of 24
8/17/2019 New EN ISO Risk Management Standard
1/24
10/15/2010
1
Implementing the New EN ISO
14971:2009 Risk Management Standard
EN ISO 14971:2009 Scope
What it is:This International Standard specifies a process for a manufacturer to identify the hazardsassociated with medical devices, including in vitro diagnostic (IVD) medical devices, to estimateand evaluate the associated risks, to control these risks, and to monitor the effectiveness of thecontrols.
Implementing the revised risk management standard into your manufacturing environment is anecessity to maintain your CE Mark for European distribution of products.
New requirements for review of risk management activitiesNew criteria for risk acceptabilityImplementation of production and post-production informationExpanded Hazard Analysis requirementsClinical Evaluation SummaryRisk control measures and residual risk
The requirements of this International Standard are applicable to all stages of the life-cycle of amedical device.
8/17/2019 New EN ISO Risk Management Standard
2/24
10/15/2010
2
What it is not:
This International Standard does not apply to clinical decision making.
This International Standard does not specify acceptable risk levels.
This International Standard does not require that the manufacturer have a quality managementsystem in place. However, risk management can be an integral part of a quality managementsystem.
EN ISO 14971 Revision History
2001: EN ISO 14971:2001 (supersedes BS EN 1441:1998)
2003: EN ISO14971:2001 (addition AMD 14456; July 7, 2003)
2003: EN ISO14971:2001 (correction CORR 14652; August 19, 2003)
2007: EN ISO14971:2007
2009: EN ISO14971:2009
8/17/2019 New EN ISO Risk Management Standard
3/24
10/15/2010
3
EN ISO 14971: Comparative Review
OldRevision
NewRevision
Key Changes
EN ISO14971:2001
+AMD14456
+CORR14652
EN ISO14971:2007
Risk analysis process section revised to include clarification around leveraging ofrisk analyses for similar devices
Risk considerations defined a round hazardous situations versus hazards; inparticular “sequence of events” that can produce hazardous situations and harm
Risk management report requirements expanded: Prior to release for commercialdistribution of the medical device the manufacturer shall carry out a review of therisk. Management process and review shall ensure that:
(a) the risk management plan has been appropriately implemented
(b) The overall residual risk is acceptable
(c) Appropriate methods are in place to obtain a relevant production and post-production information
EN ISO 14971: Comparative Review
OldRevision
NewRevision
Key Changes
EN ISO14971:2007
EN ISO14971:2009
Review leads to an informative annex, but no technical content
changed. Per endorsement notice:
The text of ISO 14971:2007, Corrected version 200 7-10-01 has been
approved by CEN as a EN ISO 14971:2009 without any modification.
Note:Although no technical content was changed, a modification was made to figure 1,page 6. The feedback loop was moved from the evaluation of overall residual riskacceptability to the production and post-production information item.
8/17/2019 New EN ISO Risk Management Standard
4/24
10/15/2010
4
A schematic representation of the risk
management process
R
I S K C O M M U N I C A T I O N
LIFECYCLE MAINTENANCE
MA NA GE ME NT RE S P ON
S I B I L I T Y
CORE PROCESS
RM PLANNING
RISK CONTROL
RISK ASSESSMENT
Elements of the Risk Management System
P R OD U C T RI S K
DE C I S I ON & RE V I E W S
E F F E C T I V E NE S S
OF
RM S Y S T E M
PRODUCTION
INFORMATION
POST-PRODUCTION
INFORMATION
I N T E R N A L
E X T E R N
A L
EVALUATION OF OVERALL
RESIDUAL RISK
RM REPORT
8/17/2019 New EN ISO Risk Management Standard
5/24
10/15/2010
5
Definitions
Risk = occurrence of harm and severity of that harm
Residual risk = risk remaining after risk control measures have been taken
Risk analysis = systematic use of available information to identify hazards and to estimate the risk
Risk assessment = overall process comprising a risk analysis and a risk evaluation
Risk control = process in which decisions are made and measures implemented by which risks arereduced to, or maintained within, specified levels
Risk estimation = process used to assign values to the probability of occurrence of harm and theseverity of that harm
Risk evaluation = process of comparing the estimated risk against given risk criteria to determinethe acceptability of the risk
Risk management = systematic application of management policies, procedures and practices to the
tasks of analyzing, evaluating, controlling and monitoring risk
Risk management file = set of records and other documents that are produced by risk management
Definitions, cont’d.
