Page 75 - Safety Risk Management for Medical Devices

54 Safety Risk Management for Medical Devices

phases of the product development process, and later update the RMP to
include the remaining phases.
2. Overview of the System
• Describe the System, its function, its elements, indications, intended use,
user, and use environment.
• Identify what is included in the analysis. It’s a common mistake to exceed
the scope of analysis and include peripheral devices that are not part of the
System in the analysis.
3. State your risk management strategy
• What’s your main strategy to make your System as safe as possible? Examples:
2 For a therapy-advisory System, you may choose to keep the physi-
cian in the decision-making loop.
2 For a deep brain stimulator, you may require the use of accurate
navigation in the brain to avoid causing brain hemorrhage during the
implant surgery
4. List your planned risk management activities
• Examples: PHA, Fault Tree Analysis, FMEA, Benefit risk analysis, etc.
5. Identify any special tools, such as FTA software, customized software, etc.
6. Identify people/roles who have responsibility for risk management activities, and
their authorities. Include who will be responsible for the maintenance of the RMF.
7. Spell out the requirements for review of risk management activities.
8. Define the risk acceptance criteria.
9. Describe the verification activities and deliverables. This includes both verifi-
cation of implementation of the Risk Controls, and verification of effective-
ness of the Risk Controls.
10. Describe how risk management will affect other aspects of product development
process such as sample size determination, production acceptance criteria, etc.
11. Describe how production and postproduction information will be captured
and fed back into the risk management process.

The above list makes for a good RMP. However, the minimum requirements for
the RMP per ISO 14971 [3,7] are items 1, 2, 6, 7, 8, 9, and 11.

11.3.1 Criteria for risk acceptability

ISO 14971 [3,7] clause 3.2 requires top management to define and document the pol-
icy for establishing and reviewing the criteria for risk acceptability. The policy should
ensure that the criteria:
a) are based upon applicable national or regional regulations
b) are based upon relevant international standards
c) take into account available information such as the generally accepted state-of-
the-art (SOTA) and known stakeholder concerns