This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
• Control measures can reduce the risk to a level which is acceptable to the current values of society
• If all the residual risks have been reduced to an acceptable level, the product can be considered safe (in other words, there is freedom from unacceptable risk)
• The manufacturer makes….and documents this decision
12
ISO 14971:2007 RequirementsRisk Management File
Risk management file includes:• Risk management plan • Results of all risk
management activities• Maintained records• Traceability for each identified hazard
• To identify the hazards associated with medical devices
• To estimate and evaluate the risks • To control these risks• To monitor the effectiveness of the control• Which can be applied to all stages of the life
cycle of a medical device • Which can be an integral part of a quality system
Meeting ISO 14971:2007 Requirements• The risk management process can be
a subset of another process, but must be defined, documented, and maintained
• The risk management file can be a subset of the design history file (DHF), but must provide traceability to identified hazards
• Post-market risk management reviews can be an update tab to the DHF or part of the complaint file
• Use cross-functional teams from existing organization to identify hazards
16
Applicability of ISO 14971:2007
ISO 14971:2007 will:
• Provide a model for a risk management plan• Give guidance for safety and information about
residual risk• Ensure that the options for risk management
tools are understood, including:PHA [preliminary hazard analysis]FTA [Fault tree analysis]FMEA [failure mode effects analysis]HAZOP [hazard and operability studies]HACCP [hazard analysis and critical control point]
• “The organization shall establish documented requirements for risk management throughout product realization. Records arising from risk management shall be maintained.”(ISO 13485:2003, 7.1)
• Note the concept of life-cycle, e.g. throughout product realization [all phases from initial concept to final decommissioning]
• Product realization = planning, customer-related processes, design control, purchasing, production, traceability, control of monitoring and measuring equipment
• “Inputs relating to product requirements shall be determined and record maintained. These inputs shall include…output(s) of risk management.”(ISO 13485:2003, 7.3.2)
• There is a Reference to ISO 14971 in note 3 under clause 7.1
• Consider risk related to installation and servicing
• Medical devices are products intended for:Diagnosis, prevention, monitoring, treatment, or alleviation of diseaseDiagnosis, monitoring, treatment, alleviation of, or compensation for, an injury or handicapInvestigation, replacement, or modification of the anatomy or of a physiological processControl of conception
• ISO 14971 is a standard a manufacturer may use to identify hazards associated with medical devices, and to estimate, evaluate, control, and monitor the effectiveness of the process
Risk Management file must include outputs from the steps of the risk management process. In addition, it shall provide traceability for each identified hazard to the solutions adopted (2.23 and 3.5)
Risk Management File (modified)
Process used to assign values to the probability of occurrence of harm and the severity of that harm
Risk Estimation
All phases in the life of a medical device, from the initial conception to final decommissioning and disposal
Life Cycle
Definitions in 14971:2007 are also now in alphabetical orderNew Definitions
• Hazards not previously recognized can be identified by systematic methods:
Failure Mode Effect Analysis (FMEA) Failure Mode Effect and Criticality Analysis (FMECA)Fault Tree Analysis (FTA)Hazard and Operability Study (HAZOP)Hazard Analysis and Critical Control Point (HACCP)
• Maintain records • Check compliance
Note: See Annex G for information on risk analysis techniques/tools to consider
42
4.3 Risk AnalysisHazard Identification
The importance of choosing tools:
• Brainstorming can only take the team so far• Component level failures, system level failures,
impact of sequences of events are sometimes best analyzed with different tools
• Different tools can be put to best use at different periods on the life-cycle
• Some tools are better adapted to hardware and some to software
• There is a risk that a patient may come to some harm if they are exposed to a hazard
• The 2007 version of the standard emphasizes ‘hazardous situation’ leading to the questions:
For the hazards we have identified, what circumstances would lead to exposure to one or more of these hazards? How could the hazard impact the patient, care giver or environment?
• Risk is a combination of the probability of occurrence and the severity of the harm which would occur, so hazards lead to hazardous situations which lead to risks
44
ISO 14971:2007 Requirements Risk Management Concept
Information for estimating risks can be obtained from:
• Published standards• Scientific technical data• Field data from similar medical devices• Usability tests with typical users• Clinical evidence• Results of relevant investigations• Expert opinions• External quality assessment schemes
48
4.4 Risk AnalysisEstimation of the Risk
Relationship between hazards, foreseeable sequences of events, hazardous situations and harm that can occur
Table E.3
Risk Concepts applied to medical devices. Guidance on hazards, risk estimation, risk acceptability, risk control, risk/benefit analysis (with examples), and overall risk evaluation
FMEA, FTA, HAZOP, PHA and HACCPInformative Annex G in the risk management standard provides excellent guidance on choice of tool options:
For this course, we will study and perform FMEA on the design of a medical device, sometimes known as a ‘design FMEA’ or DFMEAA process FMEA can also be conducted using the same tool
• Identify failure modes• Determine their probability• Help prioritize actions to be taken • Allow for mitigation of failure modes• Provide mitigation status• Help increase system/item reliability• Complement FTA
58
What FMEA Cannot Do
• Model interaction of failure modes (each failure mode is considered independent; especially an issue in software/hardware interactions)
• Predict/assess system/item reliability over the life-cycle
• Monitor and evaluate reliability improvements and final product reliability
When risk reduction is indicated, the organization must follow the processes as noted:
• Option analysis• Implementation of risk control measures• Residual risk evaluation• Risk/benefit analysis• Review of other generated hazards• Evaluation of completeness of risk control
• Review risk control measures to identify if other hazards or hazardous situations are introduced by risk control measures
• Assess estimated risks for impact on hazards previously identified
• Maintain records• Check compliance
72
6.7 Risk Control Completeness of Risk Evaluation• Ensure that risks from all identified hazards have
been evaluated• Maintain records• Check compliance
Traceability is not required in the final report, but it now is required in the risk management file to ensure that all identified hazards have been addressed
Production and Post-Production InformationISO 14971:2007, Clause 9
80
9 Production
The manufacturer shall gather and review information during production processes:
• Consider production, operators, and users• Consider installation and maintenance• Consider impact of new or revised standards
Production considerations were not clearly addressedin the previous version of the standard as it went from the reportto post-production information. The requirement now makesit clear that the expectation is that the report andconclusions are fully completed before production begins
• Establish, document, and maintain a system to review information gained about the medical device or similar devices in the post-production phase
• Evaluate the information for possible relevance to safety, especially the following:
If previously unrecognized hazards are presentIf the estimated risk arising from a hazard is no longer acceptableIf the original assessment is otherwise invalidated (by post-market data)
• Evaluate the effectiveness of the risk management process
82
9 Post-Production Information
• Post-production information will come from complaints, but should not be limited to complaints
• For ease of analysis, data should be coded• Consider coding by hazards generated, including
user error from misuse (whether accidental, or intentional if the information implies misuse on other products)
• Review data at defined intervals• Ensure management is informed of the
post-production review (e.g., as an agenda item to management review)
• Invest more time in determining intended use and foreseeable misuses
• Decide which tools are most appropriate at which stages of the life-cycle
• Invest a lot more time in listing hazards early on in the program. It is much better to identify 900 hazards and mitigate 100, than to identify 100 hazards and mitigate 50
86
Implementation: Cost and Time
• Train personnel on risk management techniques ahead of time
• Train personnel on intended use of the device as well as intended environment of use and consider ‘hands-on’ activities
• Utilize relevant standards• Leverage existing systems