Regulatory Open Forum

14971:2012 introduced the concept of reducing risks as far as possible (AFAP) in place of As Low as Reasonably Practicable (ALARP). 14971:2019 4.2 Note 1 there seems to be a choice between AFAP without adversely affecting the benefit-risk ratio and ALARP reducing the risk as low as reasonably achievable.

My question is if the risk management plan indicates we will follow AFAP are there only two risk reduction categories: AFAP and reduce to AFAP?. 

It would seem that ALARP is a bit more flexible by adding the "reasonably" qualifier. It considers reducing risk without making the MD an "unsound economic proposition".  In this case is it up to the company to determine reasonable risk?

Any thoughts would be greatly appreciated.

------------------------------
Walter Domozych
Sturbridge MA
United States
------------------------------

This gets a little arcane, so please bear with me.

EN ISO 14971:2012 was a result of problem raised by Sweden who claimed, for technical reasons, that EN ISO 14971:2009 did not qualify to be a Harmonized Standard. To meet the objection, the EU prepared EN ISO 14971:2012 and included a set of content deviations.

For ALARP, it is important to understand the concept. ISO 14971:2007 (EN ISO 14971:2009) says that "practicable" means the ability of the manufacturer to reduce the risk. It has two components. Technical is the ability to reduce the risk through technical means regardless of cost. Economic is the ability to reduce the risk without making the medical device an unsound economic proposition. The concept is that if there are too many risk control measures the cost of device becomes excessive (unsound) and people cannot afford to use it.

EN ISO 14971:2012, Content Deviation #3 says that MDD Annex I requires reduction of risks as far as possible, AFAP, without room for economic considerations. Manufacturers and Notified Bodies may not apply the ALARP concept with regard to economic considerations.

ALARP has two legs technical and economic, while AFAP has only one, technical. In my risk management class, I stand on one leg to illustrate the concept.

EN ISO 14971:2012, with its abominable content deviations is dead and buried. The current version is EN ISO 14971:2019/A11:2021. However, it raises a problem.

ISO 14971:2019, 4.2, Note 1 says, that the manufacturer's policy for establishing criteria for risk acceptability can define the approaches to risk control:<o:p></o:p>reducing risk as low as reasonably practicable (ALARP)

<o:p></o:p>reducing risk as low as reasonably achievable (ALARA)

<o:p></o:p>reducing risk as far as possible without adversely affecting the benefit-risk ratio (AFAP-BR)<o:p></o:p>

However, EN ISO 14971:2019/A11 2021, Annex ZA, 3 says the manufacturer's policy for risk reduction must follow the MDR Annex I. Note 1 enumerates the various terms and Note 2 enumerates the Annex I clauses. The problem is that the authors of Annex I were not consistent in naming the criteria.

As a general rule, most NBs use the requirements in EU-MDR Annex I(2) and EU-MDR Annex I(8).

EU-MDR Annex I(2): The requirement in this Annex to reduce risks as far as possible means the reduction of risks as far as possible without adversely affecting the benefit-risk ratio (AFAP-BR).

EU-MDR Annex I(8): All known and foreseeable risks, and any undesirable side-effects, shall be minimized and be acceptable (M&A) when weighed against the evaluated benefits to the patient and/or user arising from the achieved performance of the device during normal conditions of use.

While EN ISO 14971:2012 is gone, inconsistency and confusion still predominate in the EU.<o:p></o:p>

In summary, if you not in the EU, the international standard allows three choices. If you are in the EU there is, practically, only one choice, the one in Annex I(2).

14971:2012 introduced the concept of reducing risks as far as possible (AFAP) in place of As Low as Reasonably Practicable (ALARP). 14971:2019 4.2 Note 1 there seems to be a choice between AFAP without adversely affecting the benefit-risk ratio and ALARP reducing the risk as low as reasonably achievable.

My question is if the risk management plan indicates we will follow AFAP are there only two risk reduction categories: AFAP and reduce to AFAP?. 

It would seem that ALARP is a bit more flexible by adding the "reasonably" qualifier. It considers reducing risk without making the MD an "unsound economic proposition".  In this case is it up to the company to determine reasonable risk?

Any thoughts would be greatly appreciated.

