iso 14971 Medical device companies MUST have established risk management processes that comply with ISO 14971.

And it doesn't matter if you are developing medical devices in the U.S., EU, Canada, and so on.

EVERY INTERNATIONAL REGULATORY AGENCY YOU’VE EVER HEARD OF ACCEPTS ISO 14971 AS THE RISK MANAGEMENT STANDARD FOR THE MEDICAL DEVICE INDUSTRY.

ISO 14971 is a good standard. Informative and descriptive. Easy (enough) to comprehend.

Let's do a brief walk-through of the standard in plain English and provide an overview of key definitions and concepts.


 

ISO 14971 Risk Management Key & Definitions

Section 2 of ISO 14971 provides a thorough list of key terms and definitions relating to risk management. I am not going to go through every single term. However, I will share a few key definitions.

RISKcombination of the probability of occurrence of harm and the severity of that harm

HAZARDpotential source of harm

HAZARDOUS SITUATION - circumstance in which people, property, or the environment are exposed to one or more hazard(s)

HARM - physical injury or damage to the health of people, or damage to property or the environment

SEVERITYmeasure of the possible consequences of a hazard

RISK ANALYSISsystematic use of available information to identify hazards and to estimate the risk

RISK ESTIMATION - process used to assign values to the probability of occurrence of harm and the severity of that harm

RISK EVALUATIONprocess of comparing the estimated risk against given risk criteria to determine the acceptability of the risk

RISK ASSESSMENToverall process comprising a risk analysis and a risk evaluation

RISK CONTROL - process in which decisions are made and measures implemented by which risks are reduced to, or maintained within, specified levels

RESIDUAL RISK - risk remaining after risk control measures have been taken

Getting a grasp on the list of terms above is critical to understanding medical device risk management. These terms need to become ingrained in the lexicon of medical device professionals.

Yes, I realize you might be using other tools--such as FMEA-- to capture risk management activities. And I realize that these other tools might have similar terminology. Terms such as:

  • Failure Modes

  • Causes

  • Criticality

  • Detection

  • Risk Priority Number

It will be easy for you to fall into the trap that these other terms from your other risk tools are close enough to ISO 14971 to be more or less the same.

Please do not fall into this trap.

ISO 14971 is different than FMEA.

ISO 14971 Risk Management Process Overview

(Click infographic to enlarge.)iso-14971-risk-management-process

Share this image on your site.

This infographic aligns with the standard directly on a one to one basis. And when you let this soak in a minute or two, you can start to see how this image can and should become the foundation for your company's internal risk management process.

You don't have to re-invent the wheel.

You don't need to try and twist and contort your current non-ISO 14971 based processes.

Make your lives a little bit easier. Make sure your risk management process aligns with ISO 14971 standard.

Risk Analysis

Based on figure 1 from ISO 14971 outlining the risk management process for medical device manufacturers, the first major phase is risk analysis.

Risk analysis is the systematic use of available information to identify hazards and to estimate the risk.

In order to do so, you need to define the scope of your medical device.

You need to specify the intended use of the product.

And then you start to identify hazards and hazardous situations. (NOTE: Refer to Annexes E and H in ISO 14971 for guidance on this).

Once hazards and hazardous situations are captured, you need to estimate risks.

Remember, RISK is a combination of the probability of occurrence of harm and the severity of that harm.

This can be read as:

RISK = SEVERITY (S) x OCCURRENCE (O)

However you interpret this, you need to estimate the severity of harm that can result from hazards / hazardous situations.

You then need to estimate the probability of occurrence of each harm.

Risk Evaluation

After estimating risk by defining severity and occurrence, you now need to evaluate the risks.

A very common approach for doing so is to define a risk evaluation matrix.

medical_device_risk_evaluation_matrix

Risk evaluation involves deciding which risks are acceptable and which are unacceptable. 

Risk Control

Risk controls are implemented as a means to reduce and mitigate unacceptable risks

There are a few options to consider when implementing risk controls.

By far the most common risk control measure is to edit product labeling. But know that labeling as a risk control is absolutely the least effective.

Ideally, risk controls should be considered according to the following priorities:

  1. Product Design

  2. Protective measures incorporated within the medical device

  3. Labeling, instructions for use

Once implemented you need to confirm and document the effectiveness of each and every risk control measure.

Residual Risk Evaluation

After confirming effectiveness of risk controls, you then re-evaluate the resulting risks.

And if risks are still unacceptable, additional risk controls will be necessary. 

Interestingly, as you implement risk controls, you could be introducing new hazards and hazardous situations.

These possible new hazards and hazardous situations also need to be estimated and evaluated.

Risk / Benefit Analysis

Sometimes additional risk controls are not practical.

In these events, you have an opportunity to conduct a risk / benefit analysis where you compare the medical benefits of your device and the residual risks. 

(NOTE: I am not going to go through the differences between ISO 14971:2007 and EN ISO 14971:2012 in this post. It is quite the ongoing debate!)

Evaluation of Overall Residual Risk Acceptability

Evaluating risks and residual risks for individual hazards and hazardous situation is not enough.

You also need to evaluate the entire medical device and the overall residual risk acceptability.

It is possible for risks associated with individual hazards to be acceptable but that the entire product may not be acceptable.

Either way, you need to evaluate and document whether or not the product meets the acceptability criteria defined by the company.

Risk Management Report

When all the steps mentioned above have been addressed, a Risk Management Report shall summarize all the risk activities.

Production & Post-Production 

Medical device risk management is a total product lifecycle process.

This means you need to keep the risk management records up-to-date even after the product exits product development. 

The process should involve systematic review of risk management file and be updated when events such as complaints, product feedback, non-conformances, etc. occur.


Read the Definitive Guide to ISO 14971



 

Jon Speer, Co-founder greenlight.guru

Written By Jon Speer


Jon is the founder and VP QA/RA at greenlight.guru (quality management software exclusively for medical devices) & a medical device guru with over 18+ years industry experience. Jon knows bringing a device to market is hard, so he built greenlight.guru to make it easier. Click here to get our actionable medical device content delivered right to your inbox 1x per week.


P.S. You can learn more about our eQMS software and services here.