Regulatory Open Forum

The Forum, on occasion, includes issues related to risk management. Often these issues suggest a lack of understanding of risk management. I also see these problems in my consulting practice. Typically, companies don't follow the standard as written. Worse, they create unnecessary complexity.

In my opinion, the industry has the sense that "compliance requires complexity". I take the opposite view; simplicity is essential.

In risk management, I see a lot of problems, but they generally fall into two categories: failure to follow the standard and failure to recognize that the standard is the basis for other standards.

ISO 14971:2019 is a process standard. It is well written and describes a simple and straight forward process. The process steps follow in a logical order. Most implementations use an Excel workbook. The column headings should be the process steps in order. The rows are the individual instances; there could be many rows, but each row follows the process.

Before developing the Hazard Analysis, identify the device and its characteristics. Write the Risk Management Plan (or plans) that cover the life cycle of the device.

After completing the Hazard Analysis analyze the overall residual risk, review the process, and release the device to production.

After release to production, monitor the production and post-production information.


The major problems I see in this category are:
Failure to recognize that the Hazard Analysis is not an FMEA or FMECA. A hazard can lead to patient or user harm. The harm can occur either a normal or a fault condition. In contrast, an FMECA is a reliability tool that analyzes single point failures in a failure mode. An FMECA misses half the Hazard Analysis issues (harm in a normal condition) and does not follow the standard.

Failure to identify the sequence of events. Often patient or user harm requires more than one thing to go wrong. This is the sequence of events and is a strong component of accident prevention and investigation. The key to sequence of events is the connection to risk reduction, which should address the sequence steps. In the best case, the risk reduction measure breaks the chain in the sequence.

Confusing risk reduction with mitigation. Risk reduction addresses the severity or probability of the patient or user harm. The methods apply before the harm. Mitigation applies after the harm occurs and reduces it impact on the patient or user. Risk reduction prevents the loss of a body function. Mitigation compensates for the loss should it happen.

Not linking the tools. For example, a risk reduction measure in the manufacturing process should be part of t PFMECA. If the PFMECA shows that a nonconforming product could escape, analyze the effect in the Hazard Analysis.

The second problem is applications of risk management.
There are some standards that require risk management because they deal with patient or user harm. Typically, these standards have a file to collect the associated documentation. These files could be either part of the ISO 14971:2019 Risk Management File or separate files linked to the Risk Management File and its contents.

In each case, implement ISO 14971:2019 as a basis for the specific application. There may be specific files or specific requirements beyond ISO 14971:2019. Determine the file structure, any specific changes to the basic flow, and any specific documents required for the application.

I've identified the following standards and other applications that require risk management.
EU-MDR
EU-IVDR
FDA's guidance documents on changes to a 510(k) device
IEC 60601-1 on medical electrical equipment
IEC 62366-1:2015 on usability engineering
ISO 62304 on software
FDA's guidance documents on pre-market and post-market cyber security
ISO 10993-1:2018 and associated family members on biocompatibility
ISO 22442-1:2015 and associated family members on the use of animal tissue
 

Call to action
When writing about risk management, follow the standard as written. In particular, do not suggest that an FMEA or FMECA satisfies the standard.

Understand the standard and advocate its use as written.

Eschew complexity!

The Forum, on occasion, includes issues related to risk management. Often these issues suggest a lack of understanding of risk management. I also see these problems in my consulting practice. Typically, companies don't follow the standard as written. Worse, they create unnecessary complexity.

In my opinion, the industry has the sense that "compliance requires complexity". I take the opposite view; simplicity is essential.

In risk management, I see a lot of problems, but they generally fall into two categories: failure to follow the standard and failure to recognize that the standard is the basis for other standards.

ISO 14971:2019 is a process standard. It is well written and describes a simple and straight forward process. The process steps follow in a logical order. Most implementations use an Excel workbook. The column headings should be the process steps in order. The rows are the individual instances; there could be many rows, but each row follows the process.

Before developing the Hazard Analysis, identify the device and its characteristics. Write the Risk Management Plan (or plans) that cover the life cycle of the device.

After completing the Hazard Analysis analyze the overall residual risk, review the process, and release the device to production.

After release to production, monitor the production and post-production information.


The major problems I see in this category are:
Failure to recognize that the Hazard Analysis is not an FMEA or FMECA. A hazard can lead to patient or user harm. The harm can occur either a normal or a fault condition. In contrast, an FMECA is a reliability tool that analyzes single point failures in a failure mode. An FMECA misses half the Hazard Analysis issues (harm in a normal condition) and does not follow the standard.

Failure to identify the sequence of events. Often patient or user harm requires more than one thing to go wrong. This is the sequence of events and is a strong component of accident prevention and investigation. The key to sequence of events is the connection to risk reduction, which should address the sequence steps. In the best case, the risk reduction measure breaks the chain in the sequence.

Confusing risk reduction with mitigation. Risk reduction addresses the severity or probability of the patient or user harm. The methods apply before the harm. Mitigation applies after the harm occurs and reduces it impact on the patient or user. Risk reduction prevents the loss of a body function. Mitigation compensates for the loss should it happen.

Not linking the tools. For example, a risk reduction measure in the manufacturing process should be part of t PFMECA. If the PFMECA shows that a nonconforming product could escape, analyze the effect in the Hazard Analysis.

