new en iso risk management standard

8/17/2019 New EN ISO Risk Management Standard

1/24

10/15/2010

1

Implementing the New EN ISO

14971:2009 Risk Management Standard

EN ISO 14971:2009 Scope

What it is:This International Standard specifies a process for a manufacturer to identify the hazardsassociated with medical devices, including in vitro diagnostic (IVD) medical devices, to estimateand evaluate the associated risks, to control these risks, and to monitor the effectiveness of thecontrols.

Implementing the revised risk management standard into your manufacturing environment is anecessity to maintain your CE Mark for European distribution of products.

New requirements for review of risk management activitiesNew criteria for risk acceptabilityImplementation of production and post-production informationExpanded Hazard Analysis requirementsClinical Evaluation SummaryRisk control measures and residual risk

The requirements of this International Standard are applicable to all stages of the life-cycle of amedical device.


2/24

10/15/2010

2

What it is not:

This International Standard does not apply to clinical decision making.

This International Standard does not specify acceptable risk levels.

This International Standard does not require that the manufacturer have a quality managementsystem in place. However, risk management can be an integral part of a quality managementsystem.

EN ISO 14971 Revision History

2001: EN ISO 14971:2001 (supersedes BS EN 1441:1998)

2003: EN ISO14971:2001 (addition AMD 14456; July 7, 2003)

2003: EN ISO14971:2001 (correction CORR 14652; August 19, 2003)

2007: EN ISO14971:2007

2009: EN ISO14971:2009


3/24

10/15/2010

3

EN ISO 14971: Comparative Review

OldRevision

NewRevision

Key Changes

EN ISO14971:2001

+AMD14456

+CORR14652

EN ISO14971:2007

Risk analysis process section revised to include clarification around leveraging ofrisk analyses for similar devices

Risk considerations defined a round hazardous situations versus hazards; inparticular “sequence of events” that can produce hazardous situations and harm

Risk management report requirements expanded: Prior to release for commercialdistribution of the medical device the manufacturer shall carry out a review of therisk. Management process and review shall ensure that:

(a) the risk management plan has been appropriately implemented

(b) The overall residual risk is acceptable

(c) Appropriate methods are in place to obtain a relevant production and post-production information

EN ISO 14971: Comparative Review

OldRevision

NewRevision

Key Changes

EN ISO14971:2007

EN ISO14971:2009

Review leads to an informative annex, but no technical content

changed. Per endorsement notice:

The text of ISO 14971:2007, Corrected version 200 7-10-01 has been

approved by CEN as a EN ISO 14971:2009 without any modification.

Note:Although no technical content was changed, a modification was made to figure 1,page 6. The feedback loop was moved from the evaluation of overall residual riskacceptability to the production and post-production information item.


4/24

10/15/2010

4

A schematic representation of the risk

management process

R

I S K C O M M U N I C A T I O N

LIFECYCLE MAINTENANCE

MA NA GE ME NT RE S P ON

S I B I L I T Y

CORE PROCESS

RM PLANNING

RISK CONTROL

RISK ASSESSMENT

Elements of the Risk Management System

P R OD U C T RI S K

DE C I S I ON & RE V I E W S

E F F E C T I V E NE S S

OF

RM S Y S T E M

PRODUCTION

INFORMATION

POST-PRODUCTION

INFORMATION

I N T E R N A L

E X T E R N

A L

EVALUATION OF OVERALL

RESIDUAL RISK

RM REPORT


5/24

10/15/2010

5

Definitions

Risk = occurrence of harm and severity of that harm

Residual risk = risk remaining after risk control measures have been taken

Risk analysis = systematic use of available information to identify hazards and to estimate the risk

Risk assessment = overall process comprising a risk analysis and a risk evaluation

Risk control = process in which decisions are made and measures implemented by which risks arereduced to, or maintained within, specified levels

Risk estimation = process used to assign values to the probability of occurrence of harm and theseverity of that harm

Risk evaluation = process of comparing the estimated risk against given risk criteria to determinethe acceptability of the risk

Risk management = systematic application of management policies, procedures and practices to the

tasks of analyzing, evaluating, controlling and monitoring risk

Risk management file = set of records and other documents that are produced by risk management

Definitions, cont’d.

