ISO 14971:2019: Criteria for overall residual risk

mithilesh

Registered
Hi All

Per ISO14971:2019; the manufacturer must document the method and criteria for overall residual risk evaluation in the Risk management plan.

I am wondering if you have any idea what could be some possible method and criteria for overall residual risk evaluation.

I am slightly confused by difference between method and criteria.

if i say my criteria is :" " The overall residual risk level is acceptable if all individual risks are determined to be acceptable i.e. after all individual risks have been mitigated to acceptable levels or determined to be acceptable through the BRA analysis."

Then is my method just : "checking all residual risks in my risk files and confirming all risks are acceptable"?

Thank you

Mithilesh P.
 

Tagin

Trusted Information Resource
I would look at TR24971:2020 Guidance on the application of ISO 14971. Specifically, at Clause 8 - Evaluation of overall residual risk.

You example above would not be acceptable, as they state in clause 8 (bold added):
The evaluation of overall residual risk is a challenging task that cannot be achieved by adding all individual risks numerically. The difficulty arises for the following reasons:
— Each probability of occurrence of harm is related to a different harm with different severity and can be related to different hazardous situations.
— Probabilities are often known with different degree of uncertainty. Some probabilities could be known precisely from either historical data or testing. Other probabilities might be known imprecisely such as estimates by expert judgment, or cannot be estimated such as the probability of a software failure.
— It is not possible to combine the severities of individual harms within the broad categories usually employed in risk analysis.
Furthermore, the criteria for acceptability of the overall residual risk can be different from the criteria for acceptability of individual risks. The criteria used to evaluate individual risks usually include limits for the probability of occurrence of harm with a particular severity. The criteria used to evaluate the overall residual risk are often based on additional elements, such as the benefits of the intended use of the medical device.
 

yodon

Leader
Super Moderator
The stars seem to be aligning here with FDA, EU, and 14971 (guidance) all kind of pointing to an analysis. FDA published a couple of guidance docs that give a pretty nice framework for doing your assessment:
We adapted the latter and have used on several projects. Seems to be a solid approach. No pushback yet.
 

ThatSinc

Quite Involved in Discussions
Criteria for overall risk acceptability is, by its nature, a more broad review of the risks of the device.

You could look at
  • Number of risks that are mitigated by IFU alone
  • Number of hazards that a user might be exposed to by the same hazardous situation
  • Where all of the risks sit together, is it a "high risk" device in general or does it just have one or two high risks?

Taking an unlikely example; you could individually have 100 number of risks that have a 1 in a million chance of killing the patient, and each could be acceptable in its own right - but if you took a higher level view of the product, could you say that overall having that many opportunities is acceptable for the product?

Where 14971 only requires benefit-risk analysis for risks that are outside of your risk acceptability criteria, yet MDR etc. require a benefit risk for all risks, consider the overall risk evaluation part of a broad benefit-risk for the device.
 

Moricona

Registered
Does anyone mind to share a Risk Analysis Matrix for Medical Devices and how to calculate the Residual Risk? Also, does someone use Residual Severity as part of the final Residual Risk calculation/acceptability? It will be very appreciate any feedback. Thanks.
 

ranab

Registered
Does anyone mind to share a Risk Analysis Matrix for Medical Devices and how to calculate the Residual Risk? Also, does someone use Residual Severity as part of the final Residual Risk calculation/acceptability? It will be very appreciate any feedback. Thanks.
Hi all, I'm also curious to have an example of risk analysis matrix and see how to calculate the residual risks
 

Tidge

Trusted Information Resource
I cannot share specific risk analysis documents, but what I have most commonly seen done generally follows this path:

(1) A serious review of literature to examine the market, use cases (and user profiles), medical condition treated with the device and the history of the type of device.

This will serve as the basis for the method and criteria used later for individual products. This review is intended to provide information for such questions like "is the device used only by experts", "is the device used only in extreme circumstances", "is the treated medical condition life-threatening or non-life threatening."

(2) Executive Management uses the review to establish the risk matrix for the product family, independent of any specific devices. Different product families can have different risk matrices. For example: infusion pumps almost certainly have a different risk acceptability matrix than hospital beds. This is where the criteria are established.

