ISO 13485 from zero, episode three: risk management that runs through the whole system.
ISO Cloud Consulting editorial teamIn a medical device company risk management is not a register updated once a year. Keep business risk and product risk separate, write a risk management plan with acceptability criteria for each device family, analyze hazards to harms, control and verify, then feed risk into design, suppliers, validation and complaints.
Why does risk run through the whole system?
This is episode three of ISO 13485 from zero. With the scope and the documents in place, we turn to risk management. In a medical device company, risk is not a register you update once a year. It runs through every process, and auditors expect to see it there.
What is the difference between process risk and product risk?
ISO 13485 asks for a risk-based approach to controlling the processes of the quality system, such as how tightly you control a supplier or how much validation a piece of software needs. Separately, product risk management, under ISO 14971, deals with the risks the device itself poses to patients, users and others.
Many companies blur the two, and end up with a business risk register that says nothing about device safety. You need both, and they should be clearly distinct.
What goes in a risk management plan?
Begin with a plan for each device or family. It sets the scope, the lifecycle stages covered, who is responsible, how risks will be estimated and evaluated, and, crucially, the criteria for deciding whether a risk is acceptable.
Those criteria must come from your policy for risk acceptability, approved by top management. Without written criteria, every decision about acceptable risk becomes an argument.
How do you work from hazards to harms?
Identify the characteristics of the device that could affect safety, and the hazards that follow. Then think through the sequences of events that could lead from each hazard to a hazardous situation and then to harm. Estimate the probability and the severity of each harm.
Template for this step: the risk management plan, hazard register and report templates are in the ISO 14971 Risk Management File Kit ($129).
Use real information where you have it: complaints about similar devices, published data, your own test results. This analysis is the core of the risk file.
How do you control and verify risks?
Where a risk is not acceptable, reduce it, in a fixed order of priority. First, inherently safe design. Then protective measures in the device or the manufacturing process. Then information for safety, such as warnings and instructions. Labeling alone is the last resort, not the first.
Then verify that each control was implemented and that it works. Evaluate the residual risk, and finally the overall residual risk against the benefits of the device.
How do you put risk into the other processes?
Design inputs should include risk controls. Supplier control should be proportionate to the risk a supplier's product carries. Process validation should focus on the processes where failure creates harm. Complaints and corrective actions should check whether they reveal new hazards or a higher frequency of harm.
When every procedure asks the question, does this affect the risk file, the file stays alive.
By the end of this episode's work you should have a risk acceptability policy, a risk management plan for each device family, a first hazard analysis, and a list of the procedures that will feed the risk file. Next episode: design controls.
Where can you get a risk management file template?
The ISO 14971 Risk Management File Kit takes you from plan to report, with linked registers and workbooks. See also the risk management collection, the ISO 14971 risk management hub and our ISO 13485 consulting services.