Harm = physical injury or damage to the health of people, property or the environment, eitherdirectly or indirectly
Hazard = a potential source of harm
Normal Condition
Fault Condition
Hazardous Situation = circumstance in which people, property or the environment areexposed to one or more hazards
Occurrence = the frequency or probability of an event (e.g. harm, hazardous situation,hazard, cause, etc.)
Severity = a measure of the possible consequence of a hazard.
8/17/2019 New EN ISO Risk Management Standard
6/24
10/15/2010
6
Use, design and process FMEAs / FTAs
Hazard Analysis
Clinical Experience Summary
Risk Management Plan and Report
Key Deliverables
EN ISO 14971:2009
The manufacturer shall establish, document and maintain throughout the
life-cycle an ongoing process for identifying hazards associated with amedical device, estimating and evaluating the associated risks, controllingthese risks, and monitoring the effectiveness of the controls. This processshall include the following elements:
risk analysis;
risk evaluation;
risk control; production and post-production information
8/17/2019 New EN ISO Risk Management Standard
7/24
10/15/2010
7
EN ISO 14971:2009 Risk Management Planning
Risk management activities shall be planned. Therefore, for the particular medicaldevice being considered, the manufacturer shall establish and document a riskmanagement plan in accordance with the risk management process. The riskmanagement plan shall be part of the risk management file.
This plan shall include at least the following:a) the scope of the planned risk management activities, identifying and describing the
medical device and the life-cycle phases for which each element of the plan isapplicable;
b) assignment of responsibilities and authorities;c) requirements for review of risk management activities;d) criteria for risk acceptability, based on the manufacturer’s policy for determining
acceptable risk, including criteria for accepting risks when the probability of occurrenceof harm cannot be estimated;
e) verification activities;f) activities related to collection and review of relevant production and post-production
information.
Best Practices Risk Management Plan
Scope
Responsibilities
Similarities and differences
Acceptance criteria
Review requirements
Verification activities
Production and Post-production information collection methods
Risk Management Report Deviations
Medical benefits summary
Risk benefit evaluation
Summarized risks References
Risk management conclusion
8/17/2019 New EN ISO Risk Management Standard
8/24
10/15/2010
8
EN ISO 14971:2009 Risk Management File
For the particular medical device being considered, the manufacturer shall establish and maintaina risk management file. In addition to the requirements of other clauses of this InternationalStandard, the risk management file shall provide traceability for each identified hazard to:
the risk analysis; the risk evaluation; the implementation and verification of the risk control measures; the assessment of the acceptability of any residual risks
EN ISO 14971:2009 Risk Analysis
Intended use and identification of characteristicsrelated to the safety of the medical device:
For the particular medical device being considered, the manufacturer shall document the
intended use and reasonably foreseeable misuse. The manufacturer shall identify anddocument those qualitative and quantitative characteristics that could affect the safety of themedical device and, where appropriate, their defined limits. This documentation shall bemaintained in the risk management file.
8/17/2019 New EN ISO Risk Management Standard
9/24
10/15/2010
9
EN ISO 14971:2009 Hazard Analysis
The manufacturer shall compile documentation on known and foreseeable hazards associatedwith the medical device in both normal and fault conditions. This documentation shall bemaintained in the risk management file. Compliance is checked by inspection of the riskmanagement file.
Reasonably foreseeable sequences or combinations of events that can result in a hazardoussituation shall be considered and the resulting hazardous situations shall be recorded. For eachidentified hazardous situation, the associated risks shall be estimated using available informationor data. For hazardous situations for which the probability of the occurrence of harm cannot beestimated, the possible consequences shall be listed for use in risk evaluation and risk control.The results of these activities shall be recorded in the risk management file.
Any system used for qualitative or quantitative categorization of probability of occurrence ofharm or severity of harm shall be recorded in the risk management file.
EN ISO 14971:2009 Hazard Analysis, cont’d.
Risk estimation incorporates an analysis of the probability of occurrence and the consequences.Risk estimation can be quantitative or qualitative. Methods of risk estimation, including thoseresulting from systematic faults, are described in Annex D. Annex H gives information useful forestimating risks for in vitro diagnostic medical devices.
