Application of Risk Management

Principles for Medical Devices

Tonya A. Wilbon
Branch Chief
Postmarket and Consumer Branch
Division of Industry and Consumer Education
Office of Communication and Education
Center for Devices and Radiological Health
U.S. Food and Drug Administration
Risk
Management
Activities

2
 Learning Objectives
• Discuss the reasons for conducting risk management
activities for medical devices
• Identify when to use risk management activities for
medical devices
• Explain techniques for the application of risk
management principles

3
 Reasons for Conducting
Risk Management Activities

4
Why Conduct
Risk
Management
Activities?

5
 Why conduct risk management activities?

To ensure safety of the device throughout the product lifecycle

To identify device design problems prior to distribution

Risk analysis is a regulatory requirement

FDA regulatory submissions require risk analysis information

6
 Why conduct risk management activities?

To reduce the possibility of failure of the device

To identify hazards with use of the device

To evaluate the risk with use of the device and decide whether to
use the device or not

It is the right thing to do

7
When To Use Risk Management
Activities for Medical Devices

8
 When to Use
Risk Management Activities
• When implementing a quality system to:
– Conduct risk analysis, where appropriate, as required
– Make risk-based decisions including:
 Identifying design outputs essential for proper functioning of device
 Defining type and extent of control to be exercised over product,
services, suppliers, contractors, and consultants

21 Code of Federal Regulations, Part 820 (21 CFR 820)

9
 When to Use
Risk Management Activities
• When implementing a quality system to:
– Make risk-based decisions including:
Describing necessary process controls
Documenting major equipment used for validated processes,
where appropriate
Determining necessary approvals for in-process acceptance
activities
21 CFR 820

10
 When to Use
Risk Management Activities
• When implementing a quality system to:
– Make risk-based decisions including:
Determining need for investigation of nonconforming product
Conducting internal audits
Identifying valid statistical techniques required for
establishing, controlling, and verifying the acceptability of
process capability and product characteristics
21 CFR 820

11
 When to Use
Risk Management Activities
• By FDA to make risk-based decisions related to:
– Device classifications
– Recall classifications
– Inspectional decisions
– Enforcement activities 21 CFR 820

12
 Application of
Risk Management Principles

13
 Risk Management Process
• AAMI/ANSI/ISO* 14971:2019 Medical devices-Application
of risk management to medical devices (ISO 14971)
- Used to conduct risk analysis activities as required by
regulation
- Systematic approach to conducting risk management
activities

*AAMI =Association for the Advancement of Medical Instrumentation

ANSI = American National Standards Institute
14
ISO = International Organization for Standardization
 Risk Management Process
• AAMI/ISO TR*24971:2020-Medical devices- guidance
on the application of ISO 14971
- Provides guidance on the application of ISO 14971

*AAMI =Association for the Advancement of Medical Instrumentation

ISO = International Organization for Standardization
TR = Technical Report 15
 Risk Management
Process

AAMI/ANSI/ISO 14971:2019
Medical devices- Application of
risk management to medical
devices

16
 Risk Management Techniques
• Preliminary Hazard Analysis (PHA)
• Fault Tree Analysis (FTA)
• Failure Mode and Effects Analysis (FMEA)
• FDA Benefit-Risk Analysis

17
 Risk Management Techniques
Preliminary Hazard Analysis (PHA)
• Used in risk analysis as a means of identifying hazards
and hazardous situations
– Few device design details known
– Conducted early in device development
– Useful in prioritizing hazards
18
 Risk Management Techniques
Preliminary Hazard Analysis (PHA)
• List possible hazards
– Brainstorm for possible hazards
– Use previously published literature
– Use information in international standards

