Why Quality Assurance is More Than Just Following the Rules with Kimberly Wallbank

Kimberly Wallbank: 0:00

that everyone thinks it's red tape that it is just a bunch of bureaucrats coming up with just rules that you have to follow just to make you follow them, which is not the case. In fact, actually.

Harsh Thakkar: 0:10

What's up everybody, this is harsh from qualtivate.com. And you're listening to the life sciences 360 podcast. On this show, I chat with industry experts and thought leaders to learn about their stories, ideas and insights and how their role helps bring new therapies to patients. Thanks for joining us. Let's dive in. All right, welcome to another episode of Life Sciences 360. And my guest today is Kimberly Wallbank. She is the principal consultant at quality systems services, LLC. Welcome to the show, Kimberly.

Kimberly Wallbank: 0:41

thank you for having me.

Harsh Thakkar: 0:42

Yeah, I was going through your profile. I know you work a lot in quality and regulatory, you're also I think I read somewhere that you're on your profile that you're also a professor or speaker. So because you're in this quality space, I want to start off by asking you a very heavily loaded question. What do you think is the biggest misconception about quality management that you see for people in life sciences

Kimberly Wallbank: 1:07

that everyone thinks it's red tape that it is just a bunch of bureaucrats coming up with just rules that you have to follow just to make you follow them? Which is not the case. In fact, actually, when I started industry, that's what I thought they were very timid to talk to my QA representative, it was this big, and then have to like go speak to her. But they're they're valuable and making sure that things work well. And I think it's, we sometimes lose focus on the whole safety and efficacy of the products, which is what they're responsible for I mean everyone, in the companies responsible. But ultimately, they're the ones the QA persons are the ones that guide you to that. So that's kind of where it is. They're kind of people liked them, sometimes as much as they like their dentist.

Harsh Thakkar: 1:56

Yeah, yeah.

Kimberly Wallbank: 1:57

And that's one of the reasons why I tend to focus on listening to what manufacturing says what engineering says, and all the other groups to incorporate what they're thinking, because we're having a QA, I've seen bad QA people, and I've seen good QA people. And the bad ones are the ones who just come in with their narrow focus saying you have to do A, B, and C, the good QA people are the ones of we need to meet these regulations, we need to make sure we don't have recalls. So we need to come up with what these rules look like instructions look like that we're going to all follow. So there's a different way of approaching it with people.

Harsh Thakkar: 2:44

Right, right. And then because you've been in the industry way longer than I have looking at your career and trajectory, what have you seen, changed in quality and regulatory like, like, let's say, from your day one, your first job to where you are today? Have you noticed any big changes or trends that oh, we used to do this? 20 years ago, we don't do it anymore.

Kimberly Wallbank: 3:08

The big one is risk. When I started an industry risk wasn't something we heard about. I started back in the mid to late 90s. And I was in manufacturing and quality control at the time. And you heard the word occasionally, but nothing substantial around it now everything is what's the risk associated with what you're doing. Right? And because the first time I heard about risk was in design control, I was in med device at the time. So it was what's the risk of designing your product this way versus another configuration. Whereas now everything's associated with risk. I do a lot of complaint handling help with my clients and the regulations even on the med device side for complaints require you to assess risk. So everything. And I think it's a great mindset to have, because you're thinking about what it means to the patient, what it means to the user, because we forget sometimes that there could be a risk to the doctor or the nurse, the idea health care worker, or even home health care workers in some of these products and having to administer them.

Harsh Thakkar: 4:22

Yeah, it's a great observation because even when I started in the industry, the first time I came across the word risk was probably software validation, like risk based software validation, because I started doing that when I was early on my career, but it's a great observation that it's coming from a lot of the regulatory documents and guidances when they started using the word risk, you obviously expect that to trickle down into company SOPs and policies, but the the thing that I really haven't seen much is that yes the guidances, and regulations tell you to do risk assessment, but very few tell you exactly how to do it. And that's where I feel like in the coming 10 years or 15 years, I hope that companies will maybe try to be more creative to like you said, if you're a quality person that says, hey, we need to show that we did a risk assessment, there's 20 ways to do a risk assessment, I'm not going to tell you to go and do an FMEA. But if you come up and tell me that you have a different approach, right, so, so risk assessment, to me is like, it is a good word and a bad word. Because when you say risk assessment, people just automatically assume that they have to do an FMEA or like a long Excel spreadsheet to show every area, but you can be creative. And you can do a very simplistic risk assessment and still get by with it.