Once executive management establishes the risk matrices (per product type)...

(3) Within the risk management plan for a specific device (or a family of specific devices, essentially 1-per-DHF), the method is to a) copy the established criteria directly from the policy established by executive management. and b) apply an established policy of documenting and reducing risks (presumably via a 14971-compliant process). That policy will also have been established by executive management.

I suppose that you could do all this is an ad hoc way, by trying to justify specific risk matrices within an individual products Risk Management Plan and by coming up with some peculiar sort of different Risk Management processes for individual products (again, documented in the RM Plan), but I (personally) feel like such ad hoc approaches have too many risks (not just to patients and users!). Ad hoc approaches to risk management will often result in gaps (in the process, in the analysis, in the product) that will eventually be exposed at extremely inopportune times. Ad hoc approaches also lead to inconsistencies (between similar products) that can have serious consequences for patients/users (safety) as well as the manufacturer (legal, regulatory).
 

Aikendrum

Registered
I cannot share specific risk analysis documents, but what I have most commonly seen done generally follows this path:

(1) A serious review of literature to examine the market, use cases (and user profiles), medical condition treated with the device and the history of the type of device.

This will serve as the basis for the method and criteria used later for individual products. This review is intended to provide information for such questions like "is the device used only by experts", "is the device used only in extreme circumstances", "is the treated medical condition life-threatening or non-life threatening."

(2) Executive Management uses the review to establish the risk matrix for the product family, independent of any specific devices. Different product families can have different risk matrices. For example: infusion pumps almost certainly have a different risk acceptability matrix than hospital beds. This is where the criteria are established.

Hi, this is super helpful but I'm still struggling with the statement:

"Executive management uses the review to establish the risk matrix for the product family"

In my case, I'm trying to do just this - come up with a rational, justified set of criteria for risk acceptability for my company's device. I've hunted the internet high and low and have found a few statements like yours, i.e. that a review of literature, adverse event reports and so on can provide input into determining the acceptability of risk, but I'm completely flummoxed on how exactly. There's a difference (in my mind) between knowing the types of risks and their likelihoods based on objective data, and determining whether that combination of likelihood and severity is considered "acceptable". In my experience the literature doesn't tend to delve into the issue of acceptability!

Do you or anyone else have any tips on how to get from a body of data on the risks associated with a device when used according to your intended use, and the decision of acceptability of risk? I'm a bit stuck.

Thanks heaps!
 

Ed Panek

QA RA Small Med Dev Company
Leader
Super Moderator
First, there are design mitigations, then there are risk mitigations and the final score. If the final score is still too high you need to perform a risk-benefit analysis on that item to demonstrate its ok as a residual risk.
 

Tidge

Trusted Information Resource
Do you or anyone else have any tips on how to get from a body of data on the risks associated with a device when used according to your intended use, and the decision of acceptability of risk? I'm a bit stuck.

Some potential guidelines:

The longer the type of device (and its underlying interaction with human physiology) has been in practice, then it is more typical that a family of similar products has less tolerance for risk. That is: more of the risk space is unacceptable.

If there are alternative treatment options to the underlying technology used for physiological interaction with the patient, A new family of products using the alternative approach to treatment should NOT accept risks at a higher rate than the competing technology. Nobody should let you market a fancy new hospital bed if it could electrically shock people or pinch them, no matter how many USB ports you include (for example).

If the medical outcomes are particularly poor in the absence of the device (or alternative treatments), then it is typical that the new product family will be more accepting of higher risks.

If the family of products will be used in limited circumstances with a well-understood group of users (because of the nature of the device) it is more typical that there is a tolerance for higher risks when compared to a medical device that could be used by almost anyone almost anywhere. Compare dental x-ray device with toothbrush. Both need to be safe, but there are acceptable risks with an X-ray machine that would never be accepted with a toothbrush.

At the very least, you can use the collected data to show that as far as risk tolerance you are aligned with, or better than what is on the market (or in medical use).
 
Top Bottom