CNG TY TNHH Y.S.P. VIT NAM/ Y.S.P.INDUSTRIES VIETNAM CO., LTD.

CNG QUN L/ MANAGEMENT PROTOCOL

Tiu / Title CNG QUN L RI RO QUALITY RISK MANAGEMENT PROTOCOL

M s tham chiu/ Ref No. : QA MP - 1

B phn QA section Ngi son tho/ Established by: ____________________ (Lu Th Thanh Thy) Ngi xem xt/ Reviewed by : ____________________ (L Th Khnh Vn) Ngy/ Date : ______________ (NgNg/TT/NN//DD/ MM/YY) Ngy/ Date : ______________ (NgNg/TT/NN//DD/ MM/YY)

Ngi ph duyt/ Approvals: B phn QA Section: _____________ (L Th Khnh Vn ) Ngy/ Date : _____________ (NgNg/TT/NN//DD/ MM/YY)

Ngi xc nhn/ Acknowledged By : Khi sn xut/ Operation Department : (Chu Vn Hin ) Ngy/ Date : _____________ (NgNg/TT/NN//DD/ MM/YY)

<BAO MT/ PRIVATE & CONFIDENTIAL>

CNG TY TNHH Y.S.P. VIT NAM/ Y.S.P.INDUSTRIES VIETNAM CO., LTD.

CNG QUN L/ MANAGEMENT PROTOCOL

1. Mc tiu/ Objective: Mc tiu ca cng l thit lp mt h thng nh gi hiu qu, kim sot, giao tip v xem xt cc ri ro m bo v mt cht lng ca sn phm trong sut vng i ca sn phm v v mt an ton, sc khe v mi trng ca con ngi ti Cng ty TNHH Y.S.P. Vit Nam (YSPIVN) The objective of this protocol is to establish a system to effectively assess, control, communicate and review potential risks to assure Y. S. P. Industries Vietnam Co., Ltd (YSPI Vn) manufactured products across the products life cycle and safety, healthy and environment area. 2. Phm vi p dng/ Scope: cng p dng h thng nh gi ri ro YSP da trn cng c phn tch Failure Mode Effect and Criticality Analysis (FMECA) trong cc lnh vc sau: This protocol applies to the implementation of YSP s risk-based system approach using the Failure Mode Effect and Criticality Analysis (FMECA) tool in the following areas: Qun l cht lng/ Quality Management Nh xng v thit b/ Facilities and Equipment Sn xut/ Production Nguyn vt liu/ Materials Kim sot bao b v dn nhn/ Packaging and Labeling Controls Kim sot phng th nghim v nghin cu n nh Laboratory Control and Stability Studies 3. Ti liu tham kho/ Reference: ICH Q9 Quality Risk Management (9 November 2005) GMP Manual (Good Manufacturing Practice and Implementation 2008; Maas & Peither GMP Publishing) 4. Trch nhim/ Responsibility: Tt c cc nhn vin c trch nhim xut vn cn qun l ri ro trong cuc hp. It will be the responsibility of the participants of the Department Meeting (based on a consensus) to recommend the need for Risk Management on a particular subject(s) of concern. Trng b phn m bo cht lng xem xt v ph duyt sau cng cng qun l ri ro v bo co. It will be the responsibility of the Quality Assurance (QA) Manager to review and final approve the risk management protocol version(s) and reports. Trch nhim ca trng b phn m bo cht lng phn cng nhn vin QA tham gia tho lun qun l ri ro v h s quy trnh. It will be the responsibility of the Quality Assurance (QA) Manager to designate qualified QA personnel to facilitate the Risk Management discussion and process documentation. Trng cc b phn c lin quan hp tc vi ngi c ch nh t b phn xut qun l ri ro (v d, sn xut, kim tra cht lng, kho v k thut). Cc b phn c lin quan c tho lun trong cuc hp cc trng b phn. It will be the responsibility of the designated section manager to collaborate with the qualified representatives from the concerned section [i.e., Production, Quality Control, Warehouse, and Engineering). This shall be based on the recommendation resulting from the Department meeting of the Managers of the different section. <BAO MT/ PRIVATE & CONFIDENTIAL>

CNG TY TNHH Y.S.P. VIT NAM/ Y.S.P.INDUSTRIES VIETNAM CO., LTD.

