Risk Matrix used by my company

[david316]

Hello,

The company I work for constructs a risk matrix in order to define its risk acceptability criteria. Severities and probabilities are defined and the matrix is broken down into regions of unacceptable and acceptable risk. In order to document the regions that are acceptable the project team is supposed to consider the following:

-what risks will a device have after implementation of standards. These are assumed to broadly acceptable.
-given the benefit of the proposed device what are the accepted risks. This effectively embeds a risk vs benefit within the matrix.

There are numerous reasons why I disagree with this approach but I would be interested in other people thoughts...

Thanks

 

[Marcelo]

what risks will a device have after implementation of standards. These are assumed to broadly acceptable.

ISO 24971 does have a way to use the risk management with standards that, if you follow an evaluation (the flowchart in ISO 24971), perform testing and the test passes, you can consider the risk acceptable. But obviously you do not need a risk matrix for this, as this is an alternate risk acceptability criteria.

given the benefit of the proposed device what are the accepted risks. This effectively embeds a risk vs benefit within the matrix.

The next edition of ISO 14971 will always require a benefit/risk analysis (for aggregate risks, not individual risks), but again this does not have anything to do with a risk matrix.

As discussed in our previous discussion, I think your company has been using a risk matrix in a weird way (and unfortunately, most people do).

 

[david316]

I agree. I think its a very weird approach and pretty much impossible to do! It seems very counter intuitive to me to use risk and benefit as part of the justification in the matrix for acceptable risk. What we end up effectively saying is that a product with more benefits is allowed to have more risks as they relate to things like fire, electrocution, burns, etc. I feel this is wrong. I can accept that a product with more benefits can have more risks that relate to a consequence of the therapy but I cannot accept that a product with more benefits can have more risks as a consequence of poor design!

 

[Soogwoog]

I think this is where we start to enter the territory of reducing risk "as far as possible". Yes, a device with greater benefits can more easily justify the existence of risks - however, this doesn't remove the need to reduce those risks "as far as possible". Reducing it as far as possible needs to happen before you can be judging a residual risk acceptable or not.