Regulatory Open Forum

Based on ISO 14971 Risk control measures can reduce the severity of the harm or reduce the probability of occurrence of
the harm, or both.

Are there instructions for when risk control measures would likely reduce the probability Vs other types of controls that reduce the severity? 

Thanks!

There are no instructions, it depends on the effect of the risk control measures.

I've had people suggest that one cannot change the severity; when the harm happens it always has the same severity.

My counter example is touching a hot surface. Reducing the surface temperature reduces the severity (from, say, second degree burn to first). However, inadvertent contact, the frequency of occurrence, won't change by this risk control measure.

On the other hand, information for safety, "Hot Surface Do Not Touch", will reduce the frequency of occurrence without changing the severity.

The idea is to understand the sequence of events that converts the Hazard to the Hazardous Situation. Look at each step to determine if you can "break the chain". If not, look at each step in terms of reducing the frequency of occurrence and reducing the severity.

Based on ISO 14971 Risk control measures can reduce the severity of the harm or reduce the probability of occurrence of
the harm, or both.

Are there instructions for when risk control measures would likely reduce the probability Vs other types of controls that reduce the severity? 

Thanks!

Based on ISO 14971 Risk control measures can reduce the severity of the harm or reduce the probability of occurrence of
the harm, or both.

Are there instructions for when risk control measures would likely reduce the probability Vs other types of controls that reduce the severity? 

Thanks!

Annex A of ISO 14971:2019+A11:2021 notes that the priority order of the risk control options is important (see clause A.2.7.1).  Inherent safety by design is the most robust and most "likely to remain effective, whereas [...] even well-designed guards and protective measures can fail or be violated and information for safety might not be followed."  Likewise, ISO/TR 24971:2020 expands on this in clause 7.1.1, where it notes that making the design and manufacturing process inherently safe can eliminate a hazard, reduce the probability of harm or reduce the severity of harm.  Each of these results have associated examples that can be referenced.  

It is interesting to note that the remaining risk control options are discussed in terms of reducing the probability of harm.  Take for example protective measures and the potential to prevent "occurrence of a hazardous situation," or "preventing a hazardous situation from leading to harm."  At first glance, these may appear to mean that there is no potential for risk if there is no resulting harm or exposure to a hazard; however, as noted in Annex A of the standard (ISO 14971:2019+A11:2021) protective measures "can fail or be violated."  While verification of effectiveness of the protective measure as a risk control should provide a high degree of assurance that the control reduces risk, it does not eliminate it entirely; therefore, the probability of harm can be greatly reduced, but not likely eliminated.  So too "information for safety might not be followed" (ISO 14971:2019+A11:2021 clause A.2.7.1) and "should be used only after the manufacturer has determined that (further) risk reduction by other measures is not practicable" (ISO/TR 24971:2020 clause D.2).  Here it is noted that such information "is instructive and gives the user clear instructions of what actions to take or to avoid, in order to prevent a hazardous situation or harm from occurring;" however, the nature of the risk control does not eliminate the risk since it can only inform the user on proper use.  Therefore, it can potentially reduce the probability of harm (by affecting the hazardous situation or harm), but careful consideration should be made in demonstrating the effecting of this method in reducing risk(s).

------------------------------
Christopher Erwin
Scottsdale AZ
United States

Original Message:
Sent: 23-Feb-2023 15:31
From: Anonymous Member
Subject: Risk Assessment - Reduction in Severity of Harm

This message was posted by a user wishing to remain anonymous

Based on ISO 14971 Risk control measures can reduce the severity of the harm or reduce the probability of occurrence of
the harm, or both.

Are there instructions for when risk control measures would likely reduce the probability Vs other types of controls that reduce the severity? 

Thanks!

Excellent point, Christopher!  I find that most people do not " read and understand" the standard and all the guidance that was created by the technical committee. Most look at me with blank stares when I mention the terms and definitions as well as the annexes to the standard AND the guidances in ISO TR 24971:2020. Many of the questions can be addressed directly, as you point out Christopher, just by reading the documents. Also ask questions when you don't understand.

Christopher also mentions the EN Harmonised version of the standard, be sure to use the appropriate version of the standard ( there is only one version of ISO TR 24971:2020) when you are researching your issue. For the EC, also look at the terms and definitions in the MDR/IVDR, they may modify your approach.

