The U.S. Food and Drug Administration (FDA) has taken formal steps to prevent and mitigate drug shortages for over a decade. While the problem predates the COVID-19 pandemic, the pandemic presented potential new challenges for drug manufacturing, supply, and distribution.¹  To address those challenges, Congress enacted the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) in March 2020. The CARES Act added Section 506C(j) to the Federal Food, Drug, and Cosmetic Act, which requires certain manufacturers to develop, maintain, and implement a “redundancy risk management plan that identifies and evaluates risks to the supply of the drug, as applicable, for each establishment in which such drug or active pharmaceutical ingredient is manufactured.” In May 2022, the FDA released the draft guidance, “Risk Management Plans to Mitigate the Potential for Drug Shortages” (guidance), to assist manufacturers of drugs and active pharmaceutical ingredients (APIs) with the development, maintenance, and implementation of such risk management plans (RMPs). The comment period for this draft guidance is open until 19 July 2022. This legal alert provides an overview of this guidance and how impacted parties can comment if desired.

Who Does This Guidance Apply To?

This guidance applies to three types of entities: (1) primary stakeholders, (2) secondary stakeholders, and (3) other stakeholders.

Primary stakeholders are the entities that determine which materials and services are necessary to produce a drug product. For drug products with approved applications, this includes the holder of a new drug application, abbreviated new drug application, or biologics license application. For drug products without an application, the primary stakeholder is the entity with understanding of and capability to make changes to the supply chain for the finished product.

Secondary stakeholders are entities expected to have more detailed insight into segments of the supply chain for a drug product. Secondary stakeholders are finished product manufacturers, including those that operate establishments involved in physically manipulating the drug product, as well as any manufacturers of a drug-led, drug-device combination product or biologic-led, biologic-device combination product. API manufacturers and those who physically process or package the API are also secondary stakeholders.

“Other” stakeholders are those involved in the supply chain for drugs that do not fall into one of the above categories, including inactive ingredient manufacturers, packagers, and distributors.

RMPs are required for manufacturers of the following drug products, APIs, and associated medical devices:

• Prescription drugs that are life-supporting, life-sustaining, or intended for use in the prevention or treatment of a debilitating disease or condition.²
• Any drug that is critical to the public health during a public health emergency declared by the secretary under section 319 of the Public Health Service Act.³
• Any API included in the prescription drug products described above.
• Any associated medical device used for preparation or administration included with the prescription drug products described above.⁴

RMPs are recommended for manufacturers of the following:

• Drug products intended to treat rare diseases or conditions.⁵
• Drug products that lack appropriate alternatives.
• Medical countermeasures used in the event of a potential public health emergency stemming from a terrorist attack with a biological, chemical, or radiological/nuclear material, or a naturally occurring emerging disease⁶ and other threat agents.
• Drug products of a specific strength, dosage form, or route of administration produced by only one entity in the United States.
• Drug products with only one API manufacturer in the product’s supply chain that have been appropriately qualified by the quality unit of the finished dosage form (FDF) establishment.⁷
• Drug products with only one FDF manufacturer in the product’s supply chain.⁸
• Drug products that are manufactured in a facility with an inspection in the last five years that were classified as “official action indicated,”⁹  and there is no other manufacturing facility that is qualified in the product’s supply chain to conduct that operation.

What Does This Guidance Recommend?

To create an RMP, the FDA recommends performing a risk assessment, developing a risk control strategy, and developing a risk review schedule. The risk assessment step includes (1) identifying the risks with a potential to cause drug shortages, (2) risk analysis that includes identifying near misses in terms of drug shortages that were avoided and consideration of past circumstances or practices associated with that risk, and (3) risk evaluation that includes identifying the probability of a drug shortage occurring and the impact a drug shortage event would have. By the end of the risk assessment step, the hazards should be identified, analyzed, evaluated, and prioritized. One must determine which hazards are considered a higher risk to drug supply disruption than others.

The next step in RMP development is risk control. This step entails risk reduction and risk acceptance. Risk reduction involves identifying strategies that can be used to mitigate or avoid the identified risks, such as building redundancy into manufacturing operations, establishing controls on the supply chain, strengthening relationships with suppliers, and identifying alternative suppliers. After being implemented, these risk reduction efforts should be periodically reevaluated for effectiveness. Risk acceptance involves determining if the remaining risk is acceptable or if the risk should be further reduced by implementing additional risk reduction strategies. At the end of the risk control step, a report should be developed that documents the risk assessment and control strategies utilized.

The final step recommended in RMP development is risk review. FDA recommends at minimum an annual, internal review and revision of an RMP throughout the life cycle of a drug. This step should include lessons learned, including the root cause of new and near-miss supply disruptions and an assessment of communication with regulators and whether that communication should be improved.

Throughout the RMP development process and after implementation, FDA recommends two continual actions: risk communication and the use of risk management tools. FDA encourages stakeholders to engage in proactive communication of their RMPs with organizations within their drug supply chains and, where appropriate, with external stakeholders and regulators throughout the process. It may also be helpful for primary stakeholders to share their RMPs with secondary stakeholders in their supply chain in order to work in concert to prevent shortages. Additionally, FDA recommends using a variety of pre-developed risk management tools that may ease the process of developing and maintaining an RMP. Specific risk considerations for the RMPs are denoted in the appendix of the draft guidance.

What Do RMPs Mean for Stakeholders?

This guidance will apply to a large number of manufacturers given the broad definition of “stakeholders,” and could be expensive and time-consuming. An individual RMP must be created for each drug a manufacturer produces that is within the required category. Having one general RMP that applies to every drug a manufacturer produces is not sufficient. Developing these RMPs could be costly for manufacturers who do not already have RMPs in place or have not tailored each RMP to a particular drug.

Given the breadth of this requirement and the potential costs, it will be critical that stakeholders in the same drug supply chain coordinate with one another to develop RMPs efficiently. Sharing risk management assessments and strategies throughout the supply chain of a drug has the potential to save manufacturers time and money in the development and implementation process. Sharing RMPs also allows for standardization of risk management practices and procedures throughout the supply chain.

What Is Next?

The comment period for this guidance is open until 19 July 2022. Thus far, only four comments have been submitted. Comments and suggestions can be submitted in two ways: online or written. Online comments can be submitted to https://www.regulations.gov. Written comments can be submitted to:

Dockets Management Staff (HFA-305) Food and Drug Administration 5630 Fishers Lane, Rm. 1061 Rockville, MD 20852

All comments should be identified with Docket No. FDA-2022-D-0277.

K&L Gates is available to assist with any comments and consulting about the applicability of RMP requirements to your specific circumstances.

We acknowledge the contributions to this publication from our summer associate Katie L. Hollingsworth.