------------------------------
Walter Domozych
Sturbridge MA
United States
------------------------------

This gets a little arcane, so please bear with me.

EN ISO 14971:2012 was a result of problem raised by Sweden who claimed, for technical reasons, that EN ISO 14971:2009 did not qualify to be a Harmonized Standard. To meet the objection, the EU prepared EN ISO 14971:2012 and included a set of content deviations.

For ALARP, it is important to understand the concept. ISO 14971:2007 (EN ISO 14971:2009) says that "practicable" means the ability of the manufacturer to reduce the risk. It has two components. Technical is the ability to reduce the risk through technical means regardless of cost. Economic is the ability to reduce the risk without making the medical device an unsound economic proposition. The concept is that if there are too many risk control measures the cost of device becomes excessive (unsound) and people cannot afford to use it.

EN ISO 14971:2012, Content Deviation #3 says that MDD Annex I requires reduction of risks as far as possible, AFAP, without room for economic considerations. Manufacturers and Notified Bodies may not apply the ALARP concept with regard to economic considerations.

ALARP has two legs technical and economic, while AFAP has only one, technical. In my risk management class, I stand on one leg to illustrate the concept.

EN ISO 14971:2012, with its abominable content deviations is dead and buried. The current version is EN ISO 14971:2019/A11:2021. However, it raises a problem.

ISO 14971:2019, 4.2, Note 1 says, that the manufacturer's policy for establishing criteria for risk acceptability can define the approaches to risk control:<o:p></o:p>reducing risk as low as reasonably practicable (ALARP)

<o:p></o:p>reducing risk as low as reasonably achievable (ALARA)

<o:p></o:p>reducing risk as far as possible without adversely affecting the benefit-risk ratio (AFAP-BR)<o:p></o:p>

However, EN ISO 14971:2019/A11 2021, Annex ZA, 3 says the manufacturer's policy for risk reduction must follow the MDR Annex I. Note 1 enumerates the various terms and Note 2 enumerates the Annex I clauses. The problem is that the authors of Annex I were not consistent in naming the criteria.

As a general rule, most NBs use the requirements in EU-MDR Annex I(2) and EU-MDR Annex I(8).

EU-MDR Annex I(2): The requirement in this Annex to reduce risks as far as possible means the reduction of risks as far as possible without adversely affecting the benefit-risk ratio (AFAP-BR).

EU-MDR Annex I(8): All known and foreseeable risks, and any undesirable side-effects, shall be minimized and be acceptable (M&A) when weighed against the evaluated benefits to the patient and/or user arising from the achieved performance of the device during normal conditions of use.

While EN ISO 14971:2012 is gone, inconsistency and confusion still predominate in the EU.<o:p></o:p>

In summary, if you not in the EU, the international standard allows three choices. If you are in the EU there is, practically, only one choice, the one in Annex I(2).

14971:2012 introduced the concept of reducing risks as far as possible (AFAP) in place of As Low as Reasonably Practicable (ALARP). 14971:2019 4.2 Note 1 there seems to be a choice between AFAP without adversely affecting the benefit-risk ratio and ALARP reducing the risk as low as reasonably achievable.

My question is if the risk management plan indicates we will follow AFAP are there only two risk reduction categories: AFAP and reduce to AFAP?. 

It would seem that ALARP is a bit more flexible by adding the "reasonably" qualifier. It considers reducing risk without making the MD an "unsound economic proposition".  In this case is it up to the company to determine reasonable risk?

Any thoughts would be greatly appreciated.

------------------------------
Walter Domozych
Sturbridge MA
United States
------------------------------

14971:2012 introduced the concept of reducing risks as far as possible (AFAP) in place of As Low as Reasonably Practicable (ALARP). 14971:2019 4.2 Note 1 there seems to be a choice between AFAP without adversely affecting the benefit-risk ratio and ALARP reducing the risk as low as reasonably achievable.

My question is if the risk management plan indicates we will follow AFAP are there only two risk reduction categories: AFAP and reduce to AFAP?. 

It would seem that ALARP is a bit more flexible by adding the "reasonably" qualifier. It considers reducing risk without making the MD an "unsound economic proposition".  In this case is it up to the company to determine reasonable risk?