Harm = physical injury or damage to the health of people, property or the environment, eitherdirectly or indirectly

Hazard = a potential source of harm

Normal Condition

Fault Condition

Hazardous Situation = circumstance in which people, property or the environment areexposed to one or more hazards

Occurrence = the frequency or probability of an event (e.g. harm, hazardous situation,hazard, cause, etc.)

Severity = a measure of the possible consequence of a hazard.


6/24

10/15/2010

6

Use, design and process FMEAs / FTAs

Hazard Analysis

Clinical Experience Summary

Risk Management Plan and Report

Key Deliverables

EN ISO 14971:2009

The manufacturer shall establish, document and maintain throughout the

life-cycle an ongoing process for identifying hazards associated with amedical device, estimating and evaluating the associated risks, controllingthese risks, and monitoring the effectiveness of the controls. This processshall include the following elements:

risk analysis;

risk evaluation;

risk control; production and post-production information


7/24

10/15/2010

7

EN ISO 14971:2009 Risk Management Planning

Risk management activities shall be planned. Therefore, for the particular medicaldevice being considered, the manufacturer shall establish and document a riskmanagement plan in accordance with the risk management process. The riskmanagement plan shall be part of the risk management file.

This plan shall include at least the following:a) the scope of the planned risk management activities, identifying and describing the

medical device and the life-cycle phases for which each element of the plan isapplicable;

b) assignment of responsibilities and authorities;c) requirements for review of risk management activities;d) criteria for risk acceptability, based on the manufacturer’s policy for determining

acceptable risk, including criteria for accepting risks when the probability of occurrenceof harm cannot be estimated;

e) verification activities;f) activities related to collection and review of relevant production and post-production

information.

Best Practices Risk Management Plan

Scope

Responsibilities

Similarities and differences

Acceptance criteria

Review requirements

Verification activities

Production and Post-production information collection methods

Risk Management Report Deviations

Medical benefits summary

Risk benefit evaluation

Summarized risks References

Risk management conclusion


8/24

10/15/2010

8

EN ISO 14971:2009 Risk Management File

For the particular medical device being considered, the manufacturer shall establish and maintaina risk management file. In addition to the requirements of other clauses of this InternationalStandard, the risk management file shall provide traceability for each identified hazard to:

the risk analysis; the risk evaluation; the implementation and verification of the risk control measures; the assessment of the acceptability of any residual risks

EN ISO 14971:2009 Risk Analysis

Intended use and identification of characteristicsrelated to the safety of the medical device:

For the particular medical device being considered, the manufacturer shall document the

intended use and reasonably foreseeable misuse. The manufacturer shall identify anddocument those qualitative and quantitative characteristics that could affect the safety of themedical device and, where appropriate, their defined limits. This documentation shall bemaintained in the risk management file.


9/24

10/15/2010

9

EN ISO 14971:2009 Hazard Analysis

The manufacturer shall compile documentation on known and foreseeable hazards associatedwith the medical device in both normal and fault conditions. This documentation shall bemaintained in the risk management file. Compliance is checked by inspection of the riskmanagement file.

Reasonably foreseeable sequences or combinations of events that can result in a hazardoussituation shall be considered and the resulting hazardous situations shall be recorded. For eachidentified hazardous situation, the associated risks shall be estimated using available informationor data. For hazardous situations for which the probability of the occurrence of harm cannot beestimated, the possible consequences shall be listed for use in risk evaluation and risk control.The results of these activities shall be recorded in the risk management file.

Any system used for qualitative or quantitative categorization of probability of occurrence ofharm or severity of harm shall be recorded in the risk management file.

EN ISO 14971:2009 Hazard Analysis, cont’d.

Risk estimation incorporates an analysis of the probability of occurrence and the consequences.Risk estimation can be quantitative or qualitative. Methods of risk estimation, including thoseresulting from systematic faults, are described in Annex D. Annex H gives information useful forestimating risks for in vitro diagnostic medical devices.

