Slide 1 of 45 Implementing a Risk Management

Slide 1 of 45 Implementing a Risk Management Process Compliant with ISO 14971: 2007 & How to Address the Seven Deviations Identified in EN ISO 14971: 2012 December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 2 of 45 “Show me where it’s required” • Clause 7. 1 in ISO 13485 states: “The organization shall establish documented requirements for risk management throughout product realization. Records arising from risk management shall be maintained. ” December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 3 of 45 14971 Plus - http: //bit. ly/Shop. CSA December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 4 of 45 14971 Plus = Standard + Gap + Bonus Tools December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 5 of 45 Bonus Tools in 14971 Plus December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 6 of 45 Top 5 Risk Management Mistakes 1. Not reading the Annexes 2. Using Annex C, Questions 1 -34 as your only form of Hazard Identification 3. Using only some of the tools in Annex G 4. Too much energy spent during design upon identifying P 1 vs. P 2 (see Figure E 1, Annex E) 5. Not updating risk management documentation. December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 7 of 45 Hazard vs. Harm • Clause 2. 3 – Hazard is a “potential source of harm” [ISO/IEC Guide 51: 1999, definition 3. 5] • Clause 2. 2 – Harm is a “physical injury or damage to the health of people, or damage to property or the environment” [ISO/IEC Guide 51: 1999, definition 3. 3] December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 8 of 45 Definition of Risk • Clause 2. 16 – Risk is the “combination of the probability of occurrence of harm and the severity of that harm. ” December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 9 of 45 When are risks reviewed? erin g ine Eng g urin act December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com nuf Adverse Events (Injury & Death) Defects in Manufacturing Trend Data Material Changes Labeling Changes to Instructions Risk Changes in the Intended Use Management Process Changes Customer Complaints Supplier Changes Marketing Supplier Process Changes Design Changes Finance Service Trend Data Corrective Actions & Preventive Actions (CAPA) Ma • • • • Shipping Sales

Slide 10 of 45 Risk Management is a Process 4 – Risk Analysis 5 – Risk Evaluation Risk Assessment 6 – Risk Control Risk Management 7 – Residual Risk Acceptability 8 – Risk Management Report 9 – Production & Post-production Info December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 11 of 45 Overview of BS EN ISO 14971: 2007 • Begins on Page 5 and ends on Page 14 • Key elements I look for when I’m auditing: – Is there an Annual review of effectiveness required? – Is the Risk Management File defined in the procedure? – Does the procedure discuss risk controls and option analysis? – Is the risk of risk controls mentioned? – Is there a requirement for the overall acceptability of residual risks and a risk / benefit analysis? – Does the procedure include collection of post-production information? December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 12 of 45 Mitigation vs. Control • In the 2007 version of ISO 14971, the term “mitigation” was removed. • Mitigation implies elimination of risks, while control implies reducing and monitoring risks. December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 13 of 45 Concept of Product Lifecycle Pilot Phase Design Commercial Release Pre-Production Market Growth Sustaining Obsolesce Post-Production • Clause 2. 7 – Lifecycle is “all phases in the life of a medical device, from the initial conception to final decommissioning and disposal” December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 14 of 45 Risk Management / Design Controls • Clause 7. 3. 2 e) of ISO 13485 states that Risk management shall be an Input into Design & Development • Clause 6. 3 of ISO 14971 requires verification of effectiveness of risk controls • Clause 6. 7 of ISO 14971 requires verification of completeness of risk controls December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 15 of 45 Design Risk Management Tasks Hazard Identification Risk Management Plan Concept Phase DHF Begins December 17 th 2013 Risk Control Option Analysis Risk Assessment Feasibility Phase Risk Control Effectiveness Verification Development Phase Pilot Phase Release Phase Design Transfer Robert Packard, Consultant 15 www. Medical. Device. Academy. com rob@13485 cert. com Product Launch 510(k)

Slide 16 of 45 Design Risk Management Tasks (continued) Risk Management Report Risk / Benefit Analysis Concept Phase DHF Begins December 17 th 2013 Feasibility Phase Development Phase Pilot Phase Release Phase Design Transfer Robert Packard, Consultant 16 www. Medical. Device. Academy. com rob@13485 cert. com Product Launch 510(k)

