Risk management is crucial for medical device design, development, and manufacturing.
It involves risk assessment (ISO 14971:2019) which includes risk estimation and acceptability determination.
Risk evaluation analyzes risk control measures, residual risk, and benefit-risk analysis.
Residual risk impacts device classification and submission pathways.
Cross-functional teams are essential for the risk management file, including members from clinical, software development, engineering, usability, manufacturing, supply chain, packaging, regulatory affairs, and top management.
The risk management process includes planning, review, and ongoing risk analyses.
ISO 14971:2019
Companies must consider safety, functional, performance, and usability requirements in design input (ISO 13485:2016 Section 7.3.3).
ISO 14971:2019 provides a framework for:
Identifying potential harm sources and hazardous situations.
Estimating harm severities and probabilities.
Identifying risk control measures.
Determining post-mitigation risk and benefit-risk analysis.
Determining overall residual risk.
The risk management process involves key activities at each stage (Figure 7-1).
Risk Management Planning
Scope determination for identified activities.
Assignment of responsibilities and authorities to resources.
Personnel must have competence, education, training, skills, and experience, plus knowledge of medical devices and technologies.
The risk management plan:
Summarizes the overall process approach and methodology.
Defines the manufacturer's policy for determining acceptable risk.
Policy can come from the state of the art and regional regulatory requirements.
Manufacturer's policy is the basis for determining the acceptability of overall residual risk.
The relationship between policy, risk acceptability criteria, risk control, and risk evaluation is in Annex C of ISO/TR 24971:2020.
Risk Acceptability Criteria
Approaches include:
Reducing risks as low as reasonably practicable (ALARP).
Reducing risks as low as reasonably achievable (ALARA), especially for radiation exposure.
Reducing risk as far as possible without affecting the benefit-risk ratio (ISO/TR 24971:2020, Annex C.2).
The key output is establishing residual risk acceptability criteria.
ISO 14971:2019 requires identifying qualitative and quantitative characteristics impacting safety.
Reasonably foreseeable misuse is use not intended by the manufacturer but resulting from predictable human behavior.
Intended use, safety characteristics, and reasonably foreseeable misuse inform the identification of potential harm sources.
Functional areas like clinical and usability are key to identifying hazards and hazardous situations.
Customer complaints and marketing provide misuse information.
Software development, engineering, manufacturing, and logistics identify potential failure modes.
Harm sources occur in all lifecycle phases, including transport, storage, installation, maintenance, and disposal.
Risk is the combination of harm severity and occurrence probability.
Techniques guidance is in ISO/TR 24971:2020.
Key output is risk estimation, based on severities and probabilities.
This includes:
Postmarket surveillance data.
Published standards.
Scientific/technical investigations.
Usability tests.
Clinical evidence.
Investigations or simulations.
Expert opinion.
The output record includes intended use, safety characteristics, misuses, hazards, hazardous situations, failure modes/causes, and severity/probability estimates.
Risk Evaluation
Determining identified risks acceptability based on residual risk acceptability criteria in the risk management plan.
Risks are assigned to acceptable or unacceptable categories.
Key output is identifying hazard/situation/failure mode combinations that are acceptable versus those needing further investigation.
The output record is a list of risks categorized by residual risk acceptability criteria.
Risk Control
Developing mitigations to reduce harm severity and/or occurrence probability for unacceptable risks.
Risk mitigations fall into three categories:
Inherent safe design and manufacture (reducing hazard probability to negligible).
Examples: stationary components, restricted user access, eliminating hazardous substances.
Protective measures in the medical device or manufacturing process (reducing severity or probability).
Examples: safety goggles, ISO cleanroom requirements, anti-static wrist straps.
Information for safety and user training (reducing severity or probability).
Examples: contraindications, warnings, and precautions in labeling.
Effectiveness is evaluated by updating product requirements, specifications, and manufacturing processes.
Risk control measures must not introduce new risks.