The second problem is applications of risk management.
There are some standards that require risk management because they deal with patient or user harm. Typically, these standards have a file to collect the associated documentation. These files could be either part of the ISO 14971:2019 Risk Management File or separate files linked to the Risk Management File and its contents.

In each case, implement ISO 14971:2019 as a basis for the specific application. There may be specific files or specific requirements beyond ISO 14971:2019. Determine the file structure, any specific changes to the basic flow, and any specific documents required for the application.

I've identified the following standards and other applications that require risk management.
EU-MDR
EU-IVDR
FDA's guidance documents on changes to a 510(k) device
IEC 60601-1 on medical electrical equipment
IEC 62366-1:2015 on usability engineering
ISO 62304 on software
FDA's guidance documents on pre-market and post-market cyber security
ISO 10993-1:2018 and associated family members on biocompatibility
ISO 22442-1:2015 and associated family members on the use of animal tissue
 

Call to action
When writing about risk management, follow the standard as written. In particular, do not suggest that an FMEA or FMECA satisfies the standard.

Understand the standard and advocate its use as written.

Eschew complexity!

The Forum, on occasion, includes issues related to risk management. Often these issues suggest a lack of understanding of risk management. I also see these problems in my consulting practice. Typically, companies don't follow the standard as written. Worse, they create unnecessary complexity.

In my opinion, the industry has the sense that "compliance requires complexity". I take the opposite view; simplicity is essential.

In risk management, I see a lot of problems, but they generally fall into two categories: failure to follow the standard and failure to recognize that the standard is the basis for other standards.

ISO 14971:2019 is a process standard. It is well written and describes a simple and straight forward process. The process steps follow in a logical order. Most implementations use an Excel workbook. The column headings should be the process steps in order. The rows are the individual instances; there could be many rows, but each row follows the process.

Before developing the Hazard Analysis, identify the device and its characteristics. Write the Risk Management Plan (or plans) that cover the life cycle of the device.

After completing the Hazard Analysis analyze the overall residual risk, review the process, and release the device to production.

After release to production, monitor the production and post-production information.


The major problems I see in this category are:
Failure to recognize that the Hazard Analysis is not an FMEA or FMECA. A hazard can lead to patient or user harm. The harm can occur either a normal or a fault condition. In contrast, an FMECA is a reliability tool that analyzes single point failures in a failure mode. An FMECA misses half the Hazard Analysis issues (harm in a normal condition) and does not follow the standard.

Failure to identify the sequence of events. Often patient or user harm requires more than one thing to go wrong. This is the sequence of events and is a strong component of accident prevention and investigation. The key to sequence of events is the connection to risk reduction, which should address the sequence steps. In the best case, the risk reduction measure breaks the chain in the sequence.

Confusing risk reduction with mitigation. Risk reduction addresses the severity or probability of the patient or user harm. The methods apply before the harm. Mitigation applies after the harm occurs and reduces it impact on the patient or user. Risk reduction prevents the loss of a body function. Mitigation compensates for the loss should it happen.

Not linking the tools. For example, a risk reduction measure in the manufacturing process should be part of t PFMECA. If the PFMECA shows that a nonconforming product could escape, analyze the effect in the Hazard Analysis.

The second problem is applications of risk management.
There are some standards that require risk management because they deal with patient or user harm. Typically, these standards have a file to collect the associated documentation. These files could be either part of the ISO 14971:2019 Risk Management File or separate files linked to the Risk Management File and its contents.

In each case, implement ISO 14971:2019 as a basis for the specific application. There may be specific files or specific requirements beyond ISO 14971:2019. Determine the file structure, any specific changes to the basic flow, and any specific documents required for the application.

I've identified the following standards and other applications that require risk management.
EU-MDR
EU-IVDR
FDA's guidance documents on changes to a 510(k) device
IEC 60601-1 on medical electrical equipment
IEC 62366-1:2015 on usability engineering
ISO 62304 on software
FDA's guidance documents on pre-market and post-market cyber security
ISO 10993-1:2018 and associated family members on biocompatibility
ISO 22442-1:2015 and associated family members on the use of animal tissue
 

Call to action
When writing about risk management, follow the standard as written. In particular, do not suggest that an FMEA or FMECA satisfies the standard.

Understand the standard and advocate its use as written.

Eschew complexity!

The Forum, on occasion, includes issues related to risk management. Often these issues suggest a lack of understanding of risk management. I also see these problems in my consulting practice. Typically, companies don't follow the standard as written. Worse, they create unnecessary complexity.

In my opinion, the industry has the sense that "compliance requires complexity". I take the opposite view; simplicity is essential.

In risk management, I see a lot of problems, but they generally fall into two categories: failure to follow the standard and failure to recognize that the standard is the basis for other standards.

ISO 14971:2019 is a process standard. It is well written and describes a simple and straight forward process. The process steps follow in a logical order. Most implementations use an Excel workbook. The column headings should be the process steps in order. The rows are the individual instances; there could be many rows, but each row follows the process.

Before developing the Hazard Analysis, identify the device and its characteristics. Write the Risk Management Plan (or plans) that cover the life cycle of the device.

After completing the Hazard Analysis analyze the overall residual risk, review the process, and release the device to production.

After release to production, monitor the production and post-production information.


