This year’s Covid-19 pandemic has highlighted the need for knowledge around dealing with the unexpected. Many will also recall the situation when the Icelandic volcano Eyjafjallajökull erupted in 2010, greatly affecting flight transports and delivery of drugs to sites, which also led to a focus on proactive risk assessment.
Before discussing further, I would like to ask: what is truly unexpected? Could we have anticipated the Covid-19 situation somehow or could we at a minimum have foreseen the consequences? Many companies offered support and solutions around how to deal with the pandemic’s consequences.
The best and most realistic to implement was received exactly five weeks after the hospitals had opened up for recruitment to clinical trials and external visitors. This raises another question; when does a risk turn into an issue? And how is the transfer adequately managed? This article will attempt to answer a few of these questions. The purpose is not to provide answers in full, but to create a debate, in order to, in the long run, improve the management of risks and issues.
Mitigating risk before it becomes an issue
Literature within the field of project management describes that the most successful projects are those where the teams are acting in a proactive manner. Although this often is set by the leadership style of the project manager, everyone can adapt to a proactive way of working by establishing robust processes for risk management.
Having a standard operating procedure in place for risk and issue management, describing frequency of risk assessment, cross-functional involvement, assessment of risk score by rating impact and likelihood, follow up of proactive actions to reduce risk, either impact and/or likelihood, and pre-defined actions to be taken if the risk becomes an issue, will reduce the magnitude of the risk and/or issue. There are multiple guidelines available for those who are new to risk management, among others the ISO standard ISO 31000:2018 Risk management.
According to my English dictionary, an issue is defined as “an important subject that people are arguing about or discussing”. In the period before a governmental election, this can be the major topic of discussion even in a study team, but does not necessarily mean it will put the clinical study at risk. In other words, it is important for the team to develop a common ground and define the terms (issue, risk etc.) as applicable for the study (affecting patient safety, timelines delayed more than a month, budget overrun by more than 5% or similar). Similarly, I have seen risk logs in which almost all risks are scored as very high: here, it is very important to establish definitions for each level (highest level impact e.g. a critical safety issue, budget overrun with more than 10% or similar), both for impact and likelihood.
Potential areas for improvement
To be able to take appropriate action at the right time, it is important to understand when a risk becomes an issue. In general, if a risk has occurred, it is no longer a risk, but an issue and it would be important to take corrective action to reduce the impact of the issue, as quickly as possible. ICH [International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use] and GCP [good clinical practice] have a huge focus on appropriate risk mitigation and management, but often teams lack sufficient oversight of the risks in order to take immediate action as often as needed. Ongoing review of risks and appropriate communication are therefore key factors.
There are two further areas where I have observed that the process fails: the project manager, at best together with the project director, lists the risks he/she sees alone. This means that risks addressed for further proactive actions are often limited to the areas of previous experience and knowledge of the project manager and many risks are left out. Some companies let the different departments contribute to the risk log, but leave out the common discussion between the team members about how this is affecting the other parties. This leads to incorrect risk score, as what a specific department sees as having low impact, might have major impact for another function. Best practice is therefore where all team members provide their input to the list of risks and suggestions how to mitigate, and then a discussion in a larger forum is held.
The other area is a lack of follow up of the risk register. Separate action, decision and issue logs are reviewed at study team meetings, but not the risk actions. Often the process would indicate reviews on a quarterly basis, but this would be too infrequent to assess whether the risk has become an issue and a change in course is needed. This leads to actions taken for the issue being initiated up to three months late. My recommendations therefore would be to review the risk log at every study team meeting and to train the entire team on the risk log, so it is not a single person’s responsibility to have oversight of these. A communication plan should also be implemented, along with an escalation plan in case a risk turns into an issue.
Lessons learned from the Covid-19 pandemic
The American movies Contagion from 2011, in addition to Outbreak from 1995, should to some extent have prepared us for a situation like the Covid-19 crisis. Situations like this also did happen during the Spanish flu pandemic of 1918, the Asian flu pandemic in 1957-58, the Hong Kong flu pandemic in 1968 and most recently the pandemic caused by the influenza A(H1N1) virus in 2009. In other words, we had the best opportunity to be prepared proactively.
That being said, one side was the risk of spread from patients to site or vice versa, but one of the greatest consequences for clinical trials, was the halt or slowdown of recruitment. Have we experienced this before and could we have acted proactively to reduce the impact of this issue? Yes, with no doubt. A solution offered by many was the concept of remote monitoring, a term that I have heard presented by contract research organisations for about 10 years. However, when the situation of Covid-19 arose, the processes were unclear and not ready to be implemented promptly.
I would advocate a proactive set-up of remote versus on-site monitoring and also to assess the impact on other parties. Hospitals are most often not allowed to send patient information outside the hospital and performing source data verification over the phone adds a very high burden on site staff. With limited staff at site due to the pandemic, this is very difficult to resolve for a site.
How can we resolve this moving forward? Access to electronic patient journals should technically be possible to provide to external parties outside hospitals. If complying to regulations related to access control (e.g. 21 CFR Part 11), monitoring should be able to perform this task outside the walls of the hospital. This is of course a political debate as well as a question about the functionality of the system. It is also important to ensure compliance with GDPR [EU General Data Protection Regulation].
Another aspect for discussion was the possibility for the patient to have a phone call with the hospital, for example to report adverse events. Home visits have also been discussed for many years and for national centres, this would have been a great solution for many studies, both enabling continuous oversight of patient safety, but also reducing risk for patients by not having to travel to the larger populated areas, where Covid-19 cases were more common. Working with oncology studies, it might be more difficult due to, for example, the need for tumour assessment and corresponding access to CT/MRI.
Proper implementation of risk assessment and taking action when it counts
As briefly touched upon previously, risk assessment should not be about the personality traits of a leader, nor about a one-time paper exercise in getting the risk log finalised for a first subject.
Hence, the only way to ensure that this becomes a way of working for the entire team is to implement it properly across cross-functional plans, as project management plans, communication/escalation plans (including appropriate escalation process of risk becoming an issue), monitoring plans (e.g. remote monitoring, criteria for and process), data management plans etc.
Some contract research organisations work actively with a solid template for risks that lists all the common risks seen in clinical trials. In these cases, the risk log becomes very long and this leads to a need for proper assessment of the risk score, to be able to prioritise adequately. Although I favour a solid template, it seems that this may reduce the proper discussions that take place; risk discussion meetings fail to be set up and the risk log is not adapted to the specific study. And cross-functional study-specific discussions are crucial even if templates are developed.
Weather it is related to proactive actions mitigating a known risk, or corrective actions to limit risk occurring or taking actions promptly when a risk turns into an issue, acting with a sense of urgency is of huge importance. To do this, it is important to understand your own importance in the project and have a good knowledge of what other team members do, in order to quickly communicate to those affected. Teams that take responsibility for dealing with an issue will be the most successful and to do this, the entire team, not to mention the project management, needs to at all times understand what is of highest priority from a patient safety, financial and regulatory point of view.