CNG QUN L/ MANAGEMENT PROTOCOL

Trng cc b phn c lin quan ch nh nhn vin c o to tham gia cuc hp qun l ri ro. It will be the responsibility of the managers of the concerned section to designate their qualified representative to participate in the Risk Management Meeting. QA ln k hoch cuc hp v thng bo cho nhng ngi tham gia v cuc hp qun l ri ro. It will be the responsibility of QA to schedule the meeting and notify the participants regarding the Risk Management meeting. B phn ng k thuc tham gia cuc hp c lin quan n ng k thuc. It will be the responsibility of the Regulatory Affairs (RA) to participate in the discussion for regulatory guidance. Cc b phn c thng bo c cc chuyn vin k thut tham gia cuc tho lun. It will be the responsibility of the notified section to attend the meeting and provide their technical expertise during the discussion. QA lu h s v cc kin xc nhn t cc i tng tham gia. It will be the responsibility of QA to document and secure acknowledgements from the participants. Trng cc b phn c lin quan thc hin cc hnh ng cn thit theo chng trnh qun l ri ro. It will be the responsibility of the head(s) of the section(s) concerned to take the necessary action recommended by the risk management team as part of the risk management program. QA xc nhn v xem xt cc bin php thc hin. It will be the responsibility of QA to verify and review whether the measure(s) was/were implemented. Trng b phn QA tho lun trong cuc hp b phn v tin trnh ca chng trnh qun l ri ro. It will be the responsibility of the QA Manager to discuss in the Department Meeting the progress/outcome of the Risk Management Program. QA lu tr h s chng trnh qun l ri ro. It will be the responsibility of QA to keep the record of the program. 5. Quy trnh/ Process: 1. Bt u/ Initiation: 1.1 Chng trnh qun l ri ro c thc hin da trn cuc hp cc trng b phn. The Risk Management Program shall be prompted through the recommendation resulting from Department Meeting of the mangers of the different sections and/or of the higher management. 1.2 Trng b phn QA ch nh nhn vin QA c o to t chc cuc hp qun l ri ro. The QA Manager shall designate a qualified QA personnel to organize the risk management meeting 1.3 Nhn vin QA son tho k hoch v thng bo cho nhng ngi tham gia v cuc hp qun l ri ro. QA m bo cc i tng tham gia ng vi k hoch. QA cng vi cc bn tham gia xc lp i qun l ri ro (c th t sn xut, kim tra cht lng, k thut, SHE) The QA personnel shall set the schedule and notify the participants regarding the Risk Management meeting. QA to make sure that the concerned parties agree to the set schedule. QA together with the notified parties shall then comprise the risk management team (e.g. from production, laboratory, engineering, SHE committee) 1.4 QA chun b cc vn cn nh gi v cng c FMEA n i qun l ri ro bt u tho lun. QA shall introduce the subject to be assessed and the FMEA tool to the team prior to the start of discussion.

<BAO MT/ PRIVATE & CONFIDENTIAL>

CNG TY TNHH Y.S.P. VIT NAM/ Y.S.P.INDUSTRIES VIETNAM CO., LTD.

