line sensor with an automated alarm, tightening an in-process test's acceptance criteria, or increasing sampling frequency can drop a Detection score from an 8 down to a 3 or 4 practically overnight, without touching the underlying physics of Severity or Occurrence at all.
This is a double-edged property: it makes Detection investment an efficient lever for risk reduction, but it also means RPN can be "gamed" by over-crediting a control's real-world reliability. A rigorous program validates that a claimed detection control actually performs as scored — through challenge testing or historical deviation data — before allowing the corresponding RPN reduction to stand.
The final step translates the RPN ranking into a formal, documented classification. Parameters whose RPN exceeds the risk threshold are designated Critical Process Parameters (CPPs) — parameters whose variability has a direct, demonstrated link to a Critical Quality Attribute and therefore must be controlled within a tight, validated range with active monitoring. Everything below the threshold becomes a key or non-critical parameter, controlled within a wider standard operating range.
A Critical Process Parameter (CPP) is formally defined as a process parameter whose variability has a direct and demonstrated impact on a Critical Quality Attribute, and which must therefore be monitored or controlled to ensure the process produces the desired quality. This is a narrower category than "important parameter" — a parameter can be operationally important (affects yield, cycle time, cost) without being a CPP, if it has no demonstrated link to product quality.
Below the CPP threshold, parameters are typically split further into Key Process Parameters (KPPs) — those with a measurable effect on process performance or consistency but not directly on a CQA, controlled to ensure reproducibility — and non-critical parameters, which are documented and periodically verified but do not require tight, validated ranges. This three-tier structure lets a control strategy focus its most intensive controls precisely where the RPN ranking says they are needed.
ICH Q10 and Q11 expect the control strategy submitted in a regulatory dossier to be explicitly risk-based: CPPs receive narrowed proven acceptable ranges (PARs) established through DoE, continuous or high-frequency in-process monitoring, tight deviation alarms, and — where feasible — Process Analytical Technology (PAT) such as in-line Raman or NIR spectroscopy for real-time release attributes rather than end-point testing alone.
KPPs and non-critical parameters are controlled through standard operating procedures, wider operating ranges, and routine statistical process control charting, without the same density of real-time instrumentation. The control strategy document ties every CPP back to its FMEA entry, its DoE characterization data, and its specification — giving regulators and internal quality teams a fully traceable chain from raw brainstorming through S·O·D scoring, RPN ranking, and final classification to the specific control implemented on the plant floor.
Classification is not a one-time event performed only at initial process characterization. ICH Q12 and the broader product lifecycle framework expect CPPs and their control limits to be re-evaluated as commercial manufacturing experience accumulates, as analytical methods improve, and as post-approval changes are introduced. A parameter's Occurrence score, in particular, should be periodically recalculated against real batch history rather than left at its original development-phase estimate.
Many organizations schedule a formal FMEA refresh on a fixed cadence (e.g., annually, or triggered by a defined number of batches) specifically to catch drift in either direction: newly emerging risks that were not anticipated during development, and previously critical parameters that have proven so robust in practice that continued tight control adds cost without a corresponding quality benefit. This closes the ICH Q9 risk management loop from initial assessment through ongoing lifecycle control.