The major problems I see in this category are:
Failure to recognize that the Hazard Analysis is not an FMEA or FMECA. A hazard can lead to patient or user harm. The harm can occur either a normal or a fault condition. In contrast, an FMECA is a reliability tool that analyzes single point failures in a failure mode. An FMECA misses half the Hazard Analysis issues (harm in a normal condition) and does not follow the standard.

Failure to identify the sequence of events. Often patient or user harm requires more than one thing to go wrong. This is the sequence of events and is a strong component of accident prevention and investigation. The key to sequence of events is the connection to risk reduction, which should address the sequence steps. In the best case, the risk reduction measure breaks the chain in the sequence.

Confusing risk reduction with mitigation. Risk reduction addresses the severity or probability of the patient or user harm. The methods apply before the harm. Mitigation applies after the harm occurs and reduces it impact on the patient or user. Risk reduction prevents the loss of a body function. Mitigation compensates for the loss should it happen.

Not linking the tools. For example, a risk reduction measure in the manufacturing process should be part of t PFMECA. If the PFMECA shows that a nonconforming product could escape, analyze the effect in the Hazard Analysis.

The second problem is applications of risk management.
There are some standards that require risk management because they deal with patient or user harm. Typically, these standards have a file to collect the associated documentation. These files could be either part of the ISO 14971:2019 Risk Management File or separate files linked to the Risk Management File and its contents.

In each case, implement ISO 14971:2019 as a basis for the specific application. There may be specific files or specific requirements beyond ISO 14971:2019. Determine the file structure, any specific changes to the basic flow, and any specific documents required for the application.

I've identified the following standards and other applications that require risk management.
EU-MDR
EU-IVDR
FDA's guidance documents on changes to a 510(k) device
IEC 60601-1 on medical electrical equipment
IEC 62366-1:2015 on usability engineering
ISO 62304 on software
FDA's guidance documents on pre-market and post-market cyber security
ISO 10993-1:2018 and associated family members on biocompatibility
ISO 22442-1:2015 and associated family members on the use of animal tissue
 

Call to action
When writing about risk management, follow the standard as written. In particular, do not suggest that an FMEA or FMECA satisfies the standard.

Understand the standard and advocate its use as written.

Eschew complexity!

The Forum, on occasion, includes issues related to risk management. Often these issues suggest a lack of understanding of risk management. I also see these problems in my consulting practice. Typically, companies don't follow the standard as written. Worse, they create unnecessary complexity.

In my opinion, the industry has the sense that "compliance requires complexity". I take the opposite view; simplicity is essential.

In risk management, I see a lot of problems, but they generally fall into two categories: failure to follow the standard and failure to recognize that the standard is the basis for other standards.

ISO 14971:2019 is a process standard. It is well written and describes a simple and straight forward process. The process steps follow in a logical order. Most implementations use an Excel workbook. The column headings should be the process steps in order. The rows are the individual instances; there could be many rows, but each row follows the process.

Before developing the Hazard Analysis, identify the device and its characteristics. Write the Risk Management Plan (or plans) that cover the life cycle of the device.

After completing the Hazard Analysis analyze the overall residual risk, review the process, and release the device to production.

After release to production, monitor the production and post-production information.


The major problems I see in this category are:
Failure to recognize that the Hazard Analysis is not an FMEA or FMECA. A hazard can lead to patient or user harm. The harm can occur either a normal or a fault condition. In contrast, an FMECA is a reliability tool that analyzes single point failures in a failure mode. An FMECA misses half the Hazard Analysis issues (harm in a normal condition) and does not follow the standard.

Failure to identify the sequence of events. Often patient or user harm requires more than one thing to go wrong. This is the sequence of events and is a strong component of accident prevention and investigation. The key to sequence of events is the connection to risk reduction, which should address the sequence steps. In the best case, the risk reduction measure breaks the chain in the sequence.

Confusing risk reduction with mitigation. Risk reduction addresses the severity or probability of the patient or user harm. The methods apply before the harm. Mitigation applies after the harm occurs and reduces it impact on the patient or user. Risk reduction prevents the loss of a body function. Mitigation compensates for the loss should it happen.

Not linking the tools. For example, a risk reduction measure in the manufacturing process should be part of t PFMECA. If the PFMECA shows that a nonconforming product could escape, analyze the effect in the Hazard Analysis.

The second problem is applications of risk management.
There are some standards that require risk management because they deal with patient or user harm. Typically, these standards have a file to collect the associated documentation. These files could be either part of the ISO 14971:2019 Risk Management File or separate files linked to the Risk Management File and its contents.

In each case, implement ISO 14971:2019 as a basis for the specific application. There may be specific files or specific requirements beyond ISO 14971:2019. Determine the file structure, any specific changes to the basic flow, and any specific documents required for the application.

I've identified the following standards and other applications that require risk management.
EU-MDR
EU-IVDR
FDA's guidance documents on changes to a 510(k) device
IEC 60601-1 on medical electrical equipment
IEC 62366-1:2015 on usability engineering
ISO 62304 on software
FDA's guidance documents on pre-market and post-market cyber security
ISO 10993-1:2018 and associated family members on biocompatibility
ISO 22442-1:2015 and associated family members on the use of animal tissue
 

Call to action
When writing about risk management, follow the standard as written. In particular, do not suggest that an FMEA or FMECA satisfies the standard.