After many years working on standards committees I have learned the value of terms and definitions, often overlooked by readers. Another part of the standards is the Introduction and Scope. They are there fore a reason. Too many jump to Clause 4 and start from there. Read the ENTIRE standard including the Annexes. That reading will give you a much better understanding of the documents. A lot of work was put into entire document for good reason, to increase the users understanding.

I'm done with my rant, and thanks to Christopher for inspiring me!

Annex A of ISO 14971:2019+A11:2021 notes that the priority order of the risk control options is important (see clause A.2.7.1).  Inherent safety by design is the most robust and most "likely to remain effective, whereas [...] even well-designed guards and protective measures can fail or be violated and information for safety might not be followed."  Likewise, ISO/TR 24971:2020 expands on this in clause 7.1.1, where it notes that making the design and manufacturing process inherently safe can eliminate a hazard, reduce the probability of harm or reduce the severity of harm.  Each of these results have associated examples that can be referenced.  

It is interesting to note that the remaining risk control options are discussed in terms of reducing the probability of harm.  Take for example protective measures and the potential to prevent "occurrence of a hazardous situation," or "preventing a hazardous situation from leading to harm."  At first glance, these may appear to mean that there is no potential for risk if there is no resulting harm or exposure to a hazard; however, as noted in Annex A of the standard (ISO 14971:2019+A11:2021) protective measures "can fail or be violated."  While verification of effectiveness of the protective measure as a risk control should provide a high degree of assurance that the control reduces risk, it does not eliminate it entirely; therefore, the probability of harm can be greatly reduced, but not likely eliminated.  So too "information for safety might not be followed" (ISO 14971:2019+A11:2021 clause A.2.7.1) and "should be used only after the manufacturer has determined that (further) risk reduction by other measures is not practicable" (ISO/TR 24971:2020 clause D.2).  Here it is noted that such information "is instructive and gives the user clear instructions of what actions to take or to avoid, in order to prevent a hazardous situation or harm from occurring;" however, the nature of the risk control does not eliminate the risk since it can only inform the user on proper use.  Therefore, it can potentially reduce the probability of harm (by affecting the hazardous situation or harm), but careful consideration should be made in demonstrating the effecting of this method in reducing risk(s).

------------------------------
Christopher Erwin
Scottsdale AZ
United States

Original Message:
Sent: 23-Feb-2023 15:31
From: Anonymous Member
Subject: Risk Assessment - Reduction in Severity of Harm

This message was posted by a user wishing to remain anonymous

Based on ISO 14971 Risk control measures can reduce the severity of the harm or reduce the probability of occurrence of
the harm, or both.

Are there instructions for when risk control measures would likely reduce the probability Vs other types of controls that reduce the severity? 

Thanks!

Excellent point, Christopher!  I find that most people do not " read and understand" the standard and all the guidance that was created by the technical committee. Most look at me with blank stares when I mention the terms and definitions as well as the annexes to the standard AND the guidances in ISO TR 24971:2020. Many of the questions can be addressed directly, as you point out Christopher, just by reading the documents. Also ask questions when you don't understand.

Christopher also mentions the EN Harmonised version of the standard, be sure to use the appropriate version of the standard ( there is only one version of ISO TR 24971:2020) when you are researching your issue. For the EC, also look at the terms and definitions in the MDR/IVDR, they may modify your approach.

After many years working on standards committees I have learned the value of terms and definitions, often overlooked by readers. Another part of the standards is the Introduction and Scope. They are there fore a reason. Too many jump to Clause 4 and start from there. Read the ENTIRE standard including the Annexes. That reading will give you a much better understanding of the documents. A lot of work was put into entire document for good reason, to increase the users understanding.

I'm done with my rant, and thanks to Christopher for inspiring me!

Annex A of ISO 14971:2019+A11:2021 notes that the priority order of the risk control options is important (see clause A.2.7.1).  Inherent safety by design is the most robust and most "likely to remain effective, whereas [...] even well-designed guards and protective measures can fail or be violated and information for safety might not be followed."  Likewise, ISO/TR 24971:2020 expands on this in clause 7.1.1, where it notes that making the design and manufacturing process inherently safe can eliminate a hazard, reduce the probability of harm or reduce the severity of harm.  Each of these results have associated examples that can be referenced.  

