Dumb question on Risk Assessment - Include planned mitigations?

D

df_df

#1
I have a question that's been bugging me for a long time on risk management - should you include planned mitigations when doing your initial risk assessment, or do the initial assessment assuming there are no mitigations? Here's an crude example of what I mean using power tools.

Suppose I'm doing a hazard analysis on a circular saw that I am designing. The kind you can buy at a hardware store for cutting plywood.

First, let's assume that the spreadsheet I'm using has the following columns (based on the ISO standard) - hazardous situation, harm, severity, probability, risk (SxP), risk control method, final probability (assuming the risk control method works), final risk. The first 6 columns (through risk control method) are filled out in the first pass of the spreadsheet. The last two are done at the end of the project, after verification testing shows the mitigation is effective.

I'd put the following in the first few columns. The hazardous situation would be the sharp spinning blade. The harm would be cutting off my finger. The severity is high. :mg: Now, what is the probability? There are two ways to do this - should I assume that the movable guard (the one that is on all saws) is on the sytem when I do the initial assessment, or should I assume it's not there and put that in the risk control column?

If I did the former, the probability would be high, and the risk would be "intolerable". I'd then put "add a blade guard" in the risk control method column. The updated probability would be "low" and thus the risk would be "acceptable".

If I did the latter, the probability would be low, the risk would be low and therefore I wouldn't need to implement any other risk control method. The path seems a bit easier and more realistic. But that doesn't document the fact that there is a guard in place and its inclusion in the system may be subsequently overlooked. It also doesn't highlight the fact that you need to "verify the effectiveness" of the mitigation in order to take credit for it.

The end result is the same, there's just two roads to get there.

I know this is a trivial example, but it illustrates a very common situation - how much knowledge of the final system do you assume when you do the initial risk assessment - which should theoretically be done very early in the project.

What would you do?

- Dave
 
Elsmar Forum Sponsor

Solinas

Involved In Discussions
#2
Re: Dumb question on Risk Assessment

I'd include the guard. I would examine the product, as designed.

If you start looking at stripped down versions you don't intend to manufacture, where would you stop? Do a version without a fuse to capture what would happen if the thing shorted out and burned down a house?

A more complicated example would have you off in a dozen areas that really won't happen, due to the existing design.
 
M

MIREGMGR

#3
Re: Dumb question on Risk Assessment

There are people out there who are teaching the assume-a-really-stupid-design approach, where the obvious safety features you include in your first concept (or for purchased equipment, that are already present for various reasons, including legal requirements) are separately analyzed as if they're mitigations for hazards that otherwise would exist. Our Engineering Manager took some kind of seminar that taught that approach. Now every risk analysis we need to get done, he's a constant pain in the backside, hassling us that we're going about it all wrong.

In case that anecdote doesn't make it obvious, I agree with Solinas. Don't analyze so as to take mitigation-credit for already-mitigated risks.
 

v9991

Trusted Information Resource
#4
Re: Dumb question on Risk Assessment

I do agree with Miregmgr and Solinas,

There ought to be some exclusion criteria defined + yet, a place where its implementation is verified/reviewed.

should the failure modes which are already addressed through design(could be legal or current standards etc) would figure in the design fmea!:confused:
 

Ronen E

Problem Solver
Staff member
Moderator
#5
Re: Dumb question on Risk Assessment

Hello & welcome to the cove!

I have 2 comments:

1. One of the preliminary stages in any proper risk assessment is to unambiguously identify the design / version you are assessing at a certain risk assessment run. You could do it by referring to a version number or even by attaching design drawings. This way it is very clear what product you are trying to assess (e.g. does it have a blade guard or not).

2. Risk assessment is not a one-off activity. In my opinion, the first run should be held as early as the design concept generation stage, then the assessment revisited and enhanced on significant design milestones (whatever this would mean to you). Therefore - yes, when you do the first runs you have quite little details to go on, and so the analysis and assessment are done essentially on a conceptual level ("who said the saw has to have a blade anyway?..."); then, as the design unfolds you get to review the finer and finer details, and so do your mitigation means become more specific. Also, your ability to verify / measure effectiveness grows accordingly.