CNG QUN L/ MANAGEMENT PROTOCOL

2. nh gi/ Assessment 2.1 Xc nh/ Identification 2.1.1 Chun b phm vi p dng ca chng trnh nh gi. The team shall establish the coverage (scope) of their assessment. 2.1.2 D liu c bn c thu thp v cu trc tin trnh tng th c th hin v phn loi cc mc chi tit khc nhau (v d: mc 1, mc 2, mc 3) ph thuc vo phm vi p dng xc nh (mc cc chi tit) c tho lun. Mc cao hn s c m t vi mc chi tit hn. The basic data shall be collected and the overall process structure shall be presented and categorized under different levels of detail (e.g. Level 1, Level 2, Level 3) depending on the identified scope (level of detail) to be discussed. The higher level the greater the level of detail described. 2.2 Phn tch/ Analysis 2.2.1 i tng tham gia xc nh sai lch, kt qu v nguyn nhn ca sai lch c th xy ra. Sau phn tch tt c mc (ph thuc vo mc chi tit) v sai lch c th xy ra. Tt c cc yu t c th nh hng nn c xt n bao gm: The participants shall identify possible failures, their consequences, and causes of failure. These shall then be analyzed at all levels (depending on the level of detail) for possible failure. All potential influencing factors should be taken into account by using: 5 Ms: con ngi, my mc, nguyn vt liu, phng php v mi trng. Men, Machines, Materials, Method and Milieu (workplace) Hay / Or Thit b, quy trnh, con ngi, nguyn vt liu, mi trng v qun l. Equipment, Process, People, Materials, Environment, and Management 2.2.2 Tho lun (ng no) v cc ri ro ca mi ri ro c xc nh. Discuss (brainstorming) about the risks of the identified hazards. Thnh vin ca i tham gia thc t trong cc quy trnh, h thng v/ hay lm vic trong nh xng c vai tr quan trng xc nh sai lch c th xy ra. Team members who actually implement the processes, systems and/or work with the facilities have a good influence in identifying the possible failures. 2.2.3 Tnh s ph hp vi h s ng k (cung cp bi RA) v cc quy nh ca lut php Vit Nam v quc t (nh DAH, PIC/S, US-FDA, EU, ) . Cn nhc vn bn tham kho l lut hay ch l khuyn co nhng khng s dng quy trnh nh gi ri ro khng tun theo quy nh ca php lut. Take into account regulatory compliance (provided by RA) on the relevant authorities concerned (i.e., Vietnam DAH, Japans MHLW, PIC/S, US-FDA, EU et. al.). Consider which document is a law and which represents a guideline only but never use the risk management procedure to justify not following the law. 2.2.4 Ghi nhn tt c cc sai lch v kt qu, ri ro c th xy ra s dng phiu phn tch ri ro ca cng c FMECA (ph lc 1) Document all possible failures and their consequences and causes using the FMECAs Risk Analysis Record (Attachment 1). 2.3 nh gi/ Evaluation (Phn loi nh s l mt ti tho lun/ Numeric Ranking is still subject for discussion) 2.3.1 Nhng sai lch sau y phi c nh gi da trn The following aspects of failure shall be evaluated based on: nghim trng (S) ca kt qu sai lch Severity (S) of the failure consequence

<BAO MT/ PRIVATE & CONFIDENTIAL>

CNG TY TNHH Y.S.P. VIT NAM/ Y.S.P.INDUSTRIES VIETNAM CO., LTD.

CNG QUN L/ MANAGEMENT PROTOCOL

o lng kt qu c th xy ra ca nguy c ( v d: nh hng n ng vt, s l b nh hng, n ng k) Measure of the possible consequences of the hazard (e.g., harm to the animal, number of affected units/batches, regulatory consequences et.al.) iu g c th xy ra trong tng lai? What may happen in the future? nh s im tng theo mc nghim trng (bng 1) The numerical value increases with increasing severity (Table 1) #: S: ri ro / Risk

Bng 1: 4 mc phn loi v nghim trng (S): Table 1:Four Level Approach Ranking of Severity (S): Phn loi/ Rating M t s c/ Possible Description S im Phn loi AN TON GMP Numeric Classification SAFETY 10 e da tnh mng/ c th ng ca khu vc sn Nng c ri ro nghim trng n xut hay thit ht sn Extreme sc khe hay vn sc phm v/ hay hu qu nh (Catastrophobic) khe tm thi v/ hay c hng n cht lng v th gy ra mt kh nng thu ng k sn phm hi; sn phm phi b loi Close down of site or drug b; quy trnh phi thay i shortage and/or Life-threatening/ could consequences do affect cause a serious risk to quality and regulatory health or a temporary compliance of the product health problem and/or might trigger a potential recall; product has to be rejected; process must be changed 7 Cao Gy bnh hay iu tr sai Hu qu th hin sai lch High (Critical) lch nhng khng nm h thng trong h thng trong phn loi nng GMP hay ng k sn phm Cause illness or Consequences that mistreatment but are not indicate systematic errors covered by equivalent GMP systems or product examples of rating registration. catastrophic 4 Trung bnh Khng gy hu qu nghim Hu qu th hin trong cc Moderate (Marginal) trng n sc khe, khng vn h thng quy trnh/ tc dng ph, nhng c th x l, nh hng n cc quan st s thiu st. l sn phm khc. Do not cause a serious risk Consequences, which to health, no side effects, indicate system problems but can observe the defect. of processing/handling, which might impact also other batches/products

<BAO MT/ PRIVATE & CONFIDENTIAL>

CNG TY TNHH Y.S.P. VIT NAM/ Y.S.P.INDUSTRIES VIETNAM CO., LTD.