Information or data for estimating risks can be obtained, for example, from:a) published standards;b) scientific technical data;c) field data from similar medical devices already in use, including published reported
incidents;d) usability tests employing typical users;e) clinical evidence;f) results of appropriate investigations;g) expert opinion;
h) external quality assessment schemes.
8/17/2019 New EN ISO Risk Management Standard
10/24
10/15/2010
10
How to Begin a Hazard Analysis
Platform
known technology,
new materials/
components/
intended use
Derivative, well known technology,
line extension, minor design changes
Increasing availability
of information
Breakthrough, New Technology,
Little or no experience
Starting a Hazard Analysis - InputsSources of
Information
Type of Informat ion Comments
Use Flow ChartUseful for brainstorming
Normal state Hazards
Complaints/MDRs
Review and reuse similar
products (listed in Risk Mgt
Plan)
CRBA and CESPeriodically updated with
current Complaint/MDR info
DFU
Market SpecIntended use, functional
performance reqts
HA Work Instruction
appendixes
ISO Annexes- used to betabs in the old FMEA
workbooks
Hazard/Haz Sit/Harm
Hazard/Haz Sit/Harm
Hazard/Haz Sit
Hazard/Haz Sit/Harm
Harm
Hazard
8/17/2019 New EN ISO Risk Management Standard
11/24
Slide 19
JKM1 Increase size of triangle so the words in the top area do not extend beyond so much.Julie Maes, 7/7/2009
8/17/2019 New EN ISO Risk Management Standard
12/24
10/15/2010
11
Starting a Hazard Analysis – Sources of Information
Sources of InformationTy pe of Infor mation Comments
Bench Studies
TDP Reports
R&D studies
Feasibility, Development,
Design Verification
Animal & Clinical Studies
uFMEA and dFMEA
Obtain and reuse from
products with similar use and
design
Regulatory standards for
performance & test
e.g.
AAMI TIR 32 (software)
CDRH performance stds
ISO 10555List of harms and
severities
May use more than one
CAPAs, PIRs, Design
Changes
Obtain and reuse learning/data
from similar products (listed in
Risk Mgt Plan)
Hazard
Hazard/Haz Sit
Hazard/Haz Sit/Harm
Hazard/Haz Sit/Harm
Harm
Hazard/Haz Sit/Harm
Hazards- Fault and Normal
Fault Condition
• Characteristics that are required for operationbut present a hazard nonetheless
• Result from a Requirement/Functionality not met such as:
• Product malfunction
• Grouping of Failure Modes to describe the failure
to perform a function
Normal Condition
8/17/2019 New EN ISO Risk Management Standard
13/24
10/15/2010
12
Hazards, cont’d.
Hazards are expressed in terms of the product Use language already in complaints if possible
A Hazard is the “top” event in a list of failures If the description can lead to another product failure, it is likely not at the top
If the description is one of several causes for a failure, it is likely a “cause” and notthe hazard
Must be analyzed for the entire product kit orconfiguration
Must consider direct interaction with anotherproduct or accessory
Hazards, cont’d.
How do we know we have a complete list of hazards?
• Check hazards from different viewpoints, e.g.
Intended-use/ Misuse
Bench, animal, clinical studies
Complaints/ MDRs from similar products
Use and design FMEAs from similar products
DFUs
CES or CRBA
Developing a hazard analysis is an iterative process.
8/17/2019 New EN ISO Risk Management Standard
14/24
10/15/2010
13
Hazardous Situations
How do we determine the Hazardous Situation?
Consider the action, event or circumstance that links hazard to harm
Describe the anatomy, exposure, patient, or time that c reate difficulties in using the device,
leading to a harm
Describe how the product interacts with the patient, anatomy or body
Apply clinical knowledge of events or circumstances
Describe the sequence of events that lead from hazard to harm.
Best Practices – Hazard Analysis
Hazard AnalysisProduct Family Name:
Sources of Information:
Hazard Harm Type Hazardous Situation Harm Source Information
8/17/2019 New EN ISO Risk Management Standard
15/24
10/15/2010
14
EN ISO 14971:2009 Risk Evaluation
For each identified hazardous situation, the manufacturer shall decide, using thecriteria defined in the risk management plan, if risk reduction is required. If riskreduction is not required, the requirements given in 6.2 to 6.6 do not apply for thishazardous situation (i.e., proceed to 6.7).
The results of this risk evaluation shall be recorded in the risk management file.