Information or data for estimating risks can be obtained, for example, from:a) published standards;b) scientific technical data;c) field data from similar medical devices already in use, including published reported

incidents;d) usability tests employing typical users;e) clinical evidence;f) results of appropriate investigations;g) expert opinion;

h) external quality assessment schemes.


10/24

10/15/2010

10

How to Begin a Hazard Analysis

Platform

known technology,

new materials/

components/

intended use

Derivative, well known technology,

line extension, minor design changes

Increasing availability

of information

Breakthrough, New Technology,

Little or no experience

Starting a Hazard Analysis - InputsSources of

Information

Type of Informat ion Comments

Use Flow ChartUseful for brainstorming

Normal state Hazards

Complaints/MDRs

Review and reuse similar

products (listed in Risk Mgt

Plan)

CRBA and CESPeriodically updated with

current Complaint/MDR info

DFU

Market SpecIntended use, functional

performance reqts

HA Work Instruction

appendixes

ISO Annexes- used to betabs in the old FMEA

workbooks

Hazard/Haz Sit/Harm

Hazard/Haz Sit/Harm

Hazard/Haz Sit

Hazard/Haz Sit/Harm

Harm

Hazard


11/24

Slide 19

JKM1 Increase size of triangle so the words in the top area do not extend beyond so much.Julie Maes, 7/7/2009


12/24

10/15/2010

11

Starting a Hazard Analysis – Sources of Information

Sources of InformationTy pe of Infor mation Comments

Bench Studies

TDP Reports

R&D studies

Feasibility, Development,

Design Verification

Animal & Clinical Studies

uFMEA and dFMEA

Obtain and reuse from

products with similar use and

design

Regulatory standards for

performance & test

e.g.

AAMI TIR 32 (software)

CDRH performance stds

ISO 10555List of harms and

severities

May use more than one

CAPAs, PIRs, Design

Changes

Obtain and reuse learning/data

from similar products (listed in

Risk Mgt Plan)

Hazard

Hazard/Haz Sit

Hazard/Haz Sit/Harm

Hazard/Haz Sit/Harm

Harm

Hazard/Haz Sit/Harm

Hazards- Fault and Normal

Fault Condition

• Characteristics that are required for operationbut present a hazard nonetheless

• Result from a Requirement/Functionality not met such as:

• Product malfunction

• Grouping of Failure Modes to describe the failure

to perform a function

Normal Condition


13/24

10/15/2010

12

Hazards, cont’d.

Hazards are expressed in terms of the product Use language already in complaints if possible

A Hazard is the “top” event in a list of failures If the description can lead to another product failure, it is likely not at the top

If the description is one of several causes for a failure, it is likely a “cause” and notthe hazard

Must be analyzed for the entire product kit orconfiguration

Must consider direct interaction with anotherproduct or accessory

Hazards, cont’d.

How do we know we have a complete list of hazards?

• Check hazards from different viewpoints, e.g.

Intended-use/ Misuse

Bench, animal, clinical studies

Complaints/ MDRs from similar products

Use and design FMEAs from similar products

DFUs

CES or CRBA

Developing a hazard analysis is an iterative process.


14/24

10/15/2010

13

Hazardous Situations

How do we determine the Hazardous Situation?

Consider the action, event or circumstance that links hazard to harm

Describe the anatomy, exposure, patient, or time that c reate difficulties in using the device,

leading to a harm

Describe how the product interacts with the patient, anatomy or body

Apply clinical knowledge of events or circumstances

Describe the sequence of events that lead from hazard to harm.

Best Practices – Hazard Analysis

Hazard AnalysisProduct Family Name:

Sources of Information:

Hazard Harm Type Hazardous Situation Harm Source Information


15/24

10/15/2010

14

EN ISO 14971:2009 Risk Evaluation

For each identified hazardous situation, the manufacturer shall decide, using thecriteria defined in the risk management plan, if risk reduction is required. If riskreduction is not required, the requirements given in 6.2 to 6.6 do not apply for thishazardous situation (i.e., proceed to 6.7).

The results of this risk evaluation shall be recorded in the risk management file.