CNG QUN L/ MANAGEMENT PROTOCOL

1 Nh Minor (Negligible) nh hng/ khiu ni, khng gy ri ro v sc khe. Effect/complaints, which do not cause a risk to health. Hu qu, nh hng n hot ng cc b hng ngy. Consequences, which effect local daily operations

Kh nng xy ra (O) ca nguyn nhn sai lch. Probability of occurrence (O) of the cause of failure Sai lch thng xy ra hay c th xy ra nh th no? How often the failure occurs or can occur? Kh nng xy ra ca sai lch cng nhiu, ri ro cng cao (bng 2) The more frequently a failure occurs, the higher the risk (Table 2) #: O: ri ro/ Risk Bng 2: 4 mc phn loi kh nng xy ra (O) Table 2: Four Level Approaches Ranking of Occurrence (O): Phn loi / Rating M t s c Possible Description S im Phn loi Numeric Classification 10 Thng xuyn Mt ln/ n hng hay < 2 ngy Frequent Once per order or < 2 days 7 Lp li Mt ln/ 10 n hng hay < 2 ln/ thng. Repeated Once in 10 orders or < 2 per month 4 C th Mt ln/ 100 n hng hay < 4 ln/ thng. Occasional Once in 100 orders or < 4 per month 1 Khng ng k C th 1 ln/ 1000 n hng v khong 1 ln/ nm Unlikely May be once in 1,000 orders or about once per year Kh nng pht hin (D) nu sai lch xy ra. Probability of detection (D) if the failure occurs Kh nng pht hin s tn ti , s hin din v thc t ca nguy c. Ability to discover the existence, presence, or fact of the hazard Tm quan trng ca s nhn bit sai lch xy ra c th c pht hin hay c thng bo. Importance of knowing whether the failure that occurred can be detected or will be noticed. Nu sai lch xy ra, c h thng ti ch pht hin sai lch hay sai lch c th khng c pht hin? If a failure were to occur, are there systems in place to detect the failure or could the failure go undetected? Sai lch cng d pht hin, nguy c cng thp (bng 3) The easier the failure can be detected the lower the risk (Table 3) #: D: ri ro/ Risk Bng 3: 4 mc phn loi kh nng pht hin (D) Table 3: Four Level Approach Ranking of Detection (D): Phn loi / Rating

M t s c

<BAO MT/ PRIVATE & CONFIDENTIAL>

CNG TY TNHH Y.S.P. VIT NAM/ Y.S.P.INDUSTRIES VIETNAM CO., LTD.

CNG QUN L/ MANAGEMENT PROTOCOL

S im Numeric 10 Phn loi Classification Thng thng khng pht hin Normally not detected Possible Description Sai lch c khuynh hng b b st, v vy khng pht hin (nh kim sot k thut, khng s tay hay kim sot cm quan) Failure very likely to be overlooked, hence not detected (e.g. no technical control, no manual or visual control) Sai lch c pht hin (v d thanh tra cc vt, gim st) Failure to be detected (e.g. audit as spot check, monitoring) Sai lch pht hin bi quy trnh ti ch Failure detected by procedure in place Sai lch ngay lp tc pht hin Failure immediately identified

Lp li s b st Repeatedly overlooked i khi b b st Occasional been overlooked Khng thng xuyn b b st Unlikely to be overlooked 2.3.2

4 1

Xc nh s ri ro (RPN) bng cch nhn 3 gi tr (S,O v D) vi nhau: Determining the Risk Priority Number (RPN) by multiplying the three (S, O & D) values together. RPN= S x O x D RPN l mc m s qun l thit lp gii hn xc nh s o lng. RPN is the level at which the management sets the limits of determining the measures. ng thi l phng tin qun l xc nh ri ro c chp nhn hay khng. It is also a means for the management to decide when a risk is acceptable or not So snh cc mc ri ro v khng a ra nh gi ton din v ri ro. Enables comparison of risk levels and does not give absolute magnitude of risk. Quan trng nh gi da trn mi lin quan (thc t) v khng da trn nh gi thc t v RPN. It is important to make judgments based on relatives (real scenario) and not on actual magnitude of the RPN.

Gii hn RPN/ RPN Limits: Mt gii hn/ One limit RPN >100: Phi xc nh bin php/ Measures must be defined RPN <100: Khng cn bin php/ No measures required Hn mt gii hn/ More than one limit RPN >125: Phi xc nh bin php/ Measures must be defined RPN 80~125: i xc nh c cn bin php khng? Team decides whether or not measures are required RPN <80: Khng cn bin php/ No measures required 3. Kim sot/ Control

<BAO MT/ PRIVATE & CONFIDENTIAL>

CNG TY TNHH Y.S.P. VIT NAM/ Y.S.P.INDUSTRIES VIETNAM CO., LTD.