19
 Risk Management Techniques
Preliminary Hazard Analysis
# Hazard Hazardous Harm Severity Probability Risk
situation control
Patient Doctor Hypoglycemia; S-4 P-3 Redesign
gets believes Patient test; build
incorrect result is suffered a in internal
test accurate seizure control;
result and change
administers chemical
insulin
20
 Risk Management Techniques
Fault Tree Analysis (FTA)
• Used in risk analysis as a means of analyzing hazards
identified
– Top-down method
– Estimate fault probability
– Identify single fault that result in hazardous situations
– Identify common faults that result in hazardous situation
21
 Risk Management Techniques
Failure Mode and Effect Analysis (FMEA)
• Used in risk analysis as a means of identifying and
evaluating individual fault modes
– Bottom-up method
– Starts with causes and works toward effects
– Estimates fault probability
– Identifies single fault that result in hazardous situations
22
 Risk Management Techniques

Failure Mode and Effect Analysis (FMEA)

– Answers the question, “What happens if…?”
– Requires device detail to be known

23
 Risk Management Techniques
FDA Benefit-Risk Analysis
• Used to assess medical device risk once all measures
to reduce the risk have been applied
– Decision to rework or use “as is” a nonconforming
product
– CDRH guidance documents available
Framework for medical device decision making
24
 Risk Management Techniques
FDA Benefit-Risk Analysis
• Considers several factors when assessing benefits and risk
for:
– Determinations in Premarket Approval Application (PMA) and De
Novo classification
– Determining substantial equivalence in Premarket Notifications
[510(k)]
– Determinations for Investigational Device Exemption (IDE)
– Product availability, compliance, and enforcement decisions
25
 FDA Benefit-Risk Analysis
Benefit Factor Considered PMA/De Novo 510(k) Substantial IDE Availability, compliance,
Determination Equivalence Determination Determination and enforcement decisions

Type of benefit X X X

Magnitude of benefit X X X X

Probability or likelihood of X (Probability) X (Probability) X (Probability) X (Likelihood)

participant experiencing one or
more benefit

Duration of effects X X X X

Patient Perspective on Benefit X

Benefit factors for healthcare X

professionals or caregivers
Medical Necessity X
26
 FDA Benefit-Risk Analysis
Risk Factor Considered PMA/De Novo 510(k) Substantial IDE Availability, compliance,
Determination Equivalence Determination Determination and enforcement decisions

Severity of Risk or Harm X X (Harmful events) X X (Harm)

Probability or Likelihood of X (Probability) X (Probability) X (Probability) X (Likelihood)

risk(s) or harmful event

Probability of patient X
experiencing harmful event

Distribution of X
nonconforming devices

Duration of harmful events, X (Harmful X (Harmful events) X (Risks) X (Exposure to population)

risk, or exposure to events)
population

27
 FDA Benefit-Risk Analysis
Risk Factor Considered PMA/De Novo 510(k) Substantial IDE Availability, compliance,
Determination Equivalence Determination Determination and enforcement decisions

False-positive or false- X X X
negative results

Patient tolerance of risk X

Risk factors for healthcare X

professionals or caregivers

Risk management X

Residual risk X

28
 FDA Benefit-Risk Analysis
• Additional factors to consider (not all inclusive):
- Uncertainty
- Patient Impact
- Firm compliance history
- Mitigations
- Postmarket data
- Detectability
- Availability of alternative
- Patient perspectives treatments or diagnostics

29
 Example: Benefit-Risk Analysis
• Product Availability, Compliance, and Enforcement Decision:
– Human chorionic gonadotropin (hCG) device
 Detection of hCG in urine to aid in early detection of pregnancy

 Indicated for over-the-counter (OTC) use

 Healthcare provider noticed higher rate of positive results, but not confirmed positive in blood sample

 Higher rate of false positives than expected

 Malfunction identified in specific lots

 Lay users unable to detect malfunction

 Many other pregnancy test on the market

Factors to Consider Regarding Benefit-Risk in Medical Device Product Availability, Compliance, and Enforcement Decisions - Guidance for
Industry and Food and Drug Administration Staff (fda.gov)
30
 Example: FDA Benefit-Risk Analysis
• Benefits
– Helps patient determine whether patient is pregnant
– Benefit reduced due to potential lack of test accuracy