Best Practices

FMEA or FTA

Use

Design

Process New requirements apply – risks of risk controls

Helpful input – List of harms and severities


16/24

10/15/2010

15

EN ISO 14971:2009 Risk Reduction and Control

Risk reductionWhen risk reduction is required, risk control activities shall be performed.

Risk control option analysis The manufacturer shall identify risk control measures that are appropriate for reducing the risks

to an acceptable level.

The manufacturer shall use one or more of the following risk control options in the priority orderlisted:

a) inherent safety by design;b) protective measures in the medical device itself or in the manufacturing process;c) information for safety.

EN ISO 14971:2009 Risk Reduction and Control, cont’d.

Implementation of risk control measure(s) The manufacturer shall implement the risk control measure(s).

Implementation of each risk control measure shall be verified. This verification shall be recordedin the risk management file.

The effectiveness of the risk control measure(s) shall be verified and the results shall be recordedin the risk management file.

The verification of effectiveness can include validation activities.

Compliance is checked by inspection of the risk management file.


17/24

10/15/2010

16

EN ISO 14971:2009 Residual Risk Evaluation

After the risk control measures are applied, any residual risk shall be evaluated using the criteriadefined in the risk management plan. The results o f this evaluation shall be recorded in the riskmanagement file.

If the residual risk is not judged acceptable using these criteria, further risk control measures shallbe applied

For residual risks that are judged acceptable, the manufacturer shall decide which residual risksto disclose and what information is necessary to include in the accompanying documents in orderto disclose those residual risks.

Compliance is checked by inspection of the risk management file and the accompanyingdocuments.

Risk Assessment Tools

Hazard Analysis Fault Tree Analysis (FTA)

Product & Process FMEA

Fault Condition Hazards

Harm,

Hazardous Situation,

& Hazard

Hazard = The

Connection


18/24

10/15/2010

17

Relationship Between Risk Assessment Tools

Harm

Hazardous Situation

Hazard

use Failure Mode

design Failure Mode

process Failure Mode

H A Z A R D

A N A L Y S I S

- - - F

M E A - - -

Hazard Analysis / FMEA (+/-)

Hazard Analysis

Advantages:

Shortcoming:

FMEA

Advantages:

Shortcoming:

Used together they deliver a thorough risk analysis.

Captures Haz-Haz Sit-Harm relationships

High level summary

Identifies Normal State Hazards

Facilitates identification of new / changing

risks with commercial products

Helps with designing out Hazards

Provides consistent terminology linked to

complaint coding

Encourages teams to identify hazards

associated with interfaces

Can’t see causes of Hazards

Provides a bottom-up perspective

Analyzes single fault failures

Able to focus on specific perspectives

(use, design, process, etc.)

Provides a detailed analysis and

control focus to the individual levels

being considered

Can add redundant controls (due to one-

level-at-a-time focus)


19/24

10/15/2010

18

Best Practices

List of harms and associated severities

Benefits

Inputs

Watch outs

EN ISO 14971:2009 Risk / Benefit Analysis

If the residual risk is not judged acceptable using the criteria established in the risk managementplan and further risk control is not practicable, the manufacturer may gather and review data andliterature to determine if the medical benefits of the intended use outweigh the residual risk. Ifthis evidence does not support the conclusion that the medical benefits outweigh the residualrisk, then the risk remains unacceptable. If the medical benefits outweigh the residual risk, thenproceed to 6.6.

For risks that are demonstrated to be outweighed by the benefits, the manufacturer shall decidewhich information for safety is necessary to disclose the residual risk.

The results of this evaluation shall be recorded in the risk management file. Compliance ischecked by inspection of the risk management file.


20/24

10/15/2010

19

Best Practices – CRBA or CES Product description

Intended use, indications for use

Contraindications

Summary of scientific literature

Literature review methodology

Literature experience summary

Clinical data

Market experience

Complaint review

MDR review

Field actions

Post-market surveillance

Alternate therapies

Evaluation of risk vs. benefit ratio

Reported harms

Reported benefits Acceptability of risk vs. benefit ratio

Intolerable risk

Conclusion

Bibliography

Reference documents

Appendices (literature search articles)

EN ISO 14971:2009 Risks Arising from RiskControl Measures

The effects of the risk control measures shall be reviewed with regard to:a) the introduction of new hazards or hazardous situations;b) whether the estimated risks for previously identified hazardous situations are affected by the

introduction of the risk control measures.