Kimberly Wallbank: 5:54

Yeah, I think it's now a whole root cause word that everyone applied to for a while there were root cause everyone just made this assumption, you had to do a fishbone diagram. Yeah, to get 20 people in a room to determine root cause. Some problems do require a large cross functional group. Others do not. And so back to your point about sometimes Simplicity's best, it depends on your situation. And I think people forget that in some cases, they've been doing this. I worked with one client, they needed some support with investigations. So I was an extra set of hands doing those. And one of the things we were required to do, which he says to me was determined product impact. That is risk. Yeah, you're determining that based on risk. So you're doing it in some cases already. The one thing I think a lot of companies don't do well, is sharing their risk documents with the whole organization. So you have the people who put together the risk, and it ends up being some documents somewhere. And some companies are proactive enough to take them out once in a while and revisit them some they sit on the shelf, and they get the verbal electronic dust on them. Yeah. But it's the whole organization needs to be able to have access to these documents, it helps in assessing risks, in your particular situation, because a thorough cross functional group of experts, you already made some determinations to where you can pull from there.

Harsh Thakkar: 7:32

Yeah, that's a very valuable point as well. Because if you're putting the effort in, let's say, determining the risk of a process or implementing a software, then the future revisions of that process or of that software, you want to go back to your risk assessment and see whether the old risks still hold true, or have you found something new. So yeah, it is a great tool, if you, like you said, if you keep it as almost a living document and revisited every time you're making big changes.

Kimberly Wallbank: 8:05

Well, the other thing too, is that if put together correctly, those risk documents were put together by a cross functional team of experts. So you've had manufacturing, quality engineering, r&d, although all these groups involved. So there was a 360 view of, of the whole risk, as opposed to you sitting at your desk, in your world where you could be an expert yourself in your particular field, whether it's investigations, manufacturing, complaint handling, whatnot. But engineering may have came up with well, this is a risk that we come up with that maybe quality doesn't think about. So those are captured in those documents, if done correctly. So that's why everyone in the organization needs to have access to them. And know how to read them. And that's the other thing too, because people look at these tables, and they just, I don't know what I'm doing. So being able to understand them be able to read them and use them is key.

Harsh Thakkar: 9:13

Yep. Agreed. I know you talked you mentioned about root cause as an example. So the question I have for you on the root cause side is how this is one of my pet peeves, right? So how do you how do you go about figuring out the true root cause versus I think this is a root cause? Let's put this and move on.

Kimberly Wallbank: 9:33

Oh, yes. So there's different schools of thought of this. Some people are, and I'm kind of in the middle. One group is the simplest answer is the right answer. Okay, possibly. But sometimes there's things have you thought about X, Y, and Z. And there's groups that want to write a really short investigation that just kind of cuts to what it is. Other people want a more lengthy one, I'm kind of more in the hybrid of, you need to have as much document, you need to document everything. And so if you thought this could be the issue, but it's not explained why, because I always look at, I teach people that you're not writing for yourself, you're writing for others. And these people are reading it because they need to learn something from you. So you have knowledge they don't have. Now I usually put it in little sillier terms for them. So they get it and I keep intervention. But in essence, that's what I'm saying to them. Because I get a lot of well, you're telling me it's not a stability issue? Why? Well, because of they they go on and on. I said, well, where's that in here? Well, it's common knowledge, not to me, I barely know your product. And you think the FDA is going to know if they have to read as part of an inspection? No, and maybe someone in your organization doesn't have that knowledge that you have, they need to have an understanding to plus, typically, these documents don't get read for another 5-10 years before they get seen somewhere. So memory becomes an issue. I like to look at it as sometimes it is a simple issue, the the equipment went down, the equipment failed. I mean, there's some where power went off, so the equipment wasn't working. Okay. Well, that's a reasonable simple one. I mean, you may want to look into as part of the corrective action of why you didn't, should there be a backup? And auxiliary power? Are if there was one, why didn't it go on? So those those are those things happen, that I think are real easy and simple to acknowledge? The ones that everyone gets tripped on are operator errors. And I think in a lot of it is, is that a lot of times, it's not really the operator, as much as there's underlying issues causing the operator to have make the error, such as maybe training didn't make sense, or the SOP is unclear. Or it could be as simple as I had one company where the stop button was green, and the Go button was red. That's very counter intuitive on your equipment. I mean, common common knowledge is that Go is green, stop is red. So it's easy for, I kept seeing all these. Why don't we just change the button I mean, there are some times where it's someone who's just not getting it. And that's when obviously there needs to be some coaching and management needs to get involved. But again, it comes back also to risk which we were talking about earlier that companies need to discuss how they're going to correct these investigations, what what the outcome is, what these root causes are, because they can be expensive, or they could cause other issues in the process. So they need to evaluate them properly. And then they need to come up with what's the risk of continuing having these investigations, or the cost of actually putting in the fix.

