Page 70 - Safety Risk Management for Medical Devices

CHAPTER 11

Risk Management Process

Abstract
ISO 14971 requires that the manufacturer have a documented process for risk management, and
provide the specifications for such a process. However, the Standard does not provide a process—
that is left up to the manufacturer. In this chapter a risk management process is presented, and
expounded. One important aspect of any risk management process is the criteria for risk acceptabil-
ity, which must be identified in the Risk Management Plan.
Keywords: Risk Management Process; management responsibilities; risk management file; risk manage-
ment plan; criteria for risk acceptability; clinical hazards list; harms assessment list

ISO 14971 [3,7] requires that the manufacturer have a documented process for risk
management, and provide the specifications for such a process. However, the Standard
does not provide a process—that is left up to the manufacturer.
If risk analyses for a similar medical device are available, relevant, and adequate,
they can and should be applied to the analysis of the subject medical device.
The BXM method uses a process that is depicted in Fig. 11.1. In broad terms, it includes
Hazard identification, risk estimation, risk control, risk evaluation, and monitoring.
This process is applicable for:

• each new device, or derivative device
• new indications for an existing device
• each change (in a part) of a released device
• each change (in a part) of a realization process of a released device, including
changes to suppliers/manufacturing sites
• discovery of mislabeled or nonconforming product
• Corrective and Preventive Actions (CAPA) events with potential risk to patient
safety
The process starts with formation of the Risk Management File (RMF; see
Section 11.2), and writing a Risk Management Plan (RMP; see Section 11.3). It
would be beneficial to determine the safe-state(s) of your medical device, if any. This
would help both in the design and in the risk management decisions. Next, a
Preliminary Hazard Analysis (PHA) is done (see Section 12.2). Thereafter, the project
transitions to the design and development phase.
As designs become available Failure Modes and Effects Analyses (FMEAs) are per-
formed and iterated throughout the design and development phase (see Section 12.4).
Safety Risk Management for Medical Devices r 2018 Elsevier Ltd.
DOI: https://doi.org/10.1016/B978-0-12-813098-8.00011-8 All rights reserved. 49