Reconciling FMEA RPN ratings with Risk Acceptability

[WikipediaBrown]

I am currently working on a procedure for my company to create an FMEA for a new medical device. It is my understanding that the Hazard Analysis conducted per ISO 14971 should be our "top level" risk documentation, and then the FMEA will serve as a sort of supplementary resource, particularly when we start getting into the Process FMEA stuff later down the line.

Unfortunately I've run into a snag where the RPN ratings (green, yellow, red) are not aligning perfectly with our established Risk Matrix (Low, Medium, High). For instance, a harm might be rated as a "5" in severity, and a "2" in occurrence on our Risk Accetpability Matrix. If I was to multiply these numbers together like you would with an RPN, I would get "10", and this would be considered a high level of risk. However, if I had a harm that was rated as a "4" in occurrence and a "3" in severity, the product of those numbers is 12. The problem is, our Risk Matrix would still only designate that harm as having "medium" risk. Here's a visual aid to help describe what I'm talking about:

https://imgur.com/a/OMKucQ8

I would really prefer to stick to the tried and true method for calculating RPN with scales of 1-10 in occurrence, severity, and detectability. Should I just include a clause in my SOP which clarifies that the RPN rating does not necessarily correlate to Risk Acceptability?

I appreciate any guidance you guys can offer, this is my first time learning this material.

 

[japayson]

I believe you are describing a known weakness of the FMEA and RPN techniques. Items are treated as linear, and subject to multiplication but as you find it is not the case.

 

[Bev D]

Exactly. The laws of mathematics preclude the multiplication of ordinal data. You get funky results. You should NOT use the RPN.

 

[d_addams]

You're initial guess is correct. Who says your risk acceptability criteria has to be an explicit RPN greater than X is acceptable? You own the process, you get to make up your own rules. Presumably what you wanted is Risk zone 3 is not acceptable, so just say that. Nowhere in the Regulations or 14971 does it say one must use an explicit RPN value as the discriminator in all situations.

 

[Zero_yield]

Though I agree with the above discussion about the weakness of the RPN system, another way to fix the immediate issue is to define your green / yellow / red numbers with a number. I.e., green is RPN 1 to 4, yellow is RPN 5 to 9, red is RPN 10 or more (or wherever you want to define it). Adjust colors on grid to match.

If you can get away from RPN, great. If that's not possible, this might be a way to inject some rationality into it.

For reference, the company I'm a part of right now loves RPN for risk management. I'm a peon with basically no say in what goes into high-level corporate documents.

 

[ThatSinc]

another way to fix the immediate issue is to define your green / yellow / red numbers with a number. I.e., green is RPN 1 to 4, yellow is RPN 5 to 9, red is RPN 10 or more (or wherever you want to define it). Adjust colors on grid to match.

But this method in itself goes against the notion of defining your risk acceptability based on state of the art and often leaves you with situations where frequently causing minor harm is as acceptable as infrequently causing serious harm.

Your RPN on a 1x1x10 vs a 10x1x1 is the same.

The minor harm of removing a sticking plaster is acceptable, and is likely to happen close to 100% of the time - but you wouldn't say it's acceptable if a sticking plaster kills somebody.

 

[Zero_yield]

But this method in itself goes against the notion of defining your risk acceptability based on state of the art and often leaves you with situations where frequently causing minor harm is as acceptable as infrequently causing serious harm.

Your RPN on a 1x1x10 vs a 10x1x1 is the same.

The minor harm of removing a sticking plaster is acceptable, and is likely to happen close to 100% of the time - but you wouldn't say it's acceptable if a sticking plaster kills somebody.

This is true and goes back to the basic point of RPN being a decent tool for brainstorming and a deeply flawed tool for objectively defining risk.

For this example, the best response I have is that I defined a 10 as red. A harm that occurs nearly every time and a very rare harm with chance of a life threatening / lethal outcome are likely both unacceptable and need to be addressed. I'm not saying this makes RPN any better as a tool.

 

[Bev D]

Science is real, mathematics is real. Denying either is fatal.

The idea that an RPN is useful is part of waht i known as the “bright line fallacy” or as I call it “Statistical Alchemy”.
Lazy people (I’m no longer pulling my punches on this) love a single ’yes or no’ answer with a bright line that indicates success or failure. It never matters that the ‘calculation‘ is fake or that the line is arbitrary or as in most cases, both. People who actually believe in science and math can understand the truth if it is explained.

The RPN is NOT a decent tool for anything. It is fake. Science, math, logic are decent tools.

I will also add that guessing at the frequency or probability is just as dumb and misleading and fake.

 

[ThatSinc]

A harm that occurs nearly every time and a very rare harm with chance of a life threatening / lethal outcome are likely both unacceptable and need to be addressed.

A device that requires a blood draw to function? That will cause a minor harm 100% of the time.
It's not a risk that needs to be addressed, it's a risk that is acceptable based on the benefits of the device.

 

[Zero_yield]

The idea that an RPN is useful is part of what i known as the “bright line fallacy” or as I call it “Statistical Alchemy”.

As someone trying to understand more about the flaws with RPN methodology, could you explain more about "bright line fallacy"? I tried Googling it, and I got some interesting discussion of p-values and some unhelpful anti-science garbage.

I'm in a situation where I am required to interact with RPN tables due to my procedures, and I'd rather be aware of the problems with the methodology.