How to create the Policy for determining criteria for Risk Acceptability

[Peter Selvey]

Recently I have been playing with the concept of a risk minimum, which captures some of the issues MIREGMGR raised.

The theory goes that the use of resources (in both the analysis phase and for risk controls) increases device cost, delays placement on the market, takes resources and incentive away from new development (new ideas, improvements of existing devices). This reduces the device availability, which means a reduction in clinical benefit. Thus, increased resources means increased risk.

Applying resources can also reduce risk. But there will be diminishing returns. So, at some point there will be a risk minimum, a point beyond which application of more resources only increases the risk. It is this risk minimum that should be our general target.

The interesting point, relevant to this thread, is that the risk minimum will be different for every hazardous situation. So developing broad criteria for acceptable risk for a particular medical device, or policy for developing this criteria, makes no sense.

Other interesting conclusions include:
- the ability to limit the scope of risk management to selected hazardous situations only (with a greater depth of analysis for those situations)
- methods to objectively verify the suitability of most risk controls without relying on estimates of risk
- replacing the risk / benefit argument (which is open to abuse) with a risk minimum argument (but still limited to special situations only)
- the risk minimum is not static, and will change as technology, market experience grow

Since we are stuck with ISO 14971 for now, maybe a good "policy" would be one that requires reasonable resources be applied to minimize risk, taking into account not only state of the art, published standards, national and regional regulations, but also the potential negative effects from the use of excessive resources.