Risk Management Specialist

Risk Management Specialist

ISO 14971:2019 risk management implementation throughout the medical device lifecycle.

Table of Contents

Risk Management Planning Workflow Risk Analysis Workflow Risk Evaluation Workflow Risk Control Workflow Post-Production Risk Management Risk Assessment Templates Decision Frameworks Tools and References

Risk Management Planning Workflow

Establish risk management process per ISO 14971.

Workflow: Create Risk Management Plan

Define scope of risk management activities: Medical device identification Lifecycle stages covered Applicable standards and regulations Establish risk acceptability criteria: Define probability categories (P1-P5) Define severity categories (S1-S5) Create risk matrix with acceptance thresholds Assign responsibilities: Risk management lead Subject matter experts Approval authorities Define verification activities: Methods for control verification Acceptance criteria Plan production and post-production activities: Information sources Review triggers Update procedures Obtain plan approval Establish risk management file Validation: Plan approved; acceptability criteria defined; responsibilities assigned; file established

Risk Management Plan Content

SectionContentEvidenceScopeDevice and lifecycle coverageScope statementCriteriaRisk acceptability matrixRisk matrix documentResponsibilitiesRoles and authoritiesRACI chartVerificationMethods and acceptanceVerification planProduction/Post-ProductionMonitoring activitiesSurveillance plan

Risk Acceptability Matrix (5x5)

Probability \ SeverityNegligibleMinorSeriousCriticalCatastrophicFrequent (P5)MediumHighHighUnacceptableUnacceptableProbable (P4)MediumMediumHighHighUnacceptableOccasional (P3)LowMediumMediumHighHighRemote (P2)LowLowMediumMediumHighImprobable (P1)LowLowLowMediumMedium

Risk Level Actions

LevelAcceptableAction RequiredLowYesDocument and acceptMediumALARPReduce if practicable; document rationaleHighALARPReduction required; demonstrate ALARPUnacceptableNoDesign change mandatory

Risk Analysis Workflow

Identify hazards and estimate risks systematically.

Workflow: Conduct Risk Analysis

Define intended use and reasonably foreseeable misuse: Medical indication Patient population User population Use environment Select analysis method(s): FMEA for component/function analysis FTA for system-level analysis HAZOP for process deviations Use Error Analysis for user interaction Identify hazards by category: Energy hazards (electrical, mechanical, thermal) Biological hazards (bioburden, biocompatibility) Chemical hazards (residues, leachables) Operational hazards (software, use errors) Determine hazardous situations: Sequence of events Foreseeable misuse scenarios Single fault conditions Estimate probability of harm (P1-P5) Estimate severity of harm (S1-S5) Document in hazard analysis worksheet Validation: All hazard categories addressed; all hazards documented; probability and severity assigned

Hazard Categories Checklist

CategoryExamplesAnalyzedElectricalShock, burns, interference☐MechanicalCrushing, cutting, entrapment☐ThermalBurns, tissue damage☐RadiationIonizing, non-ionizing☐BiologicalInfection, biocompatibility☐ChemicalToxicity, irritation☐SoftwareIncorrect output, timing☐Use ErrorMisuse, perception, cognition☐EnvironmentEMC, mechanical stress☐

Analysis Method Selection

SituationRecommended MethodComponent failuresFMEASystem-level failureFTAProcess deviationsHAZOPUser interactionUse Error AnalysisSoftware behaviorSoftware FMEAEarly design phasePHA

Probability Criteria

LevelNameDescriptionFrequencyP5FrequentExpected to occur>10⁻³P4ProbableLikely to occur10⁻³ to 10⁻⁴P3OccasionalMay occur10⁻⁴ to 10⁻⁵P2RemoteUnlikely10⁻⁵ to 10⁻⁶P1ImprobableVery unlikely<10⁻⁶

Severity Criteria

LevelNameDescriptionHarmS5CatastrophicDeathDeathS4CriticalPermanent impairmentIrreversible injuryS3SeriousInjury requiring interventionReversible injuryS2MinorTemporary discomfortNo treatment neededS1NegligibleInconvenienceNo injury See: references/risk-analysis-methods.md

Risk Evaluation Workflow

Evaluate risks against acceptability criteria.

Workflow: Evaluate Identified Risks

Calculate initial risk level from probability × severity Compare to risk acceptability criteria For each risk, determine: Acceptable: Document and accept ALARP: Proceed to risk control Unacceptable: Mandatory risk control Document evaluation rationale Identify risks requiring benefit-risk analysis Complete benefit-risk analysis if applicable Compile risk evaluation summary Validation: All risks evaluated; acceptability determined; rationale documented

Risk Evaluation Decision Tree

Risk Estimated │ ▼ Apply Acceptability Criteria │ ├── Low Risk ──────────► Accept and document │ ├── Medium Risk ───────► Consider risk reduction │ │ Document ALARP if not reduced │ ▼ │ Practicable to reduce? │ │ │ Yes──► Implement control │ No───► Document ALARP rationale │ ├── High Risk ─────────► Risk reduction required │ │ Must demonstrate ALARP │ ▼ │ Implement control │ Verify residual risk │ └── Unacceptable ──────► Design change mandatory Cannot proceed without control

ALARP Demonstration Requirements

CriterionEvidence RequiredTechnical feasibilityAnalysis of alternative controlsProportionalityCost-benefit of further reductionState of the artComparison to similar devicesStakeholder inputClinical/user perspectives

Benefit-Risk Analysis Triggers

SituationBenefit-Risk RequiredResidual risk remains highYesNo feasible risk reductionYesNovel deviceYesUnacceptable risk with clinical benefitYesAll risks lowNo

Risk Control Workflow

Implement and verify risk control measures.

Workflow: Implement Risk Controls

Identify risk control options: Inherent safety by design (Priority 1) Protective measures in device (Priority 2) Information for safety (Priority 3) Select optimal control following hierarchy Analyze control for new hazards introduced Document control in design requirements Implement control in design Develop verification protocol Execute verification and document results Evaluate residual risk with control in place Validation: Control implemented; verification passed; residual risk acceptable; no unaddressed new hazards

Risk Control Hierarchy

PriorityControl TypeExamplesEffectiveness1Inherent SafetyEliminate hazard, fail-safe designHighest2Protective MeasuresGuards, alarms, automatic shutdownHigh3InformationWarnings, training, IFULower

Risk Control Option Analysis Template

• RISK CONTROL OPTION ANALYSIS
• Hazard ID: H-[XXX]
• Hazard: [Description]
• Initial Risk: P[X] × S[X] = [Level]
• OPTIONS CONSIDERED:
• | Option | Control Type | New Hazards | Feasibility | Selected |
• |--------|--------------|-------------|-------------|----------|
• | 1 | [Type] | [Yes/No] | [H/M/L] | [Yes/No] |
• | 2 | [Type] | [Yes/No] | [H/M/L] | [Yes/No] |
• SELECTED CONTROL: Option [X]
• Rationale: [Justification for selection]
• IMPLEMENTATION:
• Requirement: [REQ-XXX]
• Design Document: [Reference]
• VERIFICATION:
• Method: [Test/Analysis/Review]
• Protocol: [Reference]
• Acceptance Criteria: [Criteria]

Risk Control Verification Methods

MethodWhen to UseEvidenceTestQuantifiable performanceTest reportInspectionPhysical presenceInspection recordAnalysisDesign calculationAnalysis reportReviewDocumentation checkReview record

Residual Risk Evaluation

After ControlActionAcceptableDocument, proceedALARP achievedDocument rationale, proceedStill unacceptableAdditional control or design changeNew hazard introducedAnalyze and control new hazard

Post-Production Risk Management

Monitor and update risk management throughout product lifecycle.

Workflow: Post-Production Risk Monitoring

Identify information sources: Customer complaints Service reports Vigilance/adverse events Literature monitoring Clinical studies Establish collection procedures Define review triggers: New hazard identified Increased frequency of known hazard Serious incident Regulatory feedback Analyze incoming information for risk relevance Update risk management file as needed Communicate significant findings Conduct periodic risk management review Validation: Information sources monitored; file current; reviews completed per schedule

Information Sources

SourceInformation TypeReview FrequencyComplaintsUse issues, failuresContinuousServiceField failures, repairsMonthlyVigilanceSerious incidentsImmediateLiteratureSimilar device issuesQuarterlyRegulatoryAuthority feedbackAs receivedClinicalPMCF dataPer plan

Risk Management File Update Triggers

TriggerResponse TimeActionSerious incidentImmediateFull risk reviewNew hazard identified30 daysRisk analysis updateTrend increase60 daysTrend analysisDesign changeBefore implementationImpact assessmentStandards updatePer transition periodGap analysis

Periodic Review Requirements

Review ElementFrequencyRisk management file completenessAnnualRisk control effectivenessAnnualPost-market information analysisQuarterlyRisk-benefit conclusionsAnnual or on new data

Risk Assessment Templates

→ See references/risk-assessment-templates.md for details

Risk Control Selection

What is the risk level? │ ├── Unacceptable ──► Can hazard be eliminated? │ │ │ Yes─┴─No │ │ │ │ ▼ ▼ │ Eliminate Can protective │ hazard measure reduce? │ │ │ Yes─┴─No │ │ │ │ ▼ ▼ │ Add Add warning │ protection + training │ └── High/Medium ──► Apply hierarchy starting at Level 1

New Hazard Analysis

QuestionIf YesIf NoDoes control introduce new hazard?Analyze new hazardProceedIs new risk higher than original?Reject control optionAcceptable trade-offCan new hazard be controlled?Add controlReject control option

Risk Acceptability Decision

ConditionDecisionAll risks LowAcceptableMedium risks with ALARPAcceptableHigh risks with ALARP documentedAcceptable if benefits outweighAny Unacceptable residualNot acceptable - redesign

Scripts

ToolPurposeUsagerisk_matrix_calculator.pyCalculate risk levels and FMEA RPNpython risk_matrix_calculator.py --help Risk Matrix Calculator Features: ISO 14971 5x5 risk matrix calculation FMEA RPN (Risk Priority Number) calculation Interactive mode for guided assessment Display risk criteria definitions JSON output for integration

References

DocumentContentiso14971-implementation-guide.mdComplete ISO 14971:2019 implementation with templatesrisk-analysis-methods.mdFMEA, FTA, HAZOP, Use Error Analysis methods

Quick Reference: ISO 14971 Process

StageKey ActivitiesOutputPlanningDefine scope, criteria, responsibilitiesRisk Management PlanAnalysisIdentify hazards, estimate riskHazard AnalysisEvaluationCompare to criteria, ALARP assessmentRisk EvaluationControlImplement hierarchy, verifyRisk Control RecordsResidualOverall assessment, benefit-riskRisk Management ReportProductionMonitor, review, updateUpdated RM File

Related Skills

SkillIntegration Pointquality-manager-qms-iso13485QMS integrationcapa-officerRisk-based CAPAregulatory-affairs-headRegulatory submissionsquality-documentation-managerRisk file management