What’s New, What’s current in ISO 14971: Application of Risk

Management to Medical Devices. Paul McDanielASQ CQM/OE

Executive VP Operations and QASicel Technologies

Background

• Medical device risk management activities came about primarily because of their regulated nature– In the most general sense, using the FDA as an

example, the US population, by way of their representatives, determined that someone must look after the manufacturer’s to make sure products are safe and effective

– As the industry matured, it became apparent that in many cases, the manufacturer’s were best able to determine safety so the regulatory bodies asked for generally accepted practices to be performed by all

• But leave and objective evidence trail to follow!

ISO 14971

• The standards community determined it was time for a harmonized approach to risk management processes.– For many of the regular reasons

• level the playing field• allow market introduction to be more predictable• describe the state of the art

– For some of the unique reasons• To save a life, some times you have to introduce a risk of

harm, medical devices are somewhat unique• the consumer should be able to trust that the risk is

outweighed by the potential benefit

ISO 14971

• The first edition was issued in 2000– Follows a quality systems model– Processed focused– was a compilation of industry practices, and

the thoughts of technical experts and regulatory agencies as the “right” requirements

• After a minor amendment in 2003, the second edition was issued in 2007.

What’s it all about?

• Risk: combination of the probability of harm and the severity of that harm

• Harm: physical injury or damage to the health of people, property, or the environment

• Hazard: a potential source of harm• Hazardous situation: circumstance in

which people, property or the environment are exposed to one our more hazards

Standard Overview

• General requirements– Risk management process– Mgmt responsibilities– Qualification of personnel– Risk management plan– Risk management file

• Feeling a little ISO 9000–ish?– Definitely a little ISO 13485–ish?

• Medical devices – quality management systems, requirements for regulatory purposes

ISO 14971 Main Body

• Risk Analysis

• Risk Evaluation

• Risk Control

• Evaluation of overall residual risk acceptability

• Risk Management Report*

• Production* and Post Production Information

* Changes in 2007 edition

Risk Analysis-Intended use andId of Char related to safetyof the device-Id hazards-Est risk for eachhazardous situation

Risk evaluation

Risk Control-Option analysis-Implement controls-Residual risk evaluation-Risk/benefit analysis-Risks arising from controlmeasures-Completeness of risk control

Ris

k A

sses

smen

t

Evaluation of overallresidual riskacceptability

Risk ManagementReport

Production andpost-production

information

Risk M

anagement

Adapted from ISO 14971:2007 Figure 1

8 Risk Management Report

• Prior to release for commercial distribution of the medical device, the manufacturer shall carry out a review of the risk management process.– RM Plan was implemented– Overall residual risk is acceptable– Appropriate methods for production and post-

production data collection are in place

9 Production & Post Production Information

• Establish, document and maintain a system to collect and review information about the device…

• The system should concider– Operator, user, installation, use and

maintenance feedback is collected and processes

– New or revised standards– Publicly available information about similar

devices

9 Production & Post Production Information (cont)

• Evaluate this information for relevance to safety– Are previously unrecognized hazards or

hazardous situations present?– Are the estimated risks no longer acceptable?– Feedback any “yes” answers into the risk

assessment and controls processes for action.

Risk Analysis in Production

• Non-conforming material and Material Review Board Processes?– Can they effectively consider risks on each

occurrence?

• Control charts, acceptance data– Are risk controls part of acceptance testing?– Frequency of occurrence suggesting anything

• “Risk of failure was ranked as remote yet we’ve had three catastrophic hot-pot test failures this month!”

Informative annexes• A Rationale for requirements• B Process overview• C Questions that can be used to identify medical device

characteristics that could impact safety• D Risk concepts applied to medical devices• E Examples of hazards, foreseeable sequences of events and

hazardous situations• F Risk management plan• G Information on risk management techniques• H Guidance for in-vitro diagnostic hazards• I Guidance for Biological hazards• J Information for safety and information about residual risk• BIBLIOGRAPHY

– 37 very useful references

Information on Techniques

• Preliminary Hazard Analysis

• Fault Tree Analysis• FMEA• HAZOP• HACCP

• Failure consequences and liability management

• Product safety and liability

• FMEA/FMECA in design

• FTA in design• Reliability modeling

and predictionISO 14971 Annex G Sample keywords from ASQ Certified Reliability

Engineer BOK

Developing Risk Measures

• There is more and more indication that “quantitative” risk assessment is preferred over qualitative.