Harsh Thakkar: 13:12

Yep. Yeah, that's, that's a great point. And I agree with you, like operator error is one of the ones that is very, like difficult to figure out if that is the real root cause, or there's a lot of other things going around it. And you brought up some really good examples, like training or documentation. So now, here's another one that I want to ask you just because you are in quality and regulatory. So a lot of the the origins of guidance documents or regulations have been around, I think, been around for 20 years. Like if you look at the big ones, 10-20 years, now they're getting revised every three years or five years, whenever something new happens, it gets revised. But fundamentally, it's the same, right? If we talk about computer software validation, that started like 20 years ago, or electronic records, electronic signatures, it hasn't changed much. Right. That's one example. I'm sure you have others. So why then still today, companies are facing challenges with compliance because it's been around for so long, it's written in English. So why why do Why do you think people struggle with with

Kimberly Wallbank: 14:26

Oh, that's a great question. I think it compliance? really comes down to the culture of the company. And the mindset, again, goes back to your first question of what people think about quality and compliance. And if there was more of a cross functional focus, more of an understanding of why this is important and making the rules making the rules within the organization easier to follow. Yeah, with an understanding of why you're following them people are more likely to follow instructions that they understand why they have to do it. So I'm, I'm a big rule follower, which is why quality compliance work for me, because so you tell me the rules, I'm gonna go follow it, I may, I may start questioning them after a while, but I'm at least going to try them. But it's one of those things where from top part of the organization all the way down to your individual contributors need to buy into this is our approach, this is our goals. And that transparency between those levels of management need to happen of why we're taking this approach versus some other approach. I think the other thing is that they're not learning from each other. One company may not be learning from the other company. I mean, the FDA does give you access to read other people's consent decrees, warning letters 483s. There's organizations out there like RAPS that actually publishes them every Tuesday, the link into and has a brief discussion of what they are the main ones. But what's also very disturbing is that within the organization itself, they're not learning from each other. So I worked for one company where one division got a warning letter. And so they were fixing it within that division, but they didn't bother to look at what does that mean, for the other divisions? Are we having the same issues over there? And in one case, it was one site got the warning letter, and the other sites within that division, they didn't bother to check. And it was like, Well, wait a minute, we're having the same issue over here. Just because the FDA found it at site A, doesn't mean, they're not going to come to site B, and then cite you for it? In fact, they're probably gonna cite you worse, because you knew you had this issue.

Harsh Thakkar: 16:56

Right, right.

Kimberly Wallbank: 16:57

So I think this whole being proactive in learning, and creating that quality mindset throughout the whole organization. In fact, it's interesting, you brought that up, because I'm in the process of writing my January blog piece for my website, and it's, it's on how to get people on board with thinking about quality,

Harsh Thakkar: 17:21

yeah, and then the, the knowledge sharing part is a big one, right? It's, it's something that I've seen, in other industries, it's more like more agile and more, I don't know the right word to put it, but it's more natural, right? Like, if you go work at a tech company, everything that like about their product, or the changes that they made to the product, or the new features that they're doing, or meeting minutes from the last design meeting, they had, like, they have some sort of Project Management Cloud tool that has all of this information available to the product managers, to the developers, engineers, whatnot. But when you come into life sciences, it's like you, you do have your SOPs and policies, which pretty much the entire company has access to, because they're training. But then there's lot of these other documents, PowerPoint slides, or Excel spreadsheets and whatnot, that don't get shared. And yeah, there's companies who put it on SharePoint just so that people can access it. But sharing doesn't mean just giving you access to that file. It's making sure that what's in it, and how you can use that information for your role versus how I'm using it for my role, right. So so I feel like that's a big step. Because I've, I've gone to many companies, and they're like, Oh, here's access to SharePoint. And and I'm like, but I don't understand 10 of these documents, who do I talk to? And it, it's, it takes them a lot of effort to find the person who can walk me through that document. And that shouldn't happen.