Understand the standard and advocate its use as written.

Eschew complexity!

The Forum, on occasion, includes issues related to risk management. Often these issues suggest a lack of understanding of risk management. I also see these problems in my consulting practice. Typically, companies don't follow the standard as written. Worse, they create unnecessary complexity.

In my opinion, the industry has the sense that "compliance requires complexity". I take the opposite view; simplicity is essential.

In risk management, I see a lot of problems, but they generally fall into two categories: failure to follow the standard and failure to recognize that the standard is the basis for other standards.

ISO 14971:2019 is a process standard. It is well written and describes a simple and straight forward process. The process steps follow in a logical order. Most implementations use an Excel workbook. The column headings should be the process steps in order. The rows are the individual instances; there could be many rows, but each row follows the process.

Before developing the Hazard Analysis, identify the device and its characteristics. Write the Risk Management Plan (or plans) that cover the life cycle of the device.

After completing the Hazard Analysis analyze the overall residual risk, review the process, and release the device to production.

After release to production, monitor the production and post-production information.


The major problems I see in this category are:
Failure to recognize that the Hazard Analysis is not an FMEA or FMECA. A hazard can lead to patient or user harm. The harm can occur either a normal or a fault condition. In contrast, an FMECA is a reliability tool that analyzes single point failures in a failure mode. An FMECA misses half the Hazard Analysis issues (harm in a normal condition) and does not follow the standard.

Failure to identify the sequence of events. Often patient or user harm requires more than one thing to go wrong. This is the sequence of events and is a strong component of accident prevention and investigation. The key to sequence of events is the connection to risk reduction, which should address the sequence steps. In the best case, the risk reduction measure breaks the chain in the sequence.

Confusing risk reduction with mitigation. Risk reduction addresses the severity or probability of the patient or user harm. The methods apply before the harm. Mitigation applies after the harm occurs and reduces it impact on the patient or user. Risk reduction prevents the loss of a body function. Mitigation compensates for the loss should it happen.

Not linking the tools. For example, a risk reduction measure in the manufacturing process should be part of t PFMECA. If the PFMECA shows that a nonconforming product could escape, analyze the effect in the Hazard Analysis.

The second problem is applications of risk management.
There are some standards that require risk management because they deal with patient or user harm. Typically, these standards have a file to collect the associated documentation. These files could be either part of the ISO 14971:2019 Risk Management File or separate files linked to the Risk Management File and its contents.

In each case, implement ISO 14971:2019 as a basis for the specific application. There may be specific files or specific requirements beyond ISO 14971:2019. Determine the file structure, any specific changes to the basic flow, and any specific documents required for the application.

I've identified the following standards and other applications that require risk management.
EU-MDR
EU-IVDR
FDA's guidance documents on changes to a 510(k) device
IEC 60601-1 on medical electrical equipment
IEC 62366-1:2015 on usability engineering
ISO 62304 on software
FDA's guidance documents on pre-market and post-market cyber security
ISO 10993-1:2018 and associated family members on biocompatibility
ISO 22442-1:2015 and associated family members on the use of animal tissue
 

Call to action
When writing about risk management, follow the standard as written. In particular, do not suggest that an FMEA or FMECA satisfies the standard.

Understand the standard and advocate its use as written.

Eschew complexity!

Unlike the other standards I listed, ISO 13485:2016 does not have any version of 14971 as a normative reference.

One could have a fully compliant implementation of ISO 13485:2016 without even opening ISO 14971:2007 or ISO 14971:2019.

The Forum, on occasion, includes issues related to risk management. Often these issues suggest a lack of understanding of risk management. I also see these problems in my consulting practice. Typically, companies don't follow the standard as written. Worse, they create unnecessary complexity.

In my opinion, the industry has the sense that "compliance requires complexity". I take the opposite view; simplicity is essential.

In risk management, I see a lot of problems, but they generally fall into two categories: failure to follow the standard and failure to recognize that the standard is the basis for other standards.

ISO 14971:2019 is a process standard. It is well written and describes a simple and straight forward process. The process steps follow in a logical order. Most implementations use an Excel workbook. The column headings should be the process steps in order. The rows are the individual instances; there could be many rows, but each row follows the process.

Before developing the Hazard Analysis, identify the device and its characteristics. Write the Risk Management Plan (or plans) that cover the life cycle of the device.

After completing the Hazard Analysis analyze the overall residual risk, review the process, and release the device to production.

After release to production, monitor the production and post-production information.


The major problems I see in this category are:
Failure to recognize that the Hazard Analysis is not an FMEA or FMECA. A hazard can lead to patient or user harm. The harm can occur either a normal or a fault condition. In contrast, an FMECA is a reliability tool that analyzes single point failures in a failure mode. An FMECA misses half the Hazard Analysis issues (harm in a normal condition) and does not follow the standard.

Failure to identify the sequence of events. Often patient or user harm requires more than one thing to go wrong. This is the sequence of events and is a strong component of accident prevention and investigation. The key to sequence of events is the connection to risk reduction, which should address the sequence steps. In the best case, the risk reduction measure breaks the chain in the sequence.

Confusing risk reduction with mitigation. Risk reduction addresses the severity or probability of the patient or user harm. The methods apply before the harm. Mitigation applies after the harm occurs and reduces it impact on the patient or user. Risk reduction prevents the loss of a body function. Mitigation compensates for the loss should it happen.

