Does biopharma data need a Maslow Hierarchy?
The risks that I see most often in Data Risk Reviews seem to fall into three main categories that form a kind of Maslow-style hierarchy. I think understanding this hierarchy could be useful for anyone who wants to do a self-review of their data risks, so that’s what this week’s post is about. In future posts, I’ll go into more detail about each of the categories.
Understanding these categories is important because early discovery research isn’t covered by GXP. Being free of GXP gives teams the flexibility to try new things and move fast, unencumbered by strict rules about to handle their data, but ignoring the principles entirely means working without a safety net. It means your team doesn’t get the security and reproducibility that GXP is meant to ensure.
So in practice, it’s up to you to decide what level of risk you’re willing to accept in return for speed and flexibility. Framing the risks within a hierarchy can help you add the right guardrails to avoid the risks that could bring your programs to a screeching halt, not just adding hurdles because it’s the “right” way to do things.
Acute to Chronic
Here’s how I’m currently defining the categories, though I may revisit this in the future (I’ll probably at least rename them):
1. Acute, Avoidable Risks: These are risks of events with immediate negative impacts that can be avoided if you take the right measures in advance. They’re mostly types of mistakes like errors in manual data processing, picking the wrong version of a file or sharing sensitive information with partners such as CROs. They can typically be addressed by simplifying or automating manual processes, as well as adding audit trails so you can catch the mistakes earlier. If these mistakes go uncaught, your team could spend months chasing ghost results, or worse.
2. Readiness Risks: These are risks of being caught unprepared for inevitable events, whether that means being unable to minimize the impact of negative events or being unable to take advantage of positive ones. These include risks that make it harder to quickly analyze new data or verify results that seem significant, as well as being able to recover from potentially cataclysmic events like losing the one person who knows where all the data is. The cost of being unprepared may be lower than the cost of acute, avoidable risks, but they come at a time when you can least afford them.
3. Overhead Risks: These are issues that slowly build up over time and scale, such as small delays at each stage in a process leading to significantly longer timelines across a program, or a team that doesn’t trust its data demanding more and more validation assays until they can barely make decisions. These risks are often subtle, making it harder to estimate or identify their cost and impact. They can often be addressed with relatively small changes but those changes need to be applied consistently, which makes them much harder to address.
The Hierarchy
What’s nice about these categories is that addressing each one creates a foundation for dealing with the next. Addressing the acute, avoidable risks frees up time and cognitive load to start thinking about readiness risks. Then once you’re confident that you’re team will be ready for whatever comes its way, you can start thinking about addressing the more subtle overhead risks to optimize how the team works.
This is not to say that you have to address each category before you can move on to the next. Just like you can address multiple layers in Maslow’s hierarchy at the same time, you may decide to prioritize risks from these categories in any order. The point is that understanding this hierarchy can help you decide which risks you need to address first, which ones can wait, and which ones are a reasonable price for flexibility.
Thanks for reading! My company, Merelogic, helps biopharma teams implement tools and practices to build a solid data foundation for whatever comes next. You can learn more at merelogic.net and request a free Data Risk Review.