Application of risk management to devices can be challenging, especially when standards can change.
However, because risk management occurs for the entire life cycle of a device, understanding the steps involved and applying them appropriately is important.
General Considerations of ISO 14971
ISO 14971 is an international standard that applies to the risk management of medical devices.
It provides a means for a manufacturer to analyze, evaluate, control, and monitor risks to patients, operators, other equipment, and the environment. However, it does not require a device to be entirely risk-free or set a specific level of acceptance of risk.
Manufacturers and other stakeholders should realize that no medical device can be entirely risk-free. Each entity involved can place a different value on the possibility of harm occurring and the seriousness of the harm. As such, risk management can be complex.
However, the probability that harm will occur and the consequences of that harm both affect the concept of risk.
In general, the steps include establishing a risk management framework, performing a risk analysis, and documenting the results. These steps also consist of several smaller steps to ensure compliance.
Establishing a Risk Management Framework for Medical Device Compliance
To be compliant with ISO 14971, manufacturers should establish a framework for managing risks. This framework includes developing a process, clarifying the responsibilities of management, reviewing qualifications of appropriate personnel, and developing a risk management plan and file.
Document appropriate processes
As part of establishing a process of risk management, manufacturers should document what the appropriate processes are. Manufacturers should research the state-of-the-art standards and ascertain which ones apply to the device. They should also determine how the process will be maintained throughout the life cycle of the device.
Discuss risk management procedures
Next, manufacturers should a discuss risk management with the appropriate personnel and make certain that they demonstrate a commitment to the process.
These personnel should have a way of governing risk acceptance criteria and should review the risk acceptance criteria periodically. Manufacturers should also make certain that they have the appropriate qualifications and training to assess risks. Documentation of this training should be kept on file.
Manufacturers should develop a risk management plan appropriate documentation for each device being produced.
In each plan, the scope of risk management activities should be defined and risk management responsibilities and authorities should be identified. Each plan should contain requirements for review of risk management and risk acceptability criteria.
Methods of collecting and reviewing production and postproduction data on a device should also be included.
Establish a risk management file
After a plan has been developed, a risk management file should be established and maintained. This risk management file should be used to record the results of risk management analyses, risk management evaluations, control measures, and residual risk evaluations for each identified hazard.
Documentation for this file should be provided in a timely manner.
How to perform a risk analysis for a medical device
After developing the framework, manufacturers should conduct a risk analysis. This includes providing information on a device’s intended use, identifying any hazards, and determining the possibility of each hazardous situation occurring.
Characteristics and hazards that could potentially affect safety should be identified, and the level of risk should be estimated.
The risks should be evaluated to determine whether risk reduction measures should be taken. If necessary, appropriate risk control and reduction should be implemented. The residual risks should also be evaluated.
Documenting the Results
Documentation of the results of the each risk analysis, each device’s intended use, any foreseeable hazards, the level of risk and the process used to estimate the risk, risk evaluations, and evaluation of the residual risks should be recorded in the risk management file.
Personnel should also inspect the file periodically to make certain that it complies.
Conclusion
Compliance with ISO 14971 can be a complicated process. However, manufacturers can take a number of steps to ensure that a device complies with the appropriate regulations.
By establishing the appropriate framework and conducting the appropriate analyses, manufacturers can increase the safety of devices for patients, operators, and other appropriate personnel.
Want to learn more about medical devices and the FDA? Grab our free whitepaper: Medical Device Single Audit Program Pilot