Kimberly Wallbank: 18:55

Right? No, absolutely. And it kind of also comes down to metrics and dashboards. So I've seen a lot of companies in the last, I don't know, 10 to 15 years create these metrics and dashboards of metrics and it goes up to the site management, maybe even higher, and, but it's used as a stick as opposed to a carrot. So everyone's so focused on not being red, because they usually are color coded red, yellow, green. And one of the things is that sometimes these metrics don't make sense of what you're trying to measure. And sometimes it gets lost in getting the right grade versus understanding what you're trying to do. And putting context around it. It's, I equate it to being in like high school. And so focus on getting the A that you memorize and memorize, memorize, but you don't really learn anything. So it's when people then get their performance review based on these metrics. Without any context around it. In fact, I'm about to do a talk in a few weeks on complaint handling metrics, and what data you can get out of complaint handling and why people are doing it wrong. That it's just this data mining tool that you can use to get things out of that people aren't using it right? Or, and then they're not setting it up, right. So they can use it. But it's yeah, it's very much a siloed field. And I definitely agree with that. I'm not quite sure how to fix that yet. I've, I know, when I was a manager, I used to I don't know every four to six weeks, take my staff meeting, and turn it into a learning opportunity for my team where I would have a manager or someone else come in to the meeting and discuss their area. So they would actually get an opportunity to meet someone else, because we were a very large facility. So one time I had a seasoned project manager come in and explain how he manages projects, capital projects, with a million dollar budgets. I had someone who came in who worked with you in getting things proved over the EU because there are special rules and special signatures needed and have him come in and discuss it a little bit. And then it was like, open forum for my team to discuss. And it was very helpful, because the last thing you want is these larger meetings where it's like, okay, this person is going to tell you something, but there's always going to be some fire to put out so people aren't going to be there. And it's going to be seen as this mandatory thing that everyone's just going to roll their eyes. So it's a it's a way to make it interactive. But make it also small enough to where you're given the opportunity by your management to attend. But at the same time, it's not this stick that you're required to do.

Harsh Thakkar: 21:55

Right? Yep. And anyone listening to this episode right now, if they are looking to get into quality or regulatory, they've never worked in this field they want to get in? What advice do you have for them?

Kimberly Wallbank: 22:10

That's a great question. I found it, I came in through doing a lot of other things in industry. First, I did manufacturing quality control r&d, what I found made it easy to get in was working in other parts of the quality system in demonstrating those skills that to do that, for example, when I did manufacturing and quality control, I had to write my own investigations, I had to review my colleagues Batch Records before they went over to quality. So and then having those conversations with quality. So when you do start interviewing with quality of look, this is the skills I have, you can show that that mindset. Now, what's good about now versus then when I got in, is that people are now really looking for people in quality having some sort of technical expertise. Okay. So unlike back in the late 90s, where you could really just enter quality, because they were like, here, here are the rules now go make people follow them. Now, it's you have to be able to understand what you're signing the science and the technology behind what you're signing.

Harsh Thakkar: 23:28

Right. Right.

Kimberly Wallbank: 23:29

So it, it helps having those backgrounds, that experience in industry, whether it's engineering r&d manufacturing, to, to get into that role now.

Harsh Thakkar: 23:42

Yeah, that's an interesting point. Because especially with the advanced therapeutics and Gene cell and gene therapy, to get into a QA role in a company like that, you are going to need more than just QA experience you're going to need a little bit of manufacturing background, or something extra for those kinds of advanced therapies to get into that role. Yeah, that's a great one. So I know your your you mentioned about a speaking topic that you're doing. But where can the audience connect with you to keep up with your work to keep up with all the insights and maybe collaborate with you on projects.

Kimberly Wallbank: 24:15

So there's two ways to get a hold of me. One is through LinkedIn. In fact, I took a break during the holidays, but I'm back to providing some content almost every day for a while there before the holidays. I was doing seven days a week. I think I'm going to dwindle it down just to Monday through Friday with occasional updates on weekends. And then my website quality systems services. That's where my blog is, there's a way to contact me through there as well, where I receive email and my contact informations there. LinkedIn will also get you to my website as well.

Harsh Thakkar: 24:48

Perfect. Yeah, we'll put that in the show notes. Any final words for the audience before we?

Kimberly Wallbank: 24:52

Yeah, no, I first of all, I really enjoyed this conversation. And I think for me, I think we need to make quality, easy accessible for everyone. Because if you don't, you're going to end up having these issues where you have layoffs because you've had to spend so much money doing certain things. Take the time to do the risk, right? Take the time to see where we need to invest, versus just putting funds into areas where it's just kind of like a nice to have shiny thing. I just think it just would be better.

Harsh Thakkar: 25:28

Yeah agreed. Thank you. Again, Kimberly, for your time and wish you all the best with all the work you're doing in 2024. Thank you.

Kimberly Wallbank: 25:36

Great. Thank you so much.

Harsh Thakkar: 25:38

Thank you so much for listening. I hope you enjoyed today's episode, check out the show notes in the description for a full episode summary with all the important links. Share this with a friend on social media and leave us a review on Apple podcasts, Spotify, or wherever you listen to your favorite podcast.