Not linking the tools. For example, a risk reduction measure in the manufacturing process should be part of t PFMECA. If the PFMECA shows that a nonconforming product could escape, analyze the effect in the Hazard Analysis.

The second problem is applications of risk management.
There are some standards that require risk management because they deal with patient or user harm. Typically, these standards have a file to collect the associated documentation. These files could be either part of the ISO 14971:2019 Risk Management File or separate files linked to the Risk Management File and its contents.

In each case, implement ISO 14971:2019 as a basis for the specific application. There may be specific files or specific requirements beyond ISO 14971:2019. Determine the file structure, any specific changes to the basic flow, and any specific documents required for the application.

I've identified the following standards and other applications that require risk management.
EU-MDR
EU-IVDR
FDA's guidance documents on changes to a 510(k) device
IEC 60601-1 on medical electrical equipment
IEC 62366-1:2015 on usability engineering
ISO 62304 on software
FDA's guidance documents on pre-market and post-market cyber security
ISO 10993-1:2018 and associated family members on biocompatibility
ISO 22442-1:2015 and associated family members on the use of animal tissue
 

Call to action
When writing about risk management, follow the standard as written. In particular, do not suggest that an FMEA or FMECA satisfies the standard.

Understand the standard and advocate its use as written.

Eschew complexity!

Unlike the other standards I listed, ISO 13485:2016 does not have any version of 14971 as a normative reference.

One could have a fully compliant implementation of ISO 13485:2016 without even opening ISO 14971:2007 or ISO 14971:2019.

The Forum, on occasion, includes issues related to risk management. Often these issues suggest a lack of understanding of risk management. I also see these problems in my consulting practice. Typically, companies don't follow the standard as written. Worse, they create unnecessary complexity.

In my opinion, the industry has the sense that "compliance requires complexity". I take the opposite view; simplicity is essential.

In risk management, I see a lot of problems, but they generally fall into two categories: failure to follow the standard and failure to recognize that the standard is the basis for other standards.

ISO 14971:2019 is a process standard. It is well written and describes a simple and straight forward process. The process steps follow in a logical order. Most implementations use an Excel workbook. The column headings should be the process steps in order. The rows are the individual instances; there could be many rows, but each row follows the process.

Before developing the Hazard Analysis, identify the device and its characteristics. Write the Risk Management Plan (or plans) that cover the life cycle of the device.

After completing the Hazard Analysis analyze the overall residual risk, review the process, and release the device to production.

After release to production, monitor the production and post-production information.


The major problems I see in this category are:
Failure to recognize that the Hazard Analysis is not an FMEA or FMECA. A hazard can lead to patient or user harm. The harm can occur either a normal or a fault condition. In contrast, an FMECA is a reliability tool that analyzes single point failures in a failure mode. An FMECA misses half the Hazard Analysis issues (harm in a normal condition) and does not follow the standard.

Failure to identify the sequence of events. Often patient or user harm requires more than one thing to go wrong. This is the sequence of events and is a strong component of accident prevention and investigation. The key to sequence of events is the connection to risk reduction, which should address the sequence steps. In the best case, the risk reduction measure breaks the chain in the sequence.

Confusing risk reduction with mitigation. Risk reduction addresses the severity or probability of the patient or user harm. The methods apply before the harm. Mitigation applies after the harm occurs and reduces it impact on the patient or user. Risk reduction prevents the loss of a body function. Mitigation compensates for the loss should it happen.

Not linking the tools. For example, a risk reduction measure in the manufacturing process should be part of t PFMECA. If the PFMECA shows that a nonconforming product could escape, analyze the effect in the Hazard Analysis.

The second problem is applications of risk management.
There are some standards that require risk management because they deal with patient or user harm. Typically, these standards have a file to collect the associated documentation. These files could be either part of the ISO 14971:2019 Risk Management File or separate files linked to the Risk Management File and its contents.

In each case, implement ISO 14971:2019 as a basis for the specific application. There may be specific files or specific requirements beyond ISO 14971:2019. Determine the file structure, any specific changes to the basic flow, and any specific documents required for the application.

I've identified the following standards and other applications that require risk management.
EU-MDR
EU-IVDR
FDA's guidance documents on changes to a 510(k) device
IEC 60601-1 on medical electrical equipment
IEC 62366-1:2015 on usability engineering
ISO 62304 on software
FDA's guidance documents on pre-market and post-market cyber security
ISO 10993-1:2018 and associated family members on biocompatibility
ISO 22442-1:2015 and associated family members on the use of animal tissue
 

Call to action
When writing about risk management, follow the standard as written. In particular, do not suggest that an FMEA or FMECA satisfies the standard.

Understand the standard and advocate its use as written.

Eschew complexity!

Unlike the other standards I listed, ISO 13485:2016 does not have any version of 14971 as a normative reference.

One could have a fully compliant implementation of ISO 13485:2016 without even opening ISO 14971:2007 or ISO 14971:2019.

The Forum, on occasion, includes issues related to risk management. Often these issues suggest a lack of understanding of risk management. I also see these problems in my consulting practice. Typically, companies don't follow the standard as written. Worse, they create unnecessary complexity.

In my opinion, the industry has the sense that "compliance requires complexity". I take the opposite view; simplicity is essential.