Verification activities are required for updates; validation and usability testing for protective measures or training.
Key outputs are risk control measures and acceptability determination for marginal/unacceptable risks.
Output records include:
Planned risk control measures.
Updated product documentation.
Verification/validation/usability test plans.
Finalized risk control measures.
Acceptability determination of remaining risks.
Updated product documentation.
Verification/validation/usability test reports.
Benefit-risk analysis is conducted for unacceptable risks where severity and/or probability are not reduced.
Evaluation of Overall Residual Risk
Evaluating residual risk against acceptability criteria (ALARP, ALARA, or risk reduction without affecting the benefit-risk ratio).
Benefit-Risk Analysis
ISO 14971:2019 defines benefit as the positive outcome from device use.
This includes clinical outcome, health/quality of life improvement, and desirable changes to patient management.
ISO/TR 24971:2020 elaborates on estimating benefits by considering:
Type (e.g., life-saving).
Magnitude (e.g., therapeutic benefit extent).
Probability (e.g., diagnostic benefit effectiveness).
Duration (e.g., length of time).
Comparison to standard practice and other treatment options, involving medical, clinical, and engineering expertise.
Literature searches provide insights; clinical evidence supports clinical benefit estimation.
Comparison varies by product, considering disease characterization, data certainty, and production/post-production data for similar devices.
Comparison accounts for benefits and residual risks of similar devices and alternative solutions.
Business or economic advantages cannot be used in evaluating residual risk acceptability (ISO 14971:2019, Section A.2.7.4).
Significant residual risks must be communicated to patients, healthcare professionals, and other users.
Key output is benefit-risk analysis of residual risk and acceptability determination.
The output record is a summary of residual risks and benefit-risk analysis in a risk management report.
Risk Management Review
Evaluating risk management activities and output records against the risk management plan.
Conducted at planned intervals and before device approval for commercial distribution.
Top management reviews the suitability and effectiveness of the risk management process throughout the device lifetime.
Key output is confirming defined activities have been implemented, overall residual risk is acceptable, and production/post-production risk management activities are defined.
The output record is the risk management report, with documentation of initial and ongoing reviews.
Production and Post Production
Collecting and reviewing safety-related information after design transfer.
Using appropriate data collection and processing methods including:
Information from production, installation, servicing, and maintenance.
Logistics and supply chain information.
Quality management system data (nonconforming materials, CAPA, trend analyses, audits).
User-generated Information.
Published data specific to device application.
Alternative devices and therapies availability.
State of the art.
Publicly available information about similar devices.
New or revised standards.
Reviewing collected information for new hazards and changes to:
Estimated risk severities and probabilities.
Acceptability of risk pre- and post-mitigation.
Acceptability of overall residual risk.
Benefit-risk analysis.
Understanding of the state of the art.
Key output is reviewing conclusions against new information and impact analysis to design documentation.
The output record is the updated risk management file and design documentation updates.
ISO 14971 Integration with Regulations and Standards
Product-specific standards applied with ISO 14971 include:
ISO 10993-1:2018 (Biological evaluation of medical devices).
Annex F of ISO/TR 24971:2020 discusses security risks (data integrity, availability, confidentiality).
IMDRF guidance document (Principles and Practices for Medical Device Cybersecurity) covers software risk estimation and cybersecurity vulnerability considerations, including:
Secure communications.
Data protection.
Device integrity.
User authentication.
Software maintenance.
Physical access.
Reliability and availability.
The IMDRF guidance discusses security risk assessment, threat modeling, vulnerability scoring, and security testing, referencing NIST Cybersecurity Framework and AAMI TIR57:2016 (R2023).
Risks related to clinical testing are discussed in Chapter 17.
ISO 13485:2016 provides the framework for product realization.
MDSAP Audit Approach document aligns medical device requirements for participating regulatory authorities and include:
Risk management planning and review.
Risk management activities throughout development.
