Risk Assessment- What to do?

[alimary15]

Dear all cove members,

I have the following question: How do you deal with risks that have multiple severities? How do you document and discuss such risks in your risk management file?

Let me give you an example:

Hz. Situation: Failure of component xxx leads to additional exposure to anesthesia

This could cause:

Harm1: Minor Bleeding --> Severity: Marginal, Probability: Frequent

Harm 2: Death--> Severity: Catastrophic, Probability: Incredible

Assuming that the mitigation measures are the same for both harms and that I am able to use the same risk control measures for mitigating of both dead and minor bleeding, how can I document this risk in my risk analysis?

Option 1: I go with the most " likely-to-happen" harm, but in this case this would mean e.g. I am not considering at all the possibility of death.

Option 2: I go with the worst case harm, which is very very remote to happen, but this way I would not be able to account for marginal harms which instead occur very frequently

Option 3: I document this risk twice, one time assessing Harm 1 and one time assessing Harm 2, even if the mitigation measures are the same. But this way means my risk analysis documentation will explode!

Can anyone provide guidance or suggestions on how to handle such cases?

Thank you so much for your help!

 

[somashekar]

The manufacturer shall ensure that the risk(s) from all identified hazardous situations have been considered.
The results of this activity shall be recorded in the risk management file.

Completeness is very important in risk management. An incomplete task can mean that an identified hazard is
not controlled and harm to someone can be the consequence. The problem can result from incompleteness at
any stage of risk management, e.g. unidentified hazards, risks not assessed, unspecified risk control
measures, risk control measures not implemented or risk control measures that prove ineffective. Traceability
is needed to establish completeness of the risk management process.

So you deal with all of them.
I do not know about explode of your risk management file., but this file must be alive and address the product life cycle. So it is expected to be growing as you discover more risks...

 

[Ronen E]

True, option 3 is the way to go.

Risk assessment, evaluation and (as necessary) mitigation are done an a harm-basis, with back traceability to the hazardous situation(s) and harm realization scenario. Thus, every different harm needs its own entry. It's possible that a given risk mitigation measure will serve against several different potential harms (what you call risks), i.e. will appear on several different entries.

 

[mihzago]

is the full chain of events from the failure to the harm exactly the same in both cases?
also, does the harm depend on the patient e.g. geriatric or pediatric vs middle-age adult? I've done risk assessment where hazards would be considered separately depending on the population or the conditions diagnosed/treated.

As others have weighed in, I would too probably go with #3, but if that is not an option for some reason then #2; focus on severity and you will very likely address the lower severity harm with the control measures anyway.

 

[stm55]

is the full chain of events from the failure to the harm exactly the same in both cases?
also, does the harm depend on the patient e.g. geriatric or pediatric vs middle-age adult? I've done risk assessment where hazards would be considered separately depending on the population or the conditions diagnosed/treated.

As others have weighed in, I would too probably go with #3, but if that is not an option for some reason then #2; focus on severity and you will very likely address the lower severity harm with the control measures anyway.

is the full chain of events from the failure to the harm exactly the same in both cases?
also, does the harm depend on the patient e.g. geriatric or pediatric vs middle-age adult? I've done risk assessment where hazards would be considered separately depending on the population or the conditions diagnosed/treated.

As others have weighed in, I would too probably go with #3, but if that is not an option for some reason then #2; focus on severity and you will very likely address the lower severity harm with the control measures anyway.

Hey guys,

I know this is a VERY old post, but I asked a similar question recently, and this older thread is somewhat relevant to the situation I am thinking of.

I understand what you guys are saying with respect to looking at each harm level separately. My question is- if you have a single Hazardous Situation that could lead to many distinct harms and you look at them all separately, you may end up diluting the overall probability. Just for argument's sake, if you have a HazSit that leads to 3 separate "Catastrophic" harms, 3 separate "Major" harms, and 3 separate "Minor" harms, should you add up all the harms in a given category to determine if those overall outcomes are acceptable? If each of the 9 harms are all under the individual threshold of acceptability, it still might require risk reduction because that one HazSit can lead to a significantly greater PoH overall. For instance, if the probability of Harm 1 is 1/10,000, Harm 2 is 1/10,000, up to Harm 50 which is 1/10,000. These may all individually pass my acceptance threshold, but if there's a 50/10000 chance of some harm arising from a given HazSit, that could be very unacceptable.

Similarly, what if the overall Hazard has 5 different corresponding HazSits and each one has say a 1/1000 chance at leading to Bacteria exposure-- and these all would correspond to the same P2 profile. The overall risk of Bacteria exposure is 5 times greater, but if you assess 5 different HazSits, you would likely be understating the bacteria exposure risk. Should you be aggregating these?

Would be much appreciated if one of you could weigh in on this or my related question in my separate post (Since you both seem to have a good handle on this topic)!

 

[yodon]

should you add up all the harms in a given category to determine if those overall outcomes are acceptable?

I don't see that as a reasonable method to determine overall risk acceptability.

TR 24971 section 8.3 has some approaches to overall benefit-risk analysis. To me, it's more like making a legal case for why you believe the benefits outweigh the risks.

 

[Bev D]

When dealing with the probability of occurrence of any event, we must use the rules of probability. Sadly too many people are completely ignorant of how probability actually works. (Note that probability is real in real life while inferential statistics is based on theoretical models that rarely exist in real life.)

The answer to your question lies in probability mathematics. This is not a trivial thing to understand. I always remember this basic tenant before selecting the appropriate probability formula: the more things that can go wrong, the more things that will actually go wrong…chew on that awhile before you start to learn probability. (Let me give you a hint: more things that can go wrong will not dilute your probability that something will go wrong. If it does you selected the wrong probability formula)

I will also note the underlying flaw in most probability calculations is the initial estimate of the probability of occurrence of each unique event. For example how do you know that event A has a 1 in 10,000 probability of occurrence? The first question is 10,000 what? The second thing is how did you determine the numerator? Did you pull it out of your hopeful biased subjective anatomy? Or is it based on empirical and objective data? A real example is that aerospace engineers estimated that the probability that a catastrophic shrapnel event would hit the one area where all hydraulic lines came together resulting in complete loss of hydraulics during flight as 1 in a billion. They never stated what the billion things were. And in fact it had occurred 4 times since the estimate was made. (Look up United Airlines flight 232, the Sioux City Crash Landing)

 

[stm55]

I don't see that as a reasonable method to determine overall risk acceptability.

TR 24971 section 8.3 has some approaches to overall benefit-risk analysis. To me, it's more like making a legal case for why you believe the benefits outweigh the risks.

I was not referring to overall residual risk. I am more talking about assessing the risk of any given line item.. In the example I give, I'm saying what if a single line item (of a given hazard situation) leads to 3 separate "Major"-tier harms. If you assess them individually against whatever criteria you may conclude that there is not much risk. However, if you look at them collectively, it could push the overall probability of "Major"-tier harm into the next probability tier. My point is that I'd think you may want to look at when individually assessing a Hazardous Situation..... In other words, if there's a single Hazardous Situation that can lead to 50 different harms, but each individual harm is weighed by its severity/probability, you may conclude 50 times that the risk is low. But if you take a step back and realize that hazardous situation can lead to a 50x chance of harm compared to any given harm, you would surely want to do something to address it?

Or are you basically saying, just assess each line individually (i.e. probability/severity of specific harm.. ignore whether there are other harms associated with the same hazardous situation), and then look at what I am saying when you do the overall residual risk assessment (i.e. "each individual harm is mitigated, but this one hazardous situation looks really ugly and needs to be addressed")

 

[Tidge]

Or are you basically saying, just assess each line individually (i.e. probability/severity of specific harm.. ignore whether there are other harms associated with the same hazardous situation), and then look at what I am saying when you do the overall residual risk assessment (i.e. "each individual harm is mitigated, but this one hazardous situation looks really ugly and needs to be addressed")

The "individual lines" should be about risks, not harms. Risks need to be acceptable (enough) and it should be documented that benefits outweigh whatever risks there are.

It's not really possible to mitigate harms, but it is possible to mitigate the risks that lead to harms.

 

[stm55]

When dealing with the probability of occurrence of any event, we must use the rules of probability. Sadly too many people are completely ignorant of how probability actually works. (Note that probability is real in real life while inferential statistics is based on theoretical models that rarely exist in real life.)

The answer to your question lies in probability mathematics. This is not a trivial thing to understand. I always remember this basic tenant before selecting the appropriate probability formula: the more things that can go wrong, the more things that will actually go wrong…chew on that awhile before you start to learn probability. (Let me give you a hint: more things that can go wrong will not dilute your probability that something will go wrong. If it does you selected the wrong probability formula)

I will also note the underlying flaw in most probability calculations is the initial estimate of the probability of occurrence of each unique event. For example how do you know that event A has a 1 in 10,000 probability of occurrence? The first question is 10,000 what? The second thing is how did you determine the numerator? Did you pull it out of your hopeful biased subjective anatomy? Or is it based on empirical and objective data? A real example is that aerospace engineers estimated that the probability that a catastrophic shrapnel event would hit the one area where all hydraulic lines came together resulting in complete loss of hydraulics during flight as 1 in a billion. They never stated what the billion things were. And in fact it had occurred 4 times since the estimate was made. (Look up United Airlines flight 232, the Sioux City Crash Landing)

I appreciate these points, but I am struggling to connect them to my specific question. Your "hint" I think is relevant to what I am asking... If you are calculating the PoH of a specific Hazardous Situation, you shouldnt arrive at a lower probability if you look at individual harms separately--- this is why I would propose adding up all harms that are within the same severity tier. (i.e. if P(Harm1 given HazSit1)=.1 and P(Harm2 given HazSit1)=.1 and P(Harm3 given HazSit1)=.1 AND they are all distinct outcomes that dont overlap..... I would think you'd want to add them somehow to realize that Hazardous Situation can lead to harm 30% of the time, not 10%-- just in case your threshold for implementing actions was somewhere between them)