In risk management, I see a lot of problems, but they generally fall into two categories: failure to follow the standard and failure to recognize that the standard is the basis for other standards.

ISO 14971:2019 is a process standard. It is well written and describes a simple and straight forward process. The process steps follow in a logical order. Most implementations use an Excel workbook. The column headings should be the process steps in order. The rows are the individual instances; there could be many rows, but each row follows the process.

Before developing the Hazard Analysis, identify the device and its characteristics. Write the Risk Management Plan (or plans) that cover the life cycle of the device.

After completing the Hazard Analysis analyze the overall residual risk, review the process, and release the device to production.

After release to production, monitor the production and post-production information.


The major problems I see in this category are:
Failure to recognize that the Hazard Analysis is not an FMEA or FMECA. A hazard can lead to patient or user harm. The harm can occur either a normal or a fault condition. In contrast, an FMECA is a reliability tool that analyzes single point failures in a failure mode. An FMECA misses half the Hazard Analysis issues (harm in a normal condition) and does not follow the standard.

Failure to identify the sequence of events. Often patient or user harm requires more than one thing to go wrong. This is the sequence of events and is a strong component of accident prevention and investigation. The key to sequence of events is the connection to risk reduction, which should address the sequence steps. In the best case, the risk reduction measure breaks the chain in the sequence.

Confusing risk reduction with mitigation. Risk reduction addresses the severity or probability of the patient or user harm. The methods apply before the harm. Mitigation applies after the harm occurs and reduces it impact on the patient or user. Risk reduction prevents the loss of a body function. Mitigation compensates for the loss should it happen.

Not linking the tools. For example, a risk reduction measure in the manufacturing process should be part of t PFMECA. If the PFMECA shows that a nonconforming product could escape, analyze the effect in the Hazard Analysis.

The second problem is applications of risk management.
There are some standards that require risk management because they deal with patient or user harm. Typically, these standards have a file to collect the associated documentation. These files could be either part of the ISO 14971:2019 Risk Management File or separate files linked to the Risk Management File and its contents.

In each case, implement ISO 14971:2019 as a basis for the specific application. There may be specific files or specific requirements beyond ISO 14971:2019. Determine the file structure, any specific changes to the basic flow, and any specific documents required for the application.

I've identified the following standards and other applications that require risk management.
EU-MDR
EU-IVDR
FDA's guidance documents on changes to a 510(k) device
IEC 60601-1 on medical electrical equipment
IEC 62366-1:2015 on usability engineering
ISO 62304 on software
FDA's guidance documents on pre-market and post-market cyber security
ISO 10993-1:2018 and associated family members on biocompatibility
ISO 22442-1:2015 and associated family members on the use of animal tissue
 

Call to action
When writing about risk management, follow the standard as written. In particular, do not suggest that an FMEA or FMECA satisfies the standard.

Understand the standard and advocate its use as written.

Eschew complexity!

Unlike the other standards I listed, ISO 13485:2016 does not have any version of 14971 as a normative reference.

One could have a fully compliant implementation of ISO 13485:2016 without even opening ISO 14971:2007 or ISO 14971:2019.

The Forum, on occasion, includes issues related to risk management. Often these issues suggest a lack of understanding of risk management. I also see these problems in my consulting practice. Typically, companies don't follow the standard as written. Worse, they create unnecessary complexity.

In my opinion, the industry has the sense that "compliance requires complexity". I take the opposite view; simplicity is essential.

In risk management, I see a lot of problems, but they generally fall into two categories: failure to follow the standard and failure to recognize that the standard is the basis for other standards.

ISO 14971:2019 is a process standard. It is well written and describes a simple and straight forward process. The process steps follow in a logical order. Most implementations use an Excel workbook. The column headings should be the process steps in order. The rows are the individual instances; there could be many rows, but each row follows the process.

Before developing the Hazard Analysis, identify the device and its characteristics. Write the Risk Management Plan (or plans) that cover the life cycle of the device.

After completing the Hazard Analysis analyze the overall residual risk, review the process, and release the device to production.

After release to production, monitor the production and post-production information.


The major problems I see in this category are:
Failure to recognize that the Hazard Analysis is not an FMEA or FMECA. A hazard can lead to patient or user harm. The harm can occur either a normal or a fault condition. In contrast, an FMECA is a reliability tool that analyzes single point failures in a failure mode. An FMECA misses half the Hazard Analysis issues (harm in a normal condition) and does not follow the standard.

Failure to identify the sequence of events. Often patient or user harm requires more than one thing to go wrong. This is the sequence of events and is a strong component of accident prevention and investigation. The key to sequence of events is the connection to risk reduction, which should address the sequence steps. In the best case, the risk reduction measure breaks the chain in the sequence.

Confusing risk reduction with mitigation. Risk reduction addresses the severity or probability of the patient or user harm. The methods apply before the harm. Mitigation applies after the harm occurs and reduces it impact on the patient or user. Risk reduction prevents the loss of a body function. Mitigation compensates for the loss should it happen.

Not linking the tools. For example, a risk reduction measure in the manufacturing process should be part of t PFMECA. If the PFMECA shows that a nonconforming product could escape, analyze the effect in the Hazard Analysis.