Design verification and validation to confirm risk control effectiveness.
Risk controls applied to production and service process.
Risk controls applied to transport, installation, and servicing.
ISO 13485:2016 Clauses 4.1.2 (b) and 4.2.1 discuss a risk-based approach, with clause 5.2 requiring top management to ensure that customer requirements are met.
Clauses 7.1 to 7.3 relate to product realization. Clause 7.5 focuses on production and service provision. Clause 8.2.1 is specific to monitoring and measuring customer feedback, with clauses 8.1 and 8.2.5 requiring monitoring and measurement of processes.
North America
United States
FDA's Quality System Regulation (QSR) (21 CFR Part 820) risk-specific requirements are summarized in the MDSAP approach document, including:
Risk management planning and review (21 CFR §820.30(g)).
Risk management activities applied throughout the design and development project (21 CFR §820.30(g)).
Design verification and design validation to confirm effectiveness of risk control measures (21 CFR §820.30(f), §820.30(g))
Control, operation, and monitoring of the production and service process; risk controls (21 CFR §820.70(a), §820.75(b), §820.250).
Risk controls applied to transport, installation, and servicing (21 CFR §820.160(a), §820.170(a), §820.200(a)).
21 CFR §820.30 refers to Design Controls, the FDA guidance discusses vulnerabilities relating to user interactions, confidentiality, integrity, availability, and exploitability.
The MDSAP Design & Development task requires the verification of risk mitigation measures and the validation of such mitigations, in 21 CFR §820.30(g).
For validating software-related risk control measures, the FDA guidance document "Software as a Medical Device (SaMD): Clinical Evaluation" provides the key questions to distinguish between analytical validation and clinical validation.
The FDA guidance document also provides a worksheet for benefit-risk assessment, with both hypothetical and actual product examples.
Remaining QSR sections refer to clauses for production and process controls, process validation, distribution, installation, servicing, and statistical techniques.
ISO 14971:2019 is recognized as a consensus standard in the FDA Recognized Consensus Standards database for Medical Devices, with Recognition Number 5-125.
Canada
Health Canada's Safety and Effectiveness Requirements are outlined in the Canadian Medical Device Regulations (SOR/98-282), Sections 10 to 20, including:
Section 10: Identification, elimination (where possible), and reduction of risks, and information relative to residual risks.
Section 11: Medical devices must not adversely affect user health or safety.
Section 13: Performance must not deteriorate during the device's useful life.
Section 14: Transport/storage conditions must not adversely affect performance.
Section 15: Materials must be compatible and not pose undue risks.
Section 16: Design, manufacture, and packaging must minimize risk from foreseeable hazards.
Sections 21-23 discuss labeling requirements and directions for safe use.
Class II to IV devices must be certified to ISO 13485.
Integration with Regulations and Standards section.
Health Canada recommends a device-specific cybersecurity risk management processes in the Guidance Document: Pre-market Requirements for Medical Device Cybersecurity.
In the cybersecurity guidance document, Health Canada describes the risks related to secure communications, data integrity and confidentiality, user access, software maintenance, hardware or physical design, reliability, and availability.
Europe
Regulations (EU) 2017/745 (MDR) and 2017/746 (IVDR) require manufacturers to meet General Safety and Performance Requirements (GSPR) (Annex I), including:
Clause 1: Devices must be safe and effective, with acceptable risks.
Clause 2: Risks must be reduced as far as possible without impacting the benefit-risk ratio.
Clause 3: A risk management system is required with a plan, hazard analysis, risk estimation, control, and post-production feedback.
Clause 4: Risk mitigations must be state of the art.
Clause 5: Human factors integration is necessary to eliminate or reduce use of error-related risks.
Clause 6: The health and safety of patients, users, or other users are not adversely impacted throughout the lifetime of the device.
The MDR goes even further with the definition of clinical benefit, requiring it to be expressed in terms that are both meaningful and measurable.