Cheers,
Ronen.
 
P

PaulGr

#6
Re: Dumb question on Risk Assessment

I agree with the remarks of Rohen and I personally would be careful to include control measures already in your initial analysis. I have seen clients cited by their notified body for exactly this reason.

When a device design is stable for over 50 years (?) like the circular saw example, the formal ISO14971 approach seems indeed a bit silly, but for more complex devices it will be different.

In my opinion, this is only an issue with updates of devices where initially no proper risk analysis was done or if the initial risk analysis was a little delayed... :)

Cheers, Paul
 
D

df_df

#7
Re: Dumb question on Risk Assessment

Thanks for all your thoughts. I guess there is no clear-cut answer. I guess its a tradeoff between going overboard with analyses of product configurations that will never come to fruition and complying with the requirement to of document (and verify) all mitigations.

Maybe a compromise would be to analyze the as-envisioned design and state the assumptions that go into the initial analysis. The assumptions could be verified along with any subsequent mitigations.

PaulGr - can you give some details on insight on how and why your client got cited?

Dave
 
Last edited by a moderator:
P

PaulGr

#8
Re: Dumb question on Risk Assessment

Dave,

During that audit, there were 2 findings related to ISO14971 (ISO13485 / MDD audit, European firm, German notified body):
1: hazards that do not lead to a control measure were recorded in the risk management file.
2: Not all selected control measures were recorded in the risk management file.

In the discussion, they indicated that when a control measure is not listed in the risk analysis, there is a chance that in future updates, the control measure is 'removed'.

As the firm claimed compliance with ISO14971 in their design files, they got the finding. They updated their risk management SOP.

Cheers, Paul
 
A

Al Dyer

#9
Re: Dumb question on Risk Assessment

df,

There is nothing here that is a dumb question!! We are all seeking answers and thoughts that will help us perform our career wants and needs.:):)

Al...
 

somashekar

Staff member
Super Moderator
#10
Re: Dumb question on Risk Assessment

Don't analyze so as to take mitigation-credit for already-mitigated risks.
What a nice learning from this thread ....
Risk assessment is a live document and at design concept stage several such risks do need to be considered and they provide design inputs.
When medical devices are assessed, the residual risks is to assess the risks prevailing or induced that weighs less compared to the benefit for which the medical device is put to use. (aka contraindications)
Ex:
A process for cancer treatment may be very essential to save the life as compared to the hairfall (hairloss) which is the risk when this treatment is provided to the patient. You can do nothing more to reduce this risk but mention clearly this risk to the patient against benefit of cancer treatment.
 