The second problem is applications of risk management.
There are some standards that require risk management because they deal with patient or user harm. Typically, these standards have a file to collect the associated documentation. These files could be either part of the ISO 14971:2019 Risk Management File or separate files linked to the Risk Management File and its contents.

In each case, implement ISO 14971:2019 as a basis for the specific application. There may be specific files or specific requirements beyond ISO 14971:2019. Determine the file structure, any specific changes to the basic flow, and any specific documents required for the application.

I've identified the following standards and other applications that require risk management.
EU-MDR
EU-IVDR
FDA's guidance documents on changes to a 510(k) device
IEC 60601-1 on medical electrical equipment
IEC 62366-1:2015 on usability engineering
ISO 62304 on software
FDA's guidance documents on pre-market and post-market cyber security
ISO 10993-1:2018 and associated family members on biocompatibility
ISO 22442-1:2015 and associated family members on the use of animal tissue
 

Call to action
When writing about risk management, follow the standard as written. In particular, do not suggest that an FMEA or FMECA satisfies the standard.

Understand the standard and advocate its use as written.

Eschew complexity!

The Forum, on occasion, includes issues related to risk management. Often these issues suggest a lack of understanding of risk management. I also see these problems in my consulting practice. Typically, companies don't follow the standard as written. Worse, they create unnecessary complexity.

In my opinion, the industry has the sense that "compliance requires complexity". I take the opposite view; simplicity is essential.

In risk management, I see a lot of problems, but they generally fall into two categories: failure to follow the standard and failure to recognize that the standard is the basis for other standards.

ISO 14971:2019 is a process standard. It is well written and describes a simple and straight forward process. The process steps follow in a logical order. Most implementations use an Excel workbook. The column headings should be the process steps in order. The rows are the individual instances; there could be many rows, but each row follows the process.

Before developing the Hazard Analysis, identify the device and its characteristics. Write the Risk Management Plan (or plans) that cover the life cycle of the device.

After completing the Hazard Analysis analyze the overall residual risk, review the process, and release the device to production.

After release to production, monitor the production and post-production information.


The major problems I see in this category are:
Failure to recognize that the Hazard Analysis is not an FMEA or FMECA. A hazard can lead to patient or user harm. The harm can occur either a normal or a fault condition. In contrast, an FMECA is a reliability tool that analyzes single point failures in a failure mode. An FMECA misses half the Hazard Analysis issues (harm in a normal condition) and does not follow the standard.

Failure to identify the sequence of events. Often patient or user harm requires more than one thing to go wrong. This is the sequence of events and is a strong component of accident prevention and investigation. The key to sequence of events is the connection to risk reduction, which should address the sequence steps. In the best case, the risk reduction measure breaks the chain in the sequence.

Confusing risk reduction with mitigation. Risk reduction addresses the severity or probability of the patient or user harm. The methods apply before the harm. Mitigation applies after the harm occurs and reduces it impact on the patient or user. Risk reduction prevents the loss of a body function. Mitigation compensates for the loss should it happen.

Not linking the tools. For example, a risk reduction measure in the manufacturing process should be part of t PFMECA. If the PFMECA shows that a nonconforming product could escape, analyze the effect in the Hazard Analysis.

The second problem is applications of risk management.
There are some standards that require risk management because they deal with patient or user harm. Typically, these standards have a file to collect the associated documentation. These files could be either part of the ISO 14971:2019 Risk Management File or separate files linked to the Risk Management File and its contents.

In each case, implement ISO 14971:2019 as a basis for the specific application. There may be specific files or specific requirements beyond ISO 14971:2019. Determine the file structure, any specific changes to the basic flow, and any specific documents required for the application.

I've identified the following standards and other applications that require risk management.
EU-MDR
EU-IVDR
FDA's guidance documents on changes to a 510(k) device
IEC 60601-1 on medical electrical equipment
IEC 62366-1:2015 on usability engineering
ISO 62304 on software
FDA's guidance documents on pre-market and post-market cyber security
ISO 10993-1:2018 and associated family members on biocompatibility
ISO 22442-1:2015 and associated family members on the use of animal tissue
 

Call to action
When writing about risk management, follow the standard as written. In particular, do not suggest that an FMEA or FMECA satisfies the standard.

Understand the standard and advocate its use as written.

Eschew complexity!

The Forum, on occasion, includes issues related to risk management. Often these issues suggest a lack of understanding of risk management. I also see these problems in my consulting practice. Typically, companies don't follow the standard as written. Worse, they create unnecessary complexity.

In my opinion, the industry has the sense that "compliance requires complexity". I take the opposite view; simplicity is essential.

In risk management, I see a lot of problems, but they generally fall into two categories: failure to follow the standard and failure to recognize that the standard is the basis for other standards.

ISO 14971:2019 is a process standard. It is well written and describes a simple and straight forward process. The process steps follow in a logical order. Most implementations use an Excel workbook. The column headings should be the process steps in order. The rows are the individual instances; there could be many rows, but each row follows the process.

Before developing the Hazard Analysis, identify the device and its characteristics. Write the Risk Management Plan (or plans) that cover the life cycle of the device.

After completing the Hazard Analysis analyze the overall residual risk, review the process, and release the device to production.

After release to production, monitor the production and post-production information.


