ISO 14971 - The Basics of Medical Device Risk Management

SAVE OFFLINE

My Account

Store



Search …

Contact Us

The Leaders in Quality and Regulatory Training & Consulting Need Assistance?

1.888.532.6360

HOME

ABOUT US

CONSULTING & AUDITING

FIND A TRAINING COURSE

RESOURCES

BLOG

ISO 14971 and the Basics of Medical Device Risk Management Explained Search by Topic All Topics Auditing CAPA and Root Cause Analysis Clinical Evaluation Reports Complaint Handling and Postmarket Surveillance Design Control EU Medical Device Regulation (MDR 2017/745)

July 18, 2018

This is the first installment of a 3-part blog series on risk management. If you already know the basics, skip to the second post on risk management planning. We’ve combined all three posts into one easyto-read PDF, plus added some extras. Download it here. From a distance, risk management seems straightforward. You have a device, evaluate its potential risks, mitigate those risks, monitor them over time, and you’re done. Seems easy, right? Ah, if only life were so straightforward. The reality is that risk management is one of the more complex aspects of regulatory compliance, simply because risk comes in so many flavors and perceptions of severity, and probability can be interpreted quite differently. The thing that makes risk management tricky is that we often don’t have enough real-world data to accurately quantify risks, especially for new devices. Fortunately, there is a systematic process you can establish to estimate, evaluate, control, and monitor risks. Before we get into that, let’s step back and talk about the regulations and standards that dictate how you should approach risk management.

FDA 510(k) Submissions In Vitro Diagnostics & IVDR ISO 13485:2016 ISO 9001:2015 MDSAP MEDDEV 2.7/1 rev 4 Medical Device Quality Assurance Process Validation Risk Management/ISO 14971 Software as a Medical Device Supplier Management US FDA 21 CFR Part 820 (QSR) US FDA Updates

Medical device risk and risk management defined Risk is the combination of probability of occurrence of harm and the severity of that harm. Risk management is the systematic application of management policies, procedures, and practices to the tasks of analyzing, controlling, and monitoring risk.

Why is risk management needed? Simply put, we have a collective interest in ensuring that medical devices are safe and effective. Risk management is not optional – it is a regulatory requirement worldwide. The US FDA mandates it in the Quality System Regulation (21 CFR Part 820). Europe requires it in the new Medical Device Regulation (MDR 2017/745). Likewise, Japan, Canada, Australia, Brazil, and all other major markets require the

application of risk management, which is either referenced in their national regulations and/or ISO 13485:2016.

The role of the ISO 14971 standard Fortunately, national governments have NOT created their own guidelines telling you how to how to perform risk management. Instead, they all defer to ISO 14971, the global standard for medical device risk management. The intent of the standard is to identify hazards associated with medical devices at all stages in its life cycle, from product design to procurement to production and postmarket use. In all cases, the goal is to estimate, evaluate, control, and monitor the risks associated with each life-cycle stage. There are two versions of this standard in use today: ISO 14971:2007 – The US FDA and most other markets recommend this version of the standard to meet national risk management requirements. ISO 14971:2012 – This version is required to meet CE Marking requirements for medical devices sold in Europe. It differs only the front matter describing how ISO 14971:2007 deviates from the device directives in Europe.

If you are just getting started implementing risk management for your company, purchase the ISO 14971:2012 standard and its guidance ISO 24971:2013. You will also want to buy and read the ISO/TR 24971:2013 standard. It is brief but provides excellent guidance for dealing with specific areas of ISO 14971. Both are copyrighted documents and you can purchase them online from ISO.

ISO 14971 was first introduced in 1998 and has expanded in scope during subsequent releases. Work on an updated version is underway. An updated dated ISO 14971 is underway and expected to be complete sometime in 2019. The focus of the revision is not on revising the risk management process but rather to improve the information on implementation of the life cycle risk management process.

Sections of ISO 14971 Although risk management can be complex, the main body of the ISO 14971 standard is a scant 14 pages and consists of 9 clauses: 1. Scope 2. Terms and conditions 3. General requirements for risk management 4. Risk analysis 5. Risk evaluation 6. Risk control 7. Evaluation of overall risk acceptability 8. Risk management report 9. Production and post-production information

And these are the key annexes supporting those clauses: Annex A – Rationale for requirements Annex B – Overview of risk management process for medical devices Annex C – Questions that can be used to identify medical device characteristics that could impact safety

Annex D – Risk concepts applied to medical devices Annex E – Examples of hazards, foreseeable sequences of events, and hazardous situations Annex F – Risk management plan Annex G – Information on risk management techniques Annex H – Guidance on risk management for in-vitro diagnostic medical devices Annex I – Guidance on risk analysis process for biological hazards Annex J – Information for safety and information about residual risk

Basic steps in the medical device risk management process So where to begin? It helps to think about risk management as a process that starts with a plan. While the end deliverable is a report, your work in controlling risk is never done. We will talk in detail about each of these areas later, but here are the steps.

Create a risk management plan: Document activities that will take place, assign responsibilities, determine risk review requirements, establish risk acceptability levels, plan verification activities, and plan production/post-production activities. Assemble your risk management team: Assemble a qualified team of people who know how your device is constructed, its manufacturing processes, how it is used in the field, etc. Use risk analysis tools to identify risks: Choose the tools you will use to measure risk (discussed more later) and then use them to identity risks posed by your processes, users, suppliers, maintenance tasks, shipping, production equipment, etc. Weigh the risks versus the benefits: This is fairly self-explanatory, but the end goal is to ensure that the medical benefits of your device outweigh residual risks. Eliminate or mitigate risks: The goal here is to reduce risks to an acceptable level. We’ll talk more about risk reduction later and address how this varies between the 2007 and 2012 versions of ISO 14971.

Want to learn more? If you enjoyed this article, be sure to read the second post in this series focusing on risk management planning. If you’re ready to take the next step, check out our intensive three-day risk management training class taking place in a city near you.

Our team is here to help. Call 1.888.532.6360 or contact us online ›

 All Topics, Risk Management/ISO 14971

About Us 1095 Morris Avenue Suite 103B Union, NJ 07083

Consulting & Auditing

Contact Us

› Performance Excellence

Blog

› ISO 9000 & Related Standards

Employment

› Medical Device RA/QA

Phone: 1.888.532.6360 Fax: 732.548.4085

› Quality System Audits for ISO 13485 and FDA QSR

Find a Training Course

© Oriel STAT A MATRIX. All Rights Resrved. | Site Map | Privacy and Legal