• Consider the products liability landscape in the US when you decide to transverse that path.– The standard requires management set a

policy for determining risk acceptability, not 3 deaths per million is ok

Risk Acceptance

• For those lawyers out there: define the scope of your process– The records produced will be subject to

second guessing if harm occurs: don’t allow hindsight to change the rules

– Document your information sources!!!!!!!• When you made your risk acceptability decision,

what information was available and used?• We can only be diligent, not psychic

Risk Acceptability

• Once you start applying the process, you must maintain diligence– most risks represent “smoking guns”

• if you thought a risk could only be realized once in a device lifetime and you have two reports, revisiting your mitigation decision would be very prudent!

– what society accepts today will probably be too great a risk tomorrow

• The term is a little stale, but “state of the art” is the concept

Key to Success

• No engineer, clinician, production associate, marketeer, president, janitor, wants to make and sell unsafe products

• Risk management process and techniques, when applied early and often gives everyone the ability to do the right stuff– Applied late in the game, it makes most involved feel

poorly about any potential risks remaining

• The ISO 14971 Standard is really applicable to all industries as a best practice

IEC 60601-1 General Requirements for Basic Safety and Essential Performance of Medical Electrical Equipment

Influences of Risk Management on the Third Edition

Terms

• Basic Safety– Freedom from unacceptable risk directly caused by

physical hazards when ME equip is used under normal and single fault conditions

• Essential Performance– Performance necessary to achieve freedom from

unacceptable risk• Note: is most easily understood by considering whether its

absence or degradation would result in an unacceptable risk

• 139 defined terms to “apply 60601-1!!!!!

Key Risk Related Concepts

• Basic Safety and Essential Performance required for normal use, reasonably foreseeable mis-use, in normal condition and single fault conditions.

• Thankfully, Medical equipment is presumed to be operated under the jurisdiction of qualified or liscensed persons and the operator has the skill required for a medical application and acts according to the instructions for use.– No lawn mowers as hedge trimmers

Medical Equipment Risk Criticality

• 8 key differentiators for medical equipment as compared to other electrical equipment are mentioned:– Non-detectable hazards (radiation)– Patient may not be able to react to hazards

• ill, unconscious, impaired functioning

– Multiple equipment connections– Electrical circuits are applied directly to the body– …….– These make ISO 14971 a medical device requried

practice as compared to general industry.

60601-1 Risk Management?

• 4.2 Risk Management process for Med Elect equipment or Systems– A Risk Management Process complying with

ISO 14971 shall be performed

• 4.7 Single Fault for ME Equipment– The results of risk analysis shall be used to

determine which failures shall be tested.• Probably will need an FMEA or similar detailed

analysis to support this requirement!

Good clarifications

• Annex A Risk Management Process– Compliance with the clauses of this standard

that contains specific, verifiable requirements is presumed to reduce the associated risk(s) to an acceptable level.

– Other than these specific requirements, and single fault compliance, the manufacturer’s responsibility is to set acceptable risk levels and explain the rationale in the risk management file.

Risk Management Conformity

• There is a bell sounding in the compliance community– With the normative reference of ISO 14971 in

IEC 60601-1, we may need third party certification of risk management “systems”

3rd Party Certification

• The intent of the standards working group was to have a standalone risk management process if no quality system existed.

• We tried hard to recommend that if a Quality system existed, risk management should be integrated into it.

• Fight this trend to transfer money from medical device development to systems conformity companies!– Integrate the processes with your quality system– Look for standards work item proposals related to this concept

and vote them down.– Get another certification body if you get a quote for ISO 14971

compliance assessments/audits/certification

What’s next

• From the ISO 14971:2007 Forward– For the purposes of future IEC maintenance,

Subcommittee 62A has decided that the contents of this publication will remain unchanged until the maintenance result date (2014)

– A search of IEC subcommittee 62A and ISO Technical Committee 210 show no work item proposals for ISO 14971