Best Practices
FMEA or FTA
Use
Design
Process New requirements apply – risks of risk controls
Helpful input – List of harms and severities
8/17/2019 New EN ISO Risk Management Standard
16/24
10/15/2010
15
EN ISO 14971:2009 Risk Reduction and Control
Risk reductionWhen risk reduction is required, risk control activities shall be performed.
Risk control option analysis The manufacturer shall identify risk control measures that are appropriate for reducing the risks
to an acceptable level.
The manufacturer shall use one or more of the following risk control options in the priority orderlisted:
a) inherent safety by design;b) protective measures in the medical device itself or in the manufacturing process;c) information for safety.
EN ISO 14971:2009 Risk Reduction and Control, cont’d.
Implementation of risk control measure(s) The manufacturer shall implement the risk control measure(s).
Implementation of each risk control measure shall be verified. This verification shall be recordedin the risk management file.
The effectiveness of the risk control measure(s) shall be verified and the results shall be recordedin the risk management file.
The verification of effectiveness can include validation activities.
Compliance is checked by inspection of the risk management file.
8/17/2019 New EN ISO Risk Management Standard
17/24
10/15/2010
16
EN ISO 14971:2009 Residual Risk Evaluation
After the risk control measures are applied, any residual risk shall be evaluated using the criteriadefined in the risk management plan. The results o f this evaluation shall be recorded in the riskmanagement file.
If the residual risk is not judged acceptable using these criteria, further risk control measures shallbe applied
For residual risks that are judged acceptable, the manufacturer shall decide which residual risksto disclose and what information is necessary to include in the accompanying documents in orderto disclose those residual risks.
Compliance is checked by inspection of the risk management file and the accompanyingdocuments.
Risk Assessment Tools
Hazard Analysis Fault Tree Analysis (FTA)
Product & Process FMEA
Fault Condition Hazards
Harm,
Hazardous Situation,
& Hazard
Hazard = The
Connection
8/17/2019 New EN ISO Risk Management Standard
18/24
10/15/2010
17
Relationship Between Risk Assessment Tools
Harm
Hazardous Situation
Hazard
use Failure Mode
design Failure Mode
process Failure Mode
H A Z A R D
A N A L Y S I S
- - - F
M E A - - -
Hazard Analysis / FMEA (+/-)
Hazard Analysis
Advantages:
Shortcoming:
FMEA
Advantages:
Shortcoming:
Used together they deliver a thorough risk analysis.
Captures Haz-Haz Sit-Harm relationships
High level summary
Identifies Normal State Hazards
Facilitates identification of new / changing
risks with commercial products
Helps with designing out Hazards
Provides consistent terminology linked to
complaint coding
Encourages teams to identify hazards
associated with interfaces
Can’t see causes of Hazards
Provides a bottom-up perspective
Analyzes single fault failures
Able to focus on specific perspectives
(use, design, process, etc.)
Provides a detailed analysis and
control focus to the individual levels
being considered
Can add redundant controls (due to one-
level-at-a-time focus)
8/17/2019 New EN ISO Risk Management Standard
19/24
10/15/2010
18
Best Practices
List of harms and associated severities
Benefits
Inputs
Watch outs
EN ISO 14971:2009 Risk / Benefit Analysis
If the residual risk is not judged acceptable using the criteria established in the risk managementplan and further risk control is not practicable, the manufacturer may gather and review data andliterature to determine if the medical benefits of the intended use outweigh the residual risk. Ifthis evidence does not support the conclusion that the medical benefits outweigh the residualrisk, then the risk remains unacceptable. If the medical benefits outweigh the residual risk, thenproceed to 6.6.
For risks that are demonstrated to be outweighed by the benefits, the manufacturer shall decidewhich information for safety is necessary to disclose the residual risk.
The results of this evaluation shall be recorded in the risk management file. Compliance ischecked by inspection of the risk management file.
8/17/2019 New EN ISO Risk Management Standard
20/24
10/15/2010
19
Best Practices – CRBA or CES Product description
Intended use, indications for use
Contraindications
Summary of scientific literature
Literature review methodology
Literature experience summary
Clinical data
Market experience
Complaint review
MDR review
Field actions
Post-market surveillance
Alternate therapies
Evaluation of risk vs. benefit ratio
Reported harms
Reported benefits Acceptability of risk vs. benefit ratio
Intolerable risk
Conclusion
Bibliography
Reference documents
Appendices (literature search articles)
EN ISO 14971:2009 Risks Arising from RiskControl Measures
The effects of the risk control measures shall be reviewed with regard to:a) the introduction of new hazards or hazardous situations;b) whether the estimated risks for previously identified hazardous situations are affected by the
introduction of the risk control measures.
