Here are the basics of what we do as a Class II/IIa medical device company. As context we are recovering from a 483 letter and our risk analysis procedure is now <very> thorough. It may be overkill but I know it has the blessing of FDA:
- Develop your Top Level Hazards (TLH). These are the risks to the user, patient, and caregiver. Develop your severity rankings for these TLHs here. The severities do not change and are carried through the entire analysis.
- From your TLHs you develop your basic fault events (BFEs). Basically 'how did my TLH happen?'. Develop your Likelihood of failure here. The multiplication of the severity and the likelihood gives your Risk level. See ISO 14971 for examples.
- Develop a fault tree analysis from this information. Your failure modes leading to your BFEs leading to your TLHs. You can then develop your Risk Control Measures (RCMs) from this information. These RCMs are what you would track and Verify during testing. Basically do your RCMs work as intended to reduce the risk of the BFE? Your RCMs are what you use to reduce the Likelihood number in your Risk analysis. If your RCMs are not effective you are not justified in reducing your Likelihood number, but if you can prove they are effective then you're OK.
- This completes your fault tree. This is a top down approach, i.e. what is my failure and how did I get there? From here you would then go the other way for dFMEA and pFMEA. For your dFMEA you would take each component and ask yourself "if this fails does it lead to a TLH?". If the answer is no then move on to the next component. For you pFMEA you ask yourself "if this process fails can it lead to a TLH?". If no then move on. You would develop more risk control measures from your FMEA if you have missed anything in the FTA.
An example of a TLH would be 'Patient receives a non-sterile infusion' or something similar. A BFE would be 'Packaging failure due to xxx causes sterile barrier breach'. A RCM would be 'Packaging tested to ISTA 2A requirements'. You would then be able to establish traceability from your packaging test to your risk analysis.