It is interesting to note that the remaining risk control options are discussed in terms of reducing the probability of harm.  Take for example protective measures and the potential to prevent "occurrence of a hazardous situation," or "preventing a hazardous situation from leading to harm."  At first glance, these may appear to mean that there is no potential for risk if there is no resulting harm or exposure to a hazard; however, as noted in Annex A of the standard (ISO 14971:2019+A11:2021) protective measures "can fail or be violated."  While verification of effectiveness of the protective measure as a risk control should provide a high degree of assurance that the control reduces risk, it does not eliminate it entirely; therefore, the probability of harm can be greatly reduced, but not likely eliminated.  So too "information for safety might not be followed" (ISO 14971:2019+A11:2021 clause A.2.7.1) and "should be used only after the manufacturer has determined that (further) risk reduction by other measures is not practicable" (ISO/TR 24971:2020 clause D.2).  Here it is noted that such information "is instructive and gives the user clear instructions of what actions to take or to avoid, in order to prevent a hazardous situation or harm from occurring;" however, the nature of the risk control does not eliminate the risk since it can only inform the user on proper use.  Therefore, it can potentially reduce the probability of harm (by affecting the hazardous situation or harm), but careful consideration should be made in demonstrating the effecting of this method in reducing risk(s).

------------------------------
Christopher Erwin
Scottsdale AZ
United States

Original Message:
Sent: 23-Feb-2023 15:31
From: Anonymous Member
Subject: Risk Assessment - Reduction in Severity of Harm

This message was posted by a user wishing to remain anonymous

Based on ISO 14971 Risk control measures can reduce the severity of the harm or reduce the probability of occurrence of
the harm, or both.

Are there instructions for when risk control measures would likely reduce the probability Vs other types of controls that reduce the severity? 

Thanks!

Based on ISO 14971 Risk control measures can reduce the severity of the harm or reduce the probability of occurrence of
the harm, or both.

Are there instructions for when risk control measures would likely reduce the probability Vs other types of controls that reduce the severity? 

Thanks!

Be certain that a qualified person is judging severity, such as a physician, nurse, physician assistant, or dentist. Use the same person you go to when deciding whether to report a complaint as an MDR to FDA. Don't let engineers judge severity.

Based on ISO 14971 Risk control measures can reduce the severity of the harm or reduce the probability of occurrence of
the harm, or both.

Are there instructions for when risk control measures would likely reduce the probability Vs other types of controls that reduce the severity? 

Thanks!

I would add just a little to David's excellent response. Be sure your clinical/medical expert you use is currently qualified in the aspect of care reflected in the use of your product. Someone who was last in the aspect of care 15 years ago and has worked in a different area, but had a medical/clinical title may not be the best choice of an "expert".

Be certain that a qualified person is judging severity, such as a physician, nurse, physician assistant, or dentist. Use the same person you go to when deciding whether to report a complaint as an MDR to FDA. Don't let engineers judge severity.

Based on ISO 14971 Risk control measures can reduce the severity of the harm or reduce the probability of occurrence of
the harm, or both.

Are there instructions for when risk control measures would likely reduce the probability Vs other types of controls that reduce the severity? 

Thanks!

Based on ISO 14971 Risk control measures can reduce the severity of the harm or reduce the probability of occurrence of
the harm, or both.

Are there instructions for when risk control measures would likely reduce the probability Vs other types of controls that reduce the severity? 

Thanks!

ISO 14971 provides general guidance on risk management for medical devices, including risk control measures. The standard states that risk control measures can be used to reduce the severity of harm or the probability of occurrence of harm, or both, depending on the specific risk.

However, the standard does not provide specific instructions or criteria for when risk control measures would likely reduce the probability versus other types of controls that reduce the severity. The choice of risk control measures will depend on the specific device and the risks associated with its use. The standard emphasizes that the choice of risk control measures should be based on a risk assessment that takes into account factors such as the severity of harm, the probability of occurrence, the state of the art, and the intended use of the device.

In general, risk control measures that aim to reduce the probability of occurrence of harm may include design features that reduce the likelihood of user errors or device malfunctions, warning labels or instructions for use that increase user awareness of potential hazards, and regular maintenance or calibration to ensure proper device functioning.

On the other hand, risk control measures that aim to reduce the severity of harm may include physical barriers or protective equipment that limit the extent of injury in the event of an accident, such as impact-resistant shields or airbags in automobiles, or redundant safety features that provide backup systems in case of device failure.

Ultimately, the choice of risk control measures will depend on the specific device, the risks associated with its use, and the intended users and environments in which it will be used.

Based on ISO 14971 Risk control measures can reduce the severity