Any new or increased risks shall be managed in accordance with 4.4 to 6.5.
The results of this review shall be recorded in the risk management file. Compliance is checkedby inspection of the risk management file.
8/17/2019 New EN ISO Risk Management Standard
21/24
10/15/2010
20
EN ISO 14971:2009 Completeness of Risk Control
The manufacturer shall ensure that the risks from all identified hazardous situations have beenconsidered.
The results of this activity shall be recorded in the risk management file. Compliance is checkedby inspection of the risk management file.
EN ISO 14971:2009 Evaluation of Overall ResidualRisk Acceptability
After all risk control measures have been implemented and verified, themanufacturer shall decide if the overall residual risk posed by the medical device isacceptable using the criteria defined in the risk management plan.
If the overall residual risk is not judged acceptable using the criteria established inthe risk management plan, the manufacturer may gather and review data andliterature to determine if the medical benefits of the intended use outweigh theoverall residual risk. If this evidence supports the conclusion that the medicalbenefits outweigh the overall residual risk, then the overall residual risk can be
judged acceptable. Otherwise, the overall residual risk remains unacceptable.
For an overall residual risk that is judged acceptable, the manufacturer shall decide
which information is necessary to include in the accompanying documents in orderto disclose the overall residual risk.
The results of the overall residual risk evaluation shall be recorded in the riskmanagement file. Compliance is checked by inspection of the risk management fileand the accompanying documents.
8/17/2019 New EN ISO Risk Management Standard
22/24
10/15/2010
21
EN ISO 14971:2009 Risk Management Report
Prior to release for commercial distribution of the medical device, the manufacturer shall carryout a review of the risk management process. This review shall at least ensure that:
the risk management plan has been appropriately implemented;
the overall residual risk is acceptable;
appropriate methods are in place to obtain relevant production and post-productioninformation.
The results of this review shall be recorded as the risk management report and included in therisk management file. The responsibility for review should be assigned in the risk managementplan to persons having the appropriate authority. Compliance is checked by inspection of therisk management file.
EN ISO 14971:2009 Production and
Post-production Information
The manufacturer shall establish, document and maintain a system to collect and reviewinformation about themedical device or similar devices in the production and the post-production phases. Whenestablishing a system to collect and review information about the medical device, themanufacturer should consider among other things:
a) the mechanisms by which information generated by the operator, the user, or thoseaccountable for the installation, use and maintenance of the medical device is collected andprocessed; or
b) new or revised standards.
The system should also collect and review publicly available information about similar medicaldevices on the market. This information shall be evaluated for possible relevance to safety,especially the following: if previously unrecognized hazards or hazardous situations are present or if the estimated risks) arising from a hazardous situation is/are no longer acceptable.
8/17/2019 New EN ISO Risk Management Standard
23/24
10/15/2010
22
EN ISO 14971:2009 Production andPost-production Information, cont’d.
If any of the above conditions occur:
1) the impact on previously implemented risk management activities shall be evaluated andshall be fed back as an input to the risk management process and
2) a review of the risk management file for the medical device shall be conducted; if there is apotential that the residual risks or its acceptability has changed, the impact on previouslyimplemented risk control measures shall be evaluated.
The results of this evaluation shall be recorded in the risk management file. Compliance ischecked by inspection of the risk management file and other appropriate documents.
So What Does Your Notified Body Want? Their review shall at least ensure that:
RM plan is appropriately implemented; overall residual risk is acceptable; appropriate methods in place to obtain relevant production and post-production
information (PMS plan) Active and passive PMS
Establish, document and maintain a PMS system to collect info in production and post-production phases mechanisms of collecting & processing input from operators, users, installation and
maintenance personnel etc new or revised standards
Collect and review publicly available information about similar medical devices
impact analysis review RM file
It’s your company – they will not tell you what to do you know your products and their history better than anyone – you should decide what is
appropriate you as a company are required to have a system in place –does it work for you or is it
window dressing? talk to your notified body
8/17/2019 New EN ISO Risk Management Standard
24/24
10/15/2010
Questions?
Roberta Goode
(954) 646-1215
www.GCIBiotech.com