The major problems I see in this category are:
Failure to recognize that the Hazard Analysis is not an FMEA or FMECA. A hazard can lead to patient or user harm. The harm can occur either a normal or a fault condition. In contrast, an FMECA is a reliability tool that analyzes single point failures in a failure mode. An FMECA misses half the Hazard Analysis issues (harm in a normal condition) and does not follow the standard.

Failure to identify the sequence of events. Often patient or user harm requires more than one thing to go wrong. This is the sequence of events and is a strong component of accident prevention and investigation. The key to sequence of events is the connection to risk reduction, which should address the sequence steps. In the best case, the risk reduction measure breaks the chain in the sequence.

Confusing risk reduction with mitigation. Risk reduction addresses the severity or probability of the patient or user harm. The methods apply before the harm. Mitigation applies after the harm occurs and reduces it impact on the patient or user. Risk reduction prevents the loss of a body function. Mitigation compensates for the loss should it happen.

Not linking the tools. For example, a risk reduction measure in the manufacturing process should be part of t PFMECA. If the PFMECA shows that a nonconforming product could escape, analyze the effect in the Hazard Analysis.

The second problem is applications of risk management.
There are some standards that require risk management because they deal with patient or user harm. Typically, these standards have a file to collect the associated documentation. These files could be either part of the ISO 14971:2019 Risk Management File or separate files linked to the Risk Management File and its contents.

In each case, implement ISO 14971:2019 as a basis for the specific application. There may be specific files or specific requirements beyond ISO 14971:2019. Determine the file structure, any specific changes to the basic flow, and any specific documents required for the application.

I've identified the following standards and other applications that require risk management.
EU-MDR
EU-IVDR
FDA's guidance documents on changes to a 510(k) device
IEC 60601-1 on medical electrical equipment
IEC 62366-1:2015 on usability engineering
ISO 62304 on software
FDA's guidance documents on pre-market and post-market cyber security
ISO 10993-1:2018 and associated family members on biocompatibility
ISO 22442-1:2015 and associated family members on the use of animal tissue
 

Call to action
When writing about risk management, follow the standard as written. In particular, do not suggest that an FMEA or FMECA satisfies the standard.

Understand the standard and advocate its use as written.

Eschew complexity!

The Forum, on occasion, includes issues related to risk management. Often these issues suggest a lack of understanding of risk management. I also see these problems in my consulting practice. Typically, companies don't follow the standard as written. Worse, they create unnecessary complexity.

In my opinion, the industry has the sense that "compliance requires complexity". I take the opposite view; simplicity is essential.

In risk management, I see a lot of problems, but they generally fall into two categories: failure to follow the standard and failure to recognize that the standard is the basis for other standards.

ISO 14971:2019 is a process standard. It is well written and describes a simple and straight forward process. The process steps follow in a logical order. Most implementations use an Excel workbook. The column headings should be the process steps in order. The rows are the individual instances; there could be many rows, but each row follows the process.

Before developing the Hazard Analysis, identify the device and its characteristics. Write the Risk Management Plan (or plans) that cover the life cycle of the device.

After completing the Hazard Analysis analyze the overall residual risk, review the process, and release the device to production.

After release to production, monitor the production and post-production information.


The major problems I see in this category are:
Failure to recognize that the Hazard Analysis is not an FMEA or FMECA. A hazard can lead to patient or user harm. The harm can occur either a normal or a fault condition. In contrast, an FMECA is a reliability tool that analyzes single point failures in a failure mode. An FMECA misses half the Hazard Analysis issues (harm in a normal condition) and does not follow the standard.

Failure to identify the sequence of events. Often patient or user harm requires more than one thing to go wrong. This is the sequence of events and is a strong component of accident prevention and investigation. The key to sequence of events is the connection to risk reduction, which should address the sequence steps. In the best case, the risk reduction measure breaks the chain in the sequence.

Confusing risk reduction with mitigation. Risk reduction addresses the severity or probability of the patient or user harm. The methods apply before the harm. Mitigation applies after the harm occurs and reduces it impact on the patient or user. Risk reduction prevents the loss of a body function. Mitigation compensates for the loss should it happen.

Not linking the tools. For example, a risk reduction measure in the manufacturing process should be part of t PFMECA. If the PFMECA shows that a nonconforming product could escape, analyze the effect in the Hazard Analysis.

The second problem is applications of risk management.
There are some standards that require risk management because they deal with patient or user harm. Typically, these standards have a file to collect the associated documentation. These files could be either part of the ISO 14971:2019 Risk Management File or separate files linked to the Risk Management File and its contents.

In each case, implement ISO 14971:2019 as a basis for the specific application. There may be specific files or specific requirements beyond ISO 14971:2019. Determine the file structure, any specific changes to the basic flow, and any specific documents required for the application.

I've identified the following standards and other applications that require risk management.
EU-MDR
EU-IVDR
FDA's guidance documents on changes to a 510(k) device
IEC 60601-1 on medical electrical equipment
IEC 62366-1:2015 on usability engineering
ISO 62304 on software
FDA's guidance documents on pre-market and post-market cyber security
ISO 10993-1:2018 and associated family members on biocompatibility
ISO 22442-1:2015 and associated family members on the use of animal tissue
 

Call to action
When writing about risk management, follow the standard as written. In particular, do not suggest that an FMEA or FMECA satisfies the standard.

Understand the standard and advocate its use as written.

Eschew complexity!