Slide 17 of 45 2009 Corrections • Annex ZA/ZB/ZC • Flow Diagram Correction December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 18 of 45 MDD Requirements • Annex I, Essential Requirement (ER) 1: – “… any risks which may be associated with their intended use constitute acceptable risks when weighed against the benefits to the patient…” – “This shall include…reducing, as far as possible, the risk of use error due to the ergonomic features of the device and the environment in which the device is intended to be used (design for patient safety)…” December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 19 of 45 Deviation #6 in 2012 EN Version Deviation as to the first risk control option • Clause 6. 2 of ISO 14971 requires the manufacturer to “use one or more of the following risk control options in the priority order listed: (a) inherent safety by design. . . ” • ER 2 of the MDD requires the manufacturer to “eliminate or reduce risks as far as possible (inherently safe design and construction)" December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 20 of 45 MDD Requirements • Annex I, Essential Requirement (ER) 2: – “In selecting the most appropriate solutions, the manufacturer must apply the following principles in the following order: • eliminate or reduce risks as far as possible (inherently safe design and construction), • where appropriate take adequate protection measures including alarms if necessary, in relation to risks that cannot be eliminated, • inform users of the residual risks due to any shortcomings of the protection measures adopted. ” December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 21 of 45 Proposed Regulations • Annex I, Essential Requirement (ER) 2: – “To reduce risks, the manufacturer shall manage the risks so that the residual risk associated with each hazard as well as the overall residual risk is judged acceptable. The manufacturer shall apply the following principles in the priority order listed: a) identify known or foreseeable hazards and estimate the associated risks arising from the intended use and foreseeable misuse; b) eliminate risks as far as possible through inherently safe design and manufacture; c) reduce as far as possible the remaining risks by taking adequate protection measures, including alarms; and d) provide training to users and/or inform users of any residual risks. ” December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 22 of 45 Management Responsibilities Clause 3. 2 • Commitment by top management to risk management process – Adequate Resources – Qualified personnel for risk management • Policy for determining criteria for risk acceptability – Criteria based upon applicable regulations and International Standards – Accounts for accepted state of the art and stakeholder concerns • Review the suitability of the risk management process to ensure continuing effectiveness – May be part of the quality management system review December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 23 of 45 Risk Management Plan Clause 3. 4 • The plan shall include at least the following: – the scope of the planned risk management activities, identifying and describing the medical device and the life-cycle phases for which each element of the plan is applicable – assignment of responsibilities and authorities – requirements for review of risk management activities – criteria for risk acceptability, based on the manufacturer's policy for determining acceptable risk, including criteria for accepting risks when the probability of occurrence of harm cannot be estimated – verification activities – activities related to collection and review of relevant production and post-production information • For each risk management plan the manufacturer should choose appropriate risk acceptability criteria – May implement a matrix indicating which combinations of probability of harm and severity of harm are acceptable or unacceptable • The risk management plan is part of the risk management file – Record of the changes shall be maintained in the risk management file December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 24 of 45 Risk Management File Clause 3. 5 • File for each medical device • The risk management file shall provide traceability for each identified hazard to: – the risk analysis – the risk evaluation – the implementation and verification of the risk control measures – the assessment of the acceptability of any residual risk(s) December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 25 of 45 Hazard Identification Clause 4. 3 • Documentation on known and foreseeable hazards associated with the medical device in both normal and fault conditions • Maintained in the risk management file December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 26 of 45 Deviations #1 in 2012 EN Version Treatment of Negligible Risks Must implement risk controls for all risks. December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 27 of 45 Risk Estimation Clause 4. 4 • Reasonably foreseeable events that can result in a hazardous situation shall be considered and the resulting hazardous situation(s) shall be recorded – • For each identified hazardous situation, the associated risk(s) shall be estimated using available information or data. – • • • Hazardous situations can arise from slips, lapses and mistakes Where the probability of the occurrence of harm cannot be estimated, the possible consequences shall be listed for use in risk evaluation and risk control Any system used for qualitative or quantitative categorization of probability of occurrence of harm or severity of harm shall be recorded in the risk management file Risk estimation can be quantitative or qualitative Information or data for estimating risks can be obtained, for example, from: – – – – published standards scientific technical data field data from similar medical devices already in use, including published reported incidents usability tests employing typical users clinical evidence results of appropriate investigations expert opinion external quality assessment schemes December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 28 of 45 P 1 & P 2 from Annex E December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 29 of 45 Deviation #4 in 2012 EN Version Discretion as to whether a risk-benefit analysis needs to take place December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 30 of 45 Risk Evaluation Clause 5 Risks are Acceptable? (see Clause 3. 