Any new or increased risks shall be managed in accordance with 4.4 to 6.5.

The results of this review shall be recorded in the risk management file. Compliance is checkedby inspection of the risk management file.


21/24

10/15/2010

20

EN ISO 14971:2009 Completeness of Risk Control

The manufacturer shall ensure that the risks from all identified hazardous situations have beenconsidered.

The results of this activity shall be recorded in the risk management file. Compliance is checkedby inspection of the risk management file.

EN ISO 14971:2009 Evaluation of Overall ResidualRisk Acceptability

After all risk control measures have been implemented and verified, themanufacturer shall decide if the overall residual risk posed by the medical device isacceptable using the criteria defined in the risk management plan.

If the overall residual risk is not judged acceptable using the criteria established inthe risk management plan, the manufacturer may gather and review data andliterature to determine if the medical benefits of the intended use outweigh theoverall residual risk. If this evidence supports the conclusion that the medicalbenefits outweigh the overall residual risk, then the overall residual risk can be

judged acceptable. Otherwise, the overall residual risk remains unacceptable.

For an overall residual risk that is judged acceptable, the manufacturer shall decide

which information is necessary to include in the accompanying documents in orderto disclose the overall residual risk.

The results of the overall residual risk evaluation shall be recorded in the riskmanagement file. Compliance is checked by inspection of the risk management fileand the accompanying documents.


22/24

10/15/2010

21

EN ISO 14971:2009 Risk Management Report

Prior to release for commercial distribution of the medical device, the manufacturer shall carryout a review of the risk management process. This review shall at least ensure that:

the risk management plan has been appropriately implemented;

the overall residual risk is acceptable;

appropriate methods are in place to obtain relevant production and post-productioninformation.

The results of this review shall be recorded as the risk management report and included in therisk management file. The responsibility for review should be assigned in the risk managementplan to persons having the appropriate authority. Compliance is checked by inspection of therisk management file.

EN ISO 14971:2009 Production and

Post-production Information

The manufacturer shall establish, document and maintain a system to collect and reviewinformation about themedical device or similar devices in the production and the post-production phases. Whenestablishing a system to collect and review information about the medical device, themanufacturer should consider among other things:

a) the mechanisms by which information generated by the operator, the user, or thoseaccountable for the installation, use and maintenance of the medical device is collected andprocessed; or

b) new or revised standards.

The system should also collect and review publicly available information about similar medicaldevices on the market. This information shall be evaluated for possible relevance to safety,especially the following: if previously unrecognized hazards or hazardous situations are present or if the estimated risks) arising from a hazardous situation is/are no longer acceptable.


23/24

10/15/2010

22

EN ISO 14971:2009 Production andPost-production Information, cont’d.

If any of the above conditions occur:

1) the impact on previously implemented risk management activities shall be evaluated andshall be fed back as an input to the risk management process and

2) a review of the risk management file for the medical device shall be conducted; if there is apotential that the residual risks or its acceptability has changed, the impact on previouslyimplemented risk control measures shall be evaluated.

The results of this evaluation shall be recorded in the risk management file. Compliance ischecked by inspection of the risk management file and other appropriate documents.

So What Does Your Notified Body Want? Their review shall at least ensure that:

RM plan is appropriately implemented; overall residual risk is acceptable; appropriate methods in place to obtain relevant production and post-production

information (PMS plan) Active and passive PMS

Establish, document and maintain a PMS system to collect info in production and post-production phases mechanisms of collecting & processing input from operators, users, installation and

maintenance personnel etc new or revised standards

Collect and review publicly available information about similar medical devices

impact analysis review RM file

It’s your company – they will not tell you what to do you know your products and their history better than anyone – you should decide what is

appropriate you as a company are required to have a system in place –does it work for you or is it

window dressing? talk to your notified body


24/24

10/15/2010

Questions?

Roberta Goode

(954) 646-1215

[email protected]

www.GCIBiotech.com

new en iso risk management standard

Documents