Thread starter Similar threads Forum Replies Date
Q Graduation date on my resume - Dumb Resume Question Career and Occupation Discussions 12
G Is it dumb to develop an ISO 17025 web site? ISO 17025 related Discussions 9
Wes Bucey A really DUMB Nigerian phishing letter! "FBI" (USA) Email promising dire consequences Coffee Break and Water Cooler Discussions 9
SteelMaiden Another dumb thing to do.... Coffee Break and Water Cooler Discussions 7
ScottK Are there eBayers dumb enough to pay outrageous shipping? Coffee Break and Water Cooler Discussions 16
I More Dumb Jokes - Adults Only Please!!! Funny Stuff - Jokes and Humour 21
lanley liao Question regarding the calibration of monitoring and measure equipment. Oil and Gas Industry Standards and Regulations 0
C Gauge R&R Question Using Minitab Software 1
J IATF 16949 Internal Audit question - Auditor's responsibility Internal Auditing 6
K Question on MDR classification EU Medical Device Regulations 4
D Question on equipment - when to use reference only or research only stickers ISO 13485:2016 - Medical Device Quality Management Systems 5
D Work Instruction Question ISO 13485:2016 - Medical Device Quality Management Systems 5
M Clinical Decision Support Software Question 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 2
John C. Abnet VDA 6.3 - Question 7.3 - "blocking of parts" VDA Standards - Germany's Automotive Standards 6
D Approved supplier list - Distributors question ISO 13485:2016 - Medical Device Quality Management Systems 6
D Equipment Register and PM question ISO 13485:2016 - Medical Device Quality Management Systems 2
D Question regarding "storage and distribution" ISO 13485:2016 - Medical Device Quality Management Systems 1
D Calibration tolerance question using Pipettes Medical Device and FDA Regulations and Standards News 1
D Question regarding customer feedback process ISO 13485:2016 - Medical Device Quality Management Systems 3
D Equipment Register related question ISO 13485:2016 - Medical Device Quality Management Systems 1
S Study sign off question / responsibilities ISO 13485:2016 - Medical Device Quality Management Systems 3
S Qualification question - ISO 13485 - Setting up a small lab Reliability Analysis - Predictions, Testing and Standards 2
M Question for Auditors - "Off the Record" Conversation? General Auditing Discussions 14
D Question regarding ECO process, specifically for Life Science products and defining form fit and function ISO 13485:2016 - Medical Device Quality Management Systems 1
R Accelerated Aging - Creating test samples - Implantable medical device Question Other Medical Device Related Standards 4
A Question on Authorized Representative in Malaysia Other Medical Device Regulations World-Wide 3
D Limited Scope for second site Question? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 5
I ISO 2233:2000 Question - Medical Device Shipping/Transportation Validation Other ISO and International Standards and European Regulations 1
Anonymous16-2 Labeling Question (Dietary Supplements/Food) Pharmaceuticals (21 CFR Part 210, 21 CFR Part 211 and related Regulations) 1
T Question for: Cg & Cgk calculation General Measurement Device and Calibration Topics 3
N ASL Question for GitHub ISO 13485:2016 - Medical Device Quality Management Systems 6
hogheavenfarm GDT Flatness measurement question Inspection, Prints (Drawings), Testing, Sampling and Related Topics 10
A Question on ISO 14001:2015 - Are annual audits required? ISO 14001:2015 Specific Discussions 11
dinaroxentool Question about FDA Classification of a Device 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 3
J Another DFAR question 252.225-7009 AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 0
F Conflict Mineral Smelter Question RoHS, REACH, ELV, IMDS and Restricted Substances 8
R NRTL - Scope Question - Off-the-Shelf Plug In IEC 60601 - Medical Electrical Equipment Safety Standards Series 0
D API 6A Certification Question Oil and Gas Industry Standards and Regulations 4
dinaroxentool Question about qualification as a medical device or accessory in Europe EU Medical Device Regulations 2
R DHR question: Traceability of components ISO 13485:2016 - Medical Device Quality Management Systems 2
C MDR - Question around software accesories EU Medical Device Regulations 2
K My question is, what/when is a nonconformity? Therefore what requires an NCR? Nonconformance and Corrective Action 9
Watchcat Authoritative References about the Research Question? Quality Tools, Improvement and Analysis 0
T Question about Quality Department employee position titles Quality Manager and Management Related Issues 10
N Question on creepage/clearance requirements for HF Active Accessories for 2nd edition 60601-1 IEC 60601 - Medical Electrical Equipment Safety Standards Series 1
J Question: How to create an IMDS RoHS, REACH, ELV, IMDS and Restricted Substances 3
K Question on whether IEC 60601-2-62 standard is applied IEC 60601 - Medical Electrical Equipment Safety Standards Series 4
B QMS question in regards to multiple medical devices/products and N/A activities Other Medical Device Related Standards 12
C NB approval - Basic question about Notified Bodies and their role EU Medical Device Regulations 10
G Question about Non-conformances during New Product Introduction Nonconformance and Corrective Action 14

Similar threads

Top Bottom