Any thoughts would be greatly appreciated.

------------------------------
Walter Domozych
Sturbridge MA
United States
------------------------------

Hi Walter,

The answers will depend on the jurisdiction.

For example, I suspect that your reference to "14971:2012" is in relation to the European medical device jurisdiction; the only version of ISO 14971 designated 2012 of which I'm aware is EN ISO 14971:2012 (as amended).  But that version was superseded (in terms of state-of-the-art as well as in terms of European harmonization), and was for the outgoing EU MDD 93/42/EEC (and other outgoing device directives too).  The MDD and EN ISO 14971:2012 (as amended) both generally demanded that risks be reduced as far as possible (AFAP) for the European jurisdiction.  There was no option for utilizing the other risk reduction/acceptability endpoints (such as ALARP) offered by ISO 14971.  Lots of deep and turbulent water went under the bridge regarding Europe's interpretation and reinterpretations of the AFAP concept and superseded EN ISO 14971:2012 that may not be germane to your scenario, so I won't go further into that unless requested to do so.  However, there are still some corresponding interpretive principles that I believe are proper for carry-over regarding the new EU MDR jurisdiction (I talk more about that below).    

Specifically first, the same basic requirement for risk acceptability criteria based on AFAP also holds true under the new EU MDR 2017/745 and the latest state of the art EN ISO 14971:2019/A11:2021 (which is also the current harmonized) version for the EU MDR.  Again, as was the case under the MDD, the European EU MDR 2017/745 jurisdiction gives no direct liberty to utilize risk acceptability based on ALARP.  Yet based on concessions from the European Notified Bodies for the 2012 version's unreasonable rigidity regarding economic considerations (the NBs consequently ultimately conceded that economic practicability must be allowed to be considered), I have practiced, and continue to practice, such reasonableness now under the EU MDR.

Note also that for IVDs and the EU IVDR 2017/746, there is more legislative latitude for ALARP depending on which GSPR is the subject (see Annex ZB of EN ISO 14971:2019/A11:2021 for some explanation of those IVDR liberties).

Getting back to your AFAP questions: Here are a couple prior Forum posts attending to the AFAP concept that I think you'll find helpful:

Post 1

Post 2

Now, outside of Europe's Union, we have more liberty to take advantage of ISO 14971's risk reduction practicability considerations.  And if we do that, then yes, it is generally up to the manufacturer to define and defend the sensibility of its approach to those considerations.

Ultimately, when the RMP prescribes the risk acceptability criteria in terms of the AFAP concept, then I use the following three risk acceptability zones/categories, listed in increasing order of risk, for use in conjunction with the risk estimation matrix and other risk acceptability criteria:

• Unreduced individual risk is already reduced As Far As Possible (AFAP) down to prescribed endpoints maintaining a high level of protection of health and safety; therefore no risk control needed.
• Individual risk to be reduced As Far As Possible (AFAP) down to prescribed endpoints maintaining a high level of protection of health and safety. Under the EU MDR, this requires risk/benefit analysis in all cases to confirm no adverse impact on the risk/benefit ratio.
• Individual risk to be reduced As Far As Possible (AFAP) down to prescribed endpoints maintaining a high level of protection of health and safety. Positive benefit/risk ratio required for acceptance (whether for EU MDR or not).

And again, yes, it's generally up to the company to determine what level of risk is "reasonable" for its subject device.  However, that position will be reviewed and, as needed challenged, by regulatory agencies to assure that public health is being sufficiently maintained.

14971:2012 introduced the concept of reducing risks as far as possible (AFAP) in place of As Low as Reasonably Practicable (ALARP). 14971:2019 4.2 Note 1 there seems to be a choice between AFAP without adversely affecting the benefit-risk ratio and ALARP reducing the risk as low as reasonably achievable.

My question is if the risk management plan indicates we will follow AFAP are there only two risk reduction categories: AFAP and reduce to AFAP?. 

It would seem that ALARP is a bit more flexible by adding the "reasonably" qualifier. It considers reducing risk without making the MD an "unsound economic proposition".  In this case is it up to the company to determine reasonable risk?

Any thoughts would be greatly appreciated.

------------------------------
Walter Domozych
Sturbridge MA
United States
------------------------------