iso 14971 risk management

This guide reflects ISO 14971:2019, the current edition of the standard.

What is Risk?

ISO 14971:2019 is the international standard for applying risk management to medical devices across the product lifecycle. It defines a process for identifying hazards, estimating and evaluating risks, implementing risk controls, evaluating residual risk, reviewing benefit-risk acceptability, and monitoring production and post-market information.

For medical device companies, ISO 14971 connects risk management to design controls, usability, clinical evaluation, production controls, supplier management, postmarket surveillance, CAPA, and the quality management system. The output is a risk management file that shows how risk was identified, controlled, evaluated, and maintained throughout the device lifecycle.

The Importance of Risk and Medical Devices

The medical device industry is built on trust, between those who design, develop, and manufacture devices, and those who depend on those devices to work safely and effectively.

Imagine this from the perspective of a patient going in for any medical procedure. The patient probably thinks very little about the risks of the medical devices about to be used.

Generally, the patient trusts the expertise of the clinicians. The patient seldom wonders if the products used by the clinicians are safe and have been thoroughly and rigorously tested.

The patient, often unknowingly, accepts the risks of the medical device you and I design, develop, and manufacture. And this is exactly why Risk Management is so important to the medical device industry. You have to know that the medical devices you are involved with bringing to patients and end-users are safe.

Introduction to ISO 14971 Risk Management for Medical Devices

Make no mistake—the products that MedTech professionals design, develop, and bring to market have improved the quality of life for thousands of people. Here at Greenlight Guru, we are fortunate to have the opportunity to work with many others who have the same purpose and mission.

If you think about it, the ideal of improving the quality of life is the very premise of product risk management.

What You Will Gain From This Guide to ISO 14971

The topic of Risk Management is one that can be daunting, and at times confusing. Thankfully, ISO 14971 exists and is helpful in providing guidance and direction.

ISO 14971 provides a thorough explanation of relevant terms and definitions. And the standard defines a risk management process.

Regulations & Standards for ISO 14971 Risk Management

Realize that nearly every medical device regulatory agency has placed the topic of Risk Management front and center.

In fact, regulatory agencies, including FDA, are now using risk-based processes throughout their own internal processes when reviewing device submissions and conducting inspections and audits.

Know this: U.S. FDA, Health Canada, EU Competent Authority, Australia TGA, and Japan MHLW all require you to have a Risk Management process defined and Risk Management documentation for your products.

And all these regulatory agencies endorse ISO 14971 Medical devices -- Application of Risk Management to Medical Devices.

A Brief Overview of the Standard and Accompanying Guidance

The current version of ISO 14971 was released in December 2019. This version replaced the previous two versions of the standard that were utilized by many.

Risk Management Process Overview

Let’s start to dive into the details of Risk Management.

Medical device Risk Management requires top management involvement. It requires that a company establish a Risk Management Policy.

The process itself includes:

Risk Management Definitions You Need To Understand

There are several key terms pertaining to Risk Management defined in ISO 14971:

RISK MANAGEMENT - systematic application of management policies, procedures, and practices to the tasks of analyzing, evaluating, controlling, and monitoring risk

RISK - combination of the probability of occurrence of harm and the severity of that harm

HAZARD - potential source of harm

HAZARDOUS SITUATION - circumstance in which people, property, or the environment are exposed to one or more hazard(s)

HARM - physical injury or damage to the health of people, or damage to property or the environment

SEVERITY - measure of the possible consequences of a hazard

RISK ANALYSIS - systematic use of available information to identify hazards and to estimate the risk

RISK ESTIMATION - process used to assign values to the probability of occurrence of harm and the severity of that harm

RISK EVALUATION - process of comparing the estimated risk against given risk criteria to determine the acceptability of the risk

RISK ASSESSMENT - overall process comprising a risk analysis and a risk evaluation

RISK CONTROL - process in which decisions are made and measures implemented by which risks are reduced to, or maintained within, specified levels

RESIDUAL RISK - risk remaining after risk control measures have been taken

Role of Management in Risk Management

Oftentimes, it is assumed that the topic of Risk Management is only the responsibility of the medical device product developers and engineers designing new products.

While it is true that product developers and engineers do play a pivotal role, medical device Risk Management is a much more comprehensive process that should span all functional areas of a medical device.

This means that, in addition to product developers and engineers, other functional areas including business development, marketing, manufacturing, sales, and end-users should be an integral part of your Risk Management process.

The cornerstone of a medical device company’s risk management process must be executive management.

Risk Management Plan

A Risk Management Plan is a product-level document that should identify the risk management activities you anticipate and plan throughout the product’s life cycle. The Risk Management Plan is dynamic and should be revisited and updated often.

A Risk Management Plan must include the following criteria:

  1. Scope of the Risk Management activities. Define the product included.
  2. Describe the intended use of the product(s).
  3. Identify all Risk Management activities planned throughout the product life cycle.
  4. Define roles and responsibilities. Identify the Risk Management team that will be reviewing and approving risk documentation.
  5. Criteria for the product’s risk acceptability.
  6. Specify methods to verify Risk Control measures.
  7. Define how post-production information will be captured and fed into Risk Management activities for the product.

Risk Management File

A Risk Management File (RMF) is the place where you keep your risk management activities, documentation, and records.

A Risk Management File contains evidence of:

Risk Assessment = Risk Analysis + Risk Evaluation

ISO 14971 discusses Risk Analysis and Risk Evaluation as separate sets of tasks that together comprise Risk Assessment.

Risk Analysis

The starting point for identifying specific risks related to medical device products is Risk Analysis. There are lots of ways you can conduct Risk Analysis.

The Risk Analysis Process is typically described in your company’s Risk Management procedure. The Risk Analysis must identify the medical device, as well as who was involved, risk analysis scope, and date(s).

Identification of Hazards

Hazards are potential sources of harm. For your product, you need to identify all the possible hazards. ISO 14971 Annex C contains a great list of examples of hazards.

Risk Management Review

Before going to market with your medical device, the results of all steps in your risk management process shall be reviewed to ensure completeness.

You need to establish a Risk Management Report, which will summarize all your risk management activities and include any benefit-risk analyses and explanation of overall risk acceptability.

Summary

Realize that your Risk Management process must include: