slide 1 of 45 robert packard, consultant [email protected] december 17 th 2013 implementing a risk...

of 45

Robert Packard, Consultant

www.MedicalDeviceAcademy.com

[email protected] 17th 2013

Implementing aRisk Management Process

Compliantwith ISO 14971:2007

&How to Address the Seven

Deviations Identified inEN ISO 14971:2012

http://www.medicaldeviceacademy.com/

of 45




“Show me where it’s required”

• Clause 7.1 in ISO 13485 states:

“The organization shall establish documented requirements for risk management throughout product realization. Records arising from risk management shall be maintained .”


of 45




14971 Plus - http://bit.ly/ShopCSA


http://bit.ly/ShopCSA

of 45




14971 Plus =Standard + Gap + Bonus Tools


of 45




Bonus Tools in 14971 Plus


of 45




Top 5 Risk Management Mistakes

1. Not reading the Annexes2. Using Annex C, Questions 1-34 as your only

form of Hazard Identification3. Using only some of the tools in Annex G4. Too much energy spent during design upon

identifying P1 vs. P2 (see Figure E1, Annex E)5. Not updating risk management

documentation.


of 45




Hazard vs. Harm

• Clause 2.3 – Hazard is a “potential source of harm”[ISO/IEC Guide 51:1999, definition 3.5]

• Clause 2.2 – Harm is a “physical injury or damage to the health of people, or damage to property or the environment”[ISO/IEC Guide 51:1999, definition 3.3]


of 45




Definition of Risk

• Clause 2.16 – Risk is the “combination of the probability of occurrence of harm and the severity of that harm.”


of 45




When are risks reviewed?• Adverse Events (Injury & Death)• Defects in Manufacturing Trend Data• Material Changes• Labeling Changes• Changes to Instructions• Changes in the Intended Use• Process Changes• Customer Complaints• Supplier Changes• Supplier Process Changes• Design Changes• Service Trend Data• Corrective Actions & Preventive Actions (CAPA)

Sales

Shipping

Finance

MarketingEn

gine

erin

g

RiskManagement

Manufacturing


of 45




Risk Management is a Process

4 – Risk Analysis

5 – Risk Evaluation

6 – Risk Control

7 – Residual Risk Acceptability

8 – Risk Management Report

9 – Production & Post-production Info

RiskAssessment

RiskManagement


of 45




Overview of BS EN ISO 14971:2007

• Begins on Page 5 and ends on Page 14

• Key elements I look for when I’m auditing:– Is there an Annual review of effectiveness required?– Is the Risk Management File defined in the procedure?– Does the procedure discuss risk controls and option analysis?– Is the risk of risk controls mentioned?– Is there a requirement for the overall acceptability of residual

risks and a risk / benefit analysis?– Does the procedure include collection of post-production

information?


of 45




Mitigation vs. Control

• In the 2007 version of ISO 14971, the term “mitigation” was removed.

• Mitigation implies elimination of risks, while control implies reducing and monitoring risks.


of 45




Concept of Product Lifecycle

• Clause 2.7 – Lifecycle is “all phases in the life of a medical device, from the initial conception to final decommissioning and disposal”

ObsolesceSustainingMarket Growth

Commercial Release

PilotPhaseDesign

Pre-Production Post-Production


of 45




Risk Management / Design Controls

• Clause 7.3.2e) of ISO 13485 states that Risk management shall be an Input into Design & Development

• Clause 6.3 of ISO 14971 requires verification of effectiveness of risk controls

• Clause 6.7 of ISO 14971 requires verification of completeness of risk controls


of 45




Design Risk Management Tasks

15

DHFBegins

ProductLaunch510(k)

Design Transfer

ConceptPhase

FeasibilityPhase

DevelopmentPhase

PilotPhase

ReleasePhase

HazardIdentification

Risk ControlOption Analysis

RiskAssessment Risk Control

Effectiveness Verification

RiskManagement

Plan


of 45




Design Risk Management Tasks

16

DHFBegins

ProductLaunch510(k)

Design Transfer

ConceptPhase

FeasibilityPhase

DevelopmentPhase

PilotPhase

ReleasePhase

Risk / BenefitAnalysis

Risk ManagementReport

(continued)


of 45




2009 Corrections

• Annex ZA/ZB/ZC

• Flow Diagram Correction


of 45




MDD Requirements

• Annex I, Essential Requirement (ER) 1:– “… any risks which may be associated with their

intended use constitute acceptable risks when weighed against the benefits to the patient…”

– “This shall include…reducing, as far as possible, the risk of use error due to the ergonomic features of the device and the environment in which the device is intended to be used (design for patient safety)…”


of 45




Deviation #6 in 2012 EN Version

Deviation as to the first risk control option

• Clause 6.2 of ISO 14971 requires the manufacturer to “use one or more of the following risk control options in the priority order listed: (a) inherent safety by design...”

• ER 2 of the MDD requires the manufacturer to “eliminate or reduce risks as far as possible (inherently safe design and construction)"


of 45




MDD Requirements

• Annex I, Essential Requirement (ER) 2:– “In selecting the most appropriate solutions, the

manufacturer must apply the following principles in the following order:• eliminate or reduce risks as far as possible (inherently

safe design and construction),• where appropriate take adequate protection measures

including alarms if necessary, in relation to risks that cannot be eliminated,• inform users of the residual risks due to any

shortcomings of the protection measures adopted.”


of 45




Proposed Regulations

• Annex I, Essential Requirement (ER) 2:– “To reduce risks, the manufacturer shall manage the risks so

that the residual risk associated with each hazard as well as the overall residual risk is judged acceptable. The manufacturer shall apply the following principles in the priority order listed:

a) identify known or foreseeable hazards and estimate the associated risks arising from the intended use and foreseeable misuse;

b) eliminate risks as far as possible through inherently safe design and manufacture;

c) reduce as far as possible the remaining risks by taking adequate protection measures, including alarms; and

d) provide training to users and/or inform users of any residual risks.”


of 45




Management Responsibilities

Clause 3.2• Commitment by top management to risk management

process– Adequate Resources– Qualified personnel for risk management

• Policy for determining criteria for risk acceptability– Criteria based upon applicable regulations and International

Standards– Accounts for accepted state of the art and stakeholder concerns

• Review the suitability of the risk management process to ensure continuing effectiveness – May be part of the quality management system review


of 45




Risk Management PlanClause 3.4 • The plan shall include at least the following:

– the scope of the planned risk management activities, identifying and describing the medical device and the life-cycle phases for which each element of the plan is applicable

– assignment of responsibilities and authorities– requirements for review of risk management activities– criteria for risk acceptability, based on the manufacturer's policy for determining acceptable risk,

including criteria for accepting risks when the probability of occurrence of harm cannot be estimated

– verification activities– activities related to collection and review of relevant production and post-production information

• For each risk management plan the manufacturer should choose appropriate risk acceptability criteria– May implement a matrix indicating which combinations of probability of harm and severity of harm are

acceptable or unacceptable

• The risk management plan is part of the risk management file– Record of the changes shall be maintained in the risk management file


of 45




Risk Management File

Clause 3.5 • File for each medical device • The risk management file shall provide

traceability for each identified hazard to:– the risk analysis– the risk evaluation– the implementation and verification of the risk control

measures– the assessment of the acceptability of any residual

risk(s)


of 45




Hazard Identification

Clause 4.3• Documentation on known and foreseeable

hazards associated with the medical device in both normal and fault conditions

• Maintained in the risk management file


of 45




Deviations #1 in 2012 EN Version

Treatment of Negligible Risks

Catastrophic Critical Serious Minor Negligible 5 4 3 2 1

Frequent 5 Unacceptable Unacceptable Unacceptable Unacceptable ALARPProbable 4 Unacceptable Unacceptable Unacceptable ALARP ALARP

Occasional 3 Unacceptable Unacceptable ALARP ALARP ALARPRemote 2 Unacceptable ALARP ALARP ALARP Acceptable

Improbable 1 ALARP ALARP ALARP Acceptable Acceptable

Rating↓®

Severity

Must implement risk controls for all risks.


of 45




Risk EstimationClause 4.4• Reasonably foreseeable events that can result in a hazardous situation shall be considered and the

resulting hazardous situation(s) shall be recorded– Hazardous situations can arise from slips, lapses and mistakes

• For each identified hazardous situation, the associated risk(s) shall be estimated using available information or data. – Where the probability of the occurrence of harm cannot be estimated, the possible consequences shall be listed

for use in risk evaluation and risk control• Any system used for qualitative or quantitative categorization of probability of occurrence of harm or

severity of harm shall be recorded in the risk management file• Risk estimation can be quantitative or qualitative• Information or data for estimating risks can be obtained, for example, from:

– published standards– scientific technical data– field data from similar medical devices already in use, including published reported incidents– usability tests employing typical users– clinical evidence– results of appropriate investigations– expert opinion– external quality assessment schemes


of 45




P1 & P2 from Annex E


of 45





Discretion as to whether a risk-benefit analysis needs to take place





Unacceptable Requires a Risk / Benefit Analysis

Rating↓®

Severity


of 45




Risk Evaluation

Clause 5

Risks are Acceptable?(see Clause 3.2)


of 45





Discretion as to the risk control options/measures

• Risk Controls options shall beimplemented regardless of severityor probability of occurrence


of 45




Risk Control Option Analysis

Clause 6.2• The manufacturer shall identify risk control measures that are appropriate

for reducing the risks to an acceptable level– Risk control measures can reduce the severity of the harm or reduce the probability

of occurrence of the harm, or both• The manufacturer shall use one or more of the following risk control options

in the priority order listed:– inherent safety by design– protective measures in the medical device itself or in the manufacturing process– information for safety

• The risk control measures selected shall be recorded in the risk management file

• If, during risk control option analysis, the manufacturer determines that required risk reduction is not practicable, the manufacturer shall conduct a Risk/Benefit Analysis of the residual risk (see Clause 6.5)


of 45




Implementing Risk Controls

Clause 6.3• The manufacturer shall implement the risk control

measure(s) selected (see Clause 6.2)• Implementation of each risk control measure shall be

verified– Verification shall be recorded in the risk management file

• The effectiveness of the risk control measure(s) shall be verified and the results shall be recorded in the risk management file– Verification of effectiveness can include validation activities


of 45





Risk reduction “as far as possible” (ALAP)vs. “as low as reasonably practicable” (ALARP)





ALARP As Low as Reasonably Practicable

Rating↓®

Severity


of 45




Residual Risk Evaluation

Clause 6.4

Pre-Market Phase

Clinical Evidence

Residual Risk

PMS & PMCF Studies Quantify Residual

Risks


of 45




Risk/Benefit Analysis & Evaluation of Overall Acceptability of Risk

Clause 6.5• If the residual risk is not acceptable using the criteria established in the risk management

plan and further risk control is not practicable, the manufacturer may gather and review data and literature to determine if the medical benefits of the intended use outweigh the residual risk– If the medical benefits do not outweigh the residual risk, then the risk remains unacceptable– If the medical benefits outweigh the residual risk, then proceed to Clause 6.6

• The manufacturer shall decide which information for safety is necessary to disclose the residual risk

• Results shall be recorded in the risk management file

Clause 7• After all risk control measures have been implemented and verified, the manufacturer shall

decide if the overall residual risk posed by the medical device is acceptable using the criteria defined in the risk management plan

• If the overall residual risk is not judged acceptable, perform a Risk/Benefit Analysis (see Clause 6.5 above)

• Results of the overall residual risk evaluation shall be recorded in the risk management file


of 45





Discretionary power of manufacturers as to the acceptability of risks

• All Risks shall be included in a risk / benefit analysis—not just the risks above a certain threshold.


of 45




Risks arising from Risk Control Measures

Clause 6.6• The effects of the risk control measures shall be

reviewed with regard to:– the introduction of new hazards or hazardous situations– whether the estimated risks for previously identified

hazardous situations are affected by the introduction of the risk control measures

• Any new or increased risks shall be managed• Results of this review shall be recorded in the risk

management file


of 45





Information of the users influencing the residual risk

• No risk reduction shall be attributed to information provided to the user


of 45




Completeness of Risk Control

Clause 6.7• The manufacturer shall ensure that the risk(s)

from all identified hazardous situations have been considered

• The results of this activity shall be recorded in the risk management file


of 45




Risk Management Report

Clause 8• Prior to release for commercial distribution of the medical

device, the manufacturer shall carry out a review of the risk management process. This review shall at least ensure that:– the risk management plan has been appropriately implemented– the overall residual risk is acceptable– appropriate methods are in place to obtain relevant production and

post-production information• The results of this review shall be included in the risk

management file• The responsibility for review should be assigned in the risk

management plan to persons having the appropriate authority


of 45




ClinicalEvaluation

Post-Market Surveillance

RiskAnalysis

Post-Market Surveillance (PMS) Report Identifies

Areas Requiring Changes

Instructions for Use (IFU) Needs to Reflect

Information Found in Risk Management Report

(RMR) & Clinical Evaluation Report (CER)

The Lifecycle Loop

Production & Post-Production Information

Clause 9


of 45




Other Requirements

• Residual Risks May Require a Post-Market Clinical Follow-up (PMCF) Study as required by Annex X, 1.1c of the MDD(MEDDEV 2.12/2 rev 2)

• Clinical Evaluations shall conclude that “any risks associated with the use of the device are acceptable when weighed against the benefits to the patient.”(MEDDEV 2.7.1 rev 3)


of 45




Q & A


of 45




Do you need help with yourRisk Management Process?

Rob Packard

[email protected]

+1.802.258.1881

rob13485


mailto:[email protected]

slide 1 of 45 robert packard, consultant [email protected] december 17 th 2013 implementing a risk...

Documents

lyshopcsa slide

robert packard

risk management report

risk management mistakes

risk management documentation

risk control

risk evaluation

risk analysis