2) December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 31 of 45 Deviation #5 in 2012 EN Version Discretion as to the risk control options/measures • Risk Controls options shall be implemented regardless of severity or probability of occurrence December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 32 of 45 Risk Control Option Analysis Clause 6. 2 • The manufacturer shall identify risk control measures that are appropriate for reducing the risks to an acceptable level – Risk control measures can reduce the severity of the harm or reduce the probability of occurrence of the harm, or both • The manufacturer shall use one or more of the following risk control options in the priority order listed: – inherent safety by design – protective measures in the medical device itself or in the manufacturing process – information for safety • The risk control measures selected shall be recorded in the risk management file • If, during risk control option analysis, the manufacturer determines that required risk reduction is not practicable, the manufacturer shall conduct a Risk/Benefit Analysis of the residual risk (see Clause 6. 5) December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 33 of 45 Implementing Risk Controls Clause 6. 3 • The manufacturer shall implement the risk control measure(s) selected (see Clause 6. 2) • Implementation of each risk control measure shall be verified – Verification shall be recorded in the risk management file • The effectiveness of the risk control measure(s) shall be verified and the results shall be recorded in the risk management file – Verification of effectiveness can include validation activities December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 34 of 45 Deviation #3 in 2012 EN Version Risk reduction “as far as possible” (ALAP) vs. “as low as reasonably practicable” (ALARP) December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 35 of 45 Residual Risk Evaluation Clause 6. 4 Clinical Evidence Residual Risk Pre-Market Phase PMS & PMCF Studies Quantify Residual Risks December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 36 of 45 Risk/Benefit Analysis & Evaluation of Overall Acceptability of Risk Clause 6. 5 • If the residual risk is not acceptable using the criteria established in the risk management plan and further risk control is not practicable, the manufacturer may gather and review data and literature to determine if the medical benefits of the intended use outweigh the residual risk – If the medical benefits do not outweigh the residual risk, then the risk remains unacceptable – If the medical benefits outweigh the residual risk, then proceed to Clause 6. 6 • The manufacturer shall decide which information for safety is necessary to disclose the residual risk • Results shall be recorded in the risk management file Clause 7 • After all risk control measures have been implemented and verified, the manufacturer shall decide if the overall residual risk posed by the medical device is acceptable using the criteria defined in the risk management plan • If the overall residual risk is not judged acceptable, perform a Risk/Benefit Analysis (see Clause 6. 5 above) • Results of the overall residual risk evaluation shall be recorded in the risk management file December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 37 of 45 Deviation #2 in 2012 EN Version Discretionary power of manufacturers as to the acceptability of risks • All Risks shall be included in a risk / benefit analysis—not just the risks above a certain threshold. December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 38 of 45 Risks arising from Risk Control Measures Clause 6. 6 • The effects of the risk control measures shall be reviewed with regard to: – the introduction of new hazards or hazardous situations – whether the estimated risks for previously identified hazardous situations are affected by the introduction of the risk control measures • Any new or increased risks shall be managed • Results of this review shall be recorded in the risk management file December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 39 of 45 Deviation #7 in 2012 EN Version Information of the users influencing the residual risk • No risk reduction shall be attributed to information provided to the user December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 40 of 45 Completeness of Risk Control Clause 6. 7 • The manufacturer shall ensure that the risk(s) from all identified hazardous situations have been considered • The results of this activity shall be recorded in the risk management file December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 41 of 45 Risk Management Report Clause 8 • Prior to release for commercial distribution of the medical device, the manufacturer shall carry out a review of the risk management process. This review shall at least ensure that: – the risk management plan has been appropriately implemented – the overall residual risk is acceptable – appropriate methods are in place to obtain relevant production and post-production information • The results of this review shall be included in the risk management file • The responsibility for review should be assigned in the risk management plan to persons having the appropriate authority December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 42 of 45 Clause 9 Production & Post-Production Information Post-Market Surveillance Risk Analysis Clinical Evaluation Post-Market Surveillance (PMS) Report Identifies Areas Requiring Changes Instructions for Use (IFU) Needs to Reflect Information Found in Risk Management Report (RMR) & Clinical Evaluation Report (CER) The Lifecycle Loop December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 43 of 45 Other Requirements • Residual Risks May Require a Post-Market Clinical Follow-up (PMCF) Study as required by Annex X, 1. 1 c of the MDD (MEDDEV 2. 12/2 rev 2) • Clinical Evaluations shall conclude that “any risks associated with the use of the device are acceptable when weighed against the benefits to the patient. ” (MEDDEV 2. 7. 1 rev 3) December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 44 of 45 Q&A December 17 th 2013 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com

Slide 45 of 45 Do you need help with your Risk Management Process? rob 13485 rob@13485 cert. com Rob Packard December 17 th 2013 +1. 802. 258. 1881 Robert Packard, Consultant www. Medical. Device. Academy. com rob@13485 cert. com