CNG QUN L/ MANAGEMENT PROTOCOL

3.1 Bin php gim thiu/ Reduction Measures 3.1.1 Nu mt gii hn xc nh ti hn, i cn xc nh bin php gim RPN tng th n mt mc chp nhn, hay chp nhn tn ti ri ro If the set limits exceeded, the team needs to define measures that would lead to the reduction of the overall RPN to an acceptable level, or to accept the residual risk. 3.1.2 Tho lun bin php cn thc hin cho mi ri ro cha chp nhn gim hu qu, nguy c hay pht hin hay tt c. Discuss measures to be taken for every unacceptable risk to reduce the consequences, probability or detection or both. 3.1.3 Xem xt cc vn sau/ Consider the following: Bin php k thut/ Technical measures Bin php t chc/ Organizational measures Bin php nhn s/ Personnel measures K hoch khn cp/ Emergency planning 3.1.4 Ghi nhn tt c bin php d kin, bao gm ngy thc hin v b phn/ nhn vin chu trch nhim trong Phiu phn tch ri ro (ph lc 1) Document all the planned measures, including the implementation dates and the department/person responsible in the Risk Analysis Record (Attachment 1). 3.1.5 Ti nh gi RPN thc t (RPNpot) da trn bin php d kin gim thiu nguy c. y l RPN c chp nhn sau khi thc hin/ hon thnh cc bin php d kin. Re-evaluate the potential RPN (RPNpot) based on the planned measures of reducing the risk. This will be the RPN expected after the completion/ implementation of the planned measures. RPNpot= Spot x Opot x Dpot V d v bin php ph hp gim thiu kh nng xy ra v tng kh nng pht hin: Examples of suitable measures of reducing the probability of occurrence and the increasing probability of detection: Thay i nh xng ngn nga hon ton kh nng xy ra sai lch. Changes to facility to completely prevent the occurrence of the failure Thc hin b sung kim tra trong qu trnh hay k thut phn tch trong qu trnh Implementation of additional in-process controls or process analytical technology (PAT) Thc hin cc ch tiu kim tra b sung nh bin php bo tr d phng. Introduction of additional tests points as part of preventative maintenance Thc hin cc quy trnh thao tc chun Introduction of organizational procedures (SOPs), et. al. Risk Acceptance 3.2.1 If the RPNpot is still higher than the limit the decision of accepting the residual risk shall now involve the participation of the managers of the concerned department. It should be agreed that an appropriate strategy have been applied and that quality risk is reduced to a specified (acceptable) level prior to accepting the residual risk. This shall also depend on the discussed parameters and be decided on a case-by-case basis. Kt qu/ Output/ Result

3.2

4.

<BAO MT/ PRIVATE & CONFIDENTIAL>

CNG TY TNHH Y.S.P. VIT NAM/ Y.S.P.INDUSTRIES VIETNAM CO., LTD.

CNG QUN L/ MANAGEMENT PROTOCOL

Sau khi thc hin cc nh gi/ iu tra cn thn, mt quyt nh chnh thc chp nhn hay loi b hnh ng v/ hay thc hin hnh ng khc phc v ngn nga s c quyt nh bi i v quyt nh chnh thc t cc b phn ch nh. After undergoing careful evaluation/investigation, an informed decision of accepting or rejecting the action and /or implementation of a corrective and preventive action shall be decided by the team and the decision makers of their respective units. 4.1 Mt tng kt theo sau phiu phn tch ri ro c son tho bi QA. Bao gm cc thnh phn: An Executive Summary following the Risk Analysis Report shall be prepared by QA. These shall include some possible elements such as: Cc giai on ca quy trnh c lin quan (ri ro c nguy c cao) Process steps of concern (potential high risks) Xem xt hnh ng khc phc v ngn nga/ CAPA overview Danh sch ri ro tn ti c th chp nhn/ List of accepted residual risks Ti liu tham kho/ Referenced documents Ph duyt kin xut v xc nhn hnh ng (nh gim c iu hnh, trng b phn c lin quan v trng QA). Approvals for commitment to agree and endorse the actions (e.g. General Manager, Heads of concerned Section and Head of QA) 4.2 QA lu h s chng trnh qun l ri ro. QA shall file the documented Risk Management Program. 5. Theo di v thc hin bin php/ Follow-up and Implementation of Measures 5.1 QA s kim sot v theo di ngy n hn v thc hin cc bin php tho lun trong chng trnh qun l ri ro. QA shall control and monitor the deadlines and implementation of all measures discussed in the risk management procedure.

<BAO MT/ PRIVATE & CONFIDENTIAL>