MDR and IVDR Annex I Chapter II discuss risks and product properties related to materials, infection, radiation, energy sources, mechanics, and thermal risks.
MDR and IVDR Annex I Chapter III discuss labels and instructions for use, including communication of residual risks.
MDR and IVDR require a product safety risk management system (MDR Article 10(2) and IVDR Article 10(2)).
The General Data Protection Regulation [Regulation (EU) 2016/679] establishes the rules for the processing of personal data and the free movement of such data.
Asia
China
The Chinese National Medical Products Administration (NMPA) recognizes YY/T 0316-2016 for risk management.
YY/T 0316-2016 requires manufacturers to provide traceability of following for each identified hazard:
Risk analysis.
Risk assessment.
implementation and verification of risk control measure.
Assessment of the acceptability of any one or more residual risks.
In 2021 Centre for Medical Device Evaluation (CMDE) released a detailed comparison of risk management requirements in China and Europe.
yy/T 0316-2016 standard grants manufacturers the discretion to determine which acceptable residual risks to notify end users, patients, etc. about, while the EU MDR stipulates that manufacturers must inform users of all remaining risks.
Japan
The Pharmaceuticals and Medical Devices Act contains three risk-related essential principles:
Article 2 Risk management
Article 6 Benefits of medical devices
Article 12 Consideration of medical devices using software
The risk-specific requirements from the Ordinance on Standards for Manufacturing Control and Quality Control of Medical Devices and In Vitro Diagnostic Reagents (MHLW Ministerial Ordinance No. 169 (MO169)) are summarized in the approach document for the Medical Device Single Audit Program (MDSAP).
MO169 Chapter 2 contains Articles 4-64, and outlines the standards for manufacturing control and quality control for medical devices and in-vitro diagnostics.
India
The Medical Device Rules (2017) define regulations for medical devices and IVDs.
Chapter II indicates manufacturers must follow essential safety and performance principles.
The Device Master Files for both Class B, C, and D medical devices and in vitro diagnostic devices shall contain the following:
Safety and performance related information on the device.
Summary of the identified risks and controls.
Clinical evidence and evaluation.
Chapter IV requires manufacturers to adhere to a quality management system, specifically requiring certification to ISO 13485
Latin America (LATAM) and the Caribbean
Brazil
The Brazilian Health Regulatory Agency Agência Nacional de Vigilância Sanitária (ANVISA) has established the Collegiate Board Resolution RDC No. 665 of 30 March 2022 as the good manufacturing practices for Medical Products and In Vitro Diagnostic Products.
Article 19 establishes the criteria for a continuous risk management process, requiring analysis, evaluation, control, and risk monitoring.
ANVISA has published Guide 38/2020 "Principles and Practices of Cyber Security in Medical Devices" to provide further guidance on using a risk-based approach for cybersecurity protections in the design and development of medical devices.
Oceania
Australia
The Australian Therapeutic Goods Administration has established the Therapeutic Goods (Medical Devices) Regulations 2002 (TG(MD)R) for both medical devices and in vitro diagnostic devices (IVDs).
Manufacturers are required to demonstrate compliance to applicable provisions of the essential principles outlined in Schedule 1, as per TG(MD)R Schedule 3 P1 C1 1.4(2).
Schedule 3 P1 describes the aspects related to the design and development process. These include the classification rules, conformity assessment procedures, controlling and monitoring each stage of the design and production process, gathering postmarketing data, and implementing corrective actions in relation to the design or production of the devices.
Conclusion
Many country-specific and/or regional requirements for the design, development, and manufacture of medical devices concern safety and risk.
The widely used risk management standard ISO 14971:2019 provides a framework for risk management planning, risk analysis, risk evaluation, risk control, evaluation of the overall residual risk, review of the risk management process, and production and post-production monitoring.
Risk management is key to getting a medical device to market and to ensuring its ongoing competitiveness.