• Risks
– Unnecessary prenatal care
– Delayed medically necessary treatments

Factors to Consider Regarding Benefit-Risk in Medical Device Product Availability, Compliance, and Enforcement Decisions - Guidance for
Industry and Food and Drug Administration Staff (fda.gov)
31
 Example: FDA Benefit-Risk Analysis
Worksheet Assessment: Factors considered
• Patient tolerance for risk and perspective on benefit
– Patient like having OTC test for pregnancy
– FDA does not have data on patient tolerance

• Mitigation
– Firm did not identify a mitigation to address this risk

• Patient impact
– Impact on patient if device was not available in the marketplace
– Similar devices available without additional risks

Factors to Consider Regarding Benefit-Risk in Medical Device Product Availability, Compliance, and Enforcement Decisions - Guidance for
Industry and Food and Drug Administration Staff (fda.gov)
32
 Example: FDA Benefit-Risk Analysis
• Product availability, compliance, and enforcement decision
– No need to support continued availability of affected lots
 Benefit to patients is low
 Risk moderate due to delay in medically necessary treatment
 Firm notified retailers and distributors to remove affected lots
 Firm submitted report to FDA per 21 CFR 806
 FDA classified action as a Class II recall

Factors to Consider Regarding Benefit-Risk in Medical Device Product Availability, Compliance, and Enforcement Decisions - Guidance for
Industry and Food and Drug Administration Staff (fda.gov)
33
 Other Risk Management Techniques
• Risk Acceptability Chart
– For evaluating risk (initial and residual risk)
• Risk Control Option Analysis
– For controlling risk
• Risk Management Report
– To capture relevant review of production and
postproduction risk information
34
 Summary
• Risk management activities are essential throughout
the product life cycle
• PHA, FTA, FMEA, and FDA Benefit-Risk analysis are
different types of risk management techniques
• Manufacturers should use more than one risk
management technique in their risk management
process
35
 Resources
Slide Cited Resource URL
Number

6, 7 ANSI/AAMI/ISO 14971:2019 Medical www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfStandards/detail.cfm?standard__ident

devices – Applications of risk ification_no=40369
management to medical devices (for purchase from standards organization)

15, 16, 17 21 CFR 820 Quality System Regulation www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?CFRPart=820

19 ANSI/AAMI/ISO 14971:2019 https://www.iso.org/standard/74437.html

Medical devices- Guidance on the (for purchase from standards organization)
application of ISO 14971
20 Factors to Consider Regarding Benefit- https://www.fda.gov/regulatory-information/search-fda-guidance-
Risk in Medical Device Product documents/factors-consider-regarding-benefit-risk-medical-device-product-
Availability, Compliance, and availability-compliance-and
Enforcement Decisions
20 4 CDRH Benefit-Risk Guidance https://www.fda.gov/regulatory-information/search-fda-guidance-documents
documents:
36
 Industry Education:
Three Resources for You
1. CDRH Learn: Multi-Media Industry Education
 Over 200 modules
 Videos, audio recordings, power point presentations, software-based “how to” modules
 Mobile-friendly: access CDRH Learn on your portable devices
www.fda.gov/CDRHLearn

2. Device Advice: Text-Based Education

 Comprehensive regulatory information on premarket and postmarket topics
www.fda.gov/DeviceAdvice

3. Division of Industry and Consumer Education (DICE)

 Contact DICE if you have a question
 Email: [email protected]
 Phone: 1(800) 638-2041 or (301) 796-7100 (Hours: 9 am-12:30 pm; 1 pm-4:30pm EST)
 Web: www.fda.gov/DICE
37
 Your Call To Action
• Identify when to evaluate risk and conduct risk
management activities early
• Identify and utilize resources available for conducting
risk management activities
• Make sure you use the appropriate risk management
technique/tool for managing risk

38
39