Every medical device carries some risk. ISO 14971:2019, Medical devices, application of risk management to medical devices, is the international standard for handling it. The US FDA recognises it. The FDA describes it as a systematic approach that sets out the terms, the principles and a process for the risk management of medical devices, including software as a medical device and in vitro diagnostic devices. This article walks through the core chain of ideas: hazard, hazardous situation, harm, and the controls that act on them.
Three words, in a fixed order
The FDA training material explains the vocabulary as a sequence. A hazard is a potential source of harm. A hazardous situation is a circumstance in which people, property or the environment are exposed to one or more hazards. Harm is injury or damage to the health of people, or damage to property or the environment. A hazard on the bench hurts nobody. Harm needs a hazardous situation first, and the situation needs a sequence of events to bring it about.
Two more words turn this into a number. Severity measures the possible consequences of a hazard, usually stated as the severity of the harm. Risk, in the definition the FDA quotes from the standard, is the combination of the probability of occurrence of harm and the severity of that harm. The probability has two steps. The hazardous situation has to occur, and then it has to lead to harm. In the FDA's driving example, the speed, the size of the vehicle and its safety features change how severe the harm is.
The 2019 edition also defines benefit: the positive impact or desirable outcome of using a device on the health of an individual, or a positive impact on patient management or public health. The definition matters later, when the remaining risk is weighed.
Finding the hazards
The FDA training material names three techniques that support the process. Annex B of ISO/TR 24971:2020, the guidance document for the standard, describes these and other techniques.
| Technique | Direction | Typical use |
|---|---|---|
| Preliminary hazard analysis | Starts from what the device is and does | Early in development, when little is known. Lists hazards, hazardous situations and harms, and helps to rank the hazards. |
| Fault tree analysis | Top down, from a hazardous situation | Finds the single faults, and the common faults, that lead to it. Drawn as a tree with AND and OR connectors. |
| Failure mode and effects analysis | Bottom up, from a cause | Asks what happens if a part, a process step or a user action goes wrong. It can cover manufacturing and use error. |
A preliminary hazard analysis can begin from the materials, the equipment, the use environment and the interfaces between parts, and from published literature and standards. For each hazard, record the hazardous situation, the possible harm, the severity, the probability, and the risk control measures you can think of. The FDA advises manufacturers to use more than one risk management technique.
Controls, in order of preference
Once a risk is judged too high, it is controlled. The FDA human factors guidance lists the control options in ISO 14971 in order of preference and effectiveness. It gives its examples for use-related hazards.
- Inherent safety by design. Remove the hazard or the chance of the error. Examples in the guidance: connectors that cannot be joined to the wrong part, removing a feature that can be chosen by mistake, and automating a step that users tend to get wrong.
- Protective measures in the device itself or in the manufacturing process. Examples: guards, interlocks, warning screens and alerts, such as a low battery alert.
- Information for safety. Warnings in the manual, and training. The guidance says these are not the most preferred, because they rely on the user to remember or look up the information, the labelling may not be at hand during use, and training fades with time.
Design changes are generally the most effective route. The guidance adds a practical point: unless a design change removes the possibility of the error completely, the labelling and training should still be updated to address the hazard. It also asks that the strategies be tested, to confirm that the use-related hazards were addressed and that no new hazards were introduced.
Residual risk and benefit-risk
Residual risk is the risk that remains after the controls are in place. No device is free of it. The FDA describes a risk acceptability chart as a tool for judging both the initial and the residual risk. Its training material also describes benefit-risk analysis, a technique the FDA uses once all measures to reduce the risk have been applied and only acceptable residual risk remains. It helps decide whether to rework a device or accept it as it is. On the manufacturer's side, the FDA human factors guidance says that where human factors validation testing shows serious use errors persist, a premarket submission has to analyse the results thoroughly and show that further reduction of their likelihood is not possible or practical, and that the benefits of device use outweigh the residual risks.
The risk file does not close at launch
Risk management begins with the idea and continues through the life of the device. An FDA training presentation quotes Clause A.2.10 of ISO 14971:2019 to make the point: modelling cannot replace a real device in the hands of real users. Production and post-production information therefore feeds back into the file. The presentation lists sources on both sides:
- Production: supplier monitoring, process monitoring, inspection and test results, environmental monitoring and audit results.
- Post-production: complaints, customer feedback, adverse events, installation and servicing, clinical studies, scientific literature and media sources. Look at similar devices as well as your own.
Monitoring may reveal hazardous situations nobody foresaw, and it lets the team refine its risk estimates. FDA training material also lists a risk management report as a tool for recording the review of this information.
Common mistakes
- Mixing up hazard and harm. A sharp edge is a hazard. The cut is the harm. The link between them is the hazardous situation.
- Reaching for a warning first. A label is the weakest control on the list. Ask whether the design can change.
- Using one technique only. The FDA advises more than one.
- Treating the file as a design-phase document. Complaints and production data belong in it.
- Not testing the control. A control that was never checked may not work, and may add a new hazard.
Where to start
Begin the hazard analysis early in development. FDA training places the preliminary hazard analysis at the stage when little is known about the design. It lists hazards from the materials, the equipment, the use environment and the interfaces between parts. The FDA also notes that the technique can help identify the essential design outputs.
Sources: US FDA, Application of Risk Management Principles (CDRH Learn training material on ISO 14971:2019, ISO/TR 24971:2020 and risk management techniques); US FDA, Risk Basics for Medical Devices (training transcript); US FDA, Use of Production and Post-Production Information in Risk Management (13 July 2022, an informal FDA presentation that does not necessarily represent the formal position of the FDA); US FDA guidance, Applying Human Factors and Usability Engineering to Medical Devices, sections on risk control options and residual risk. The standard itself is sold by ISO and is not reproduced here. This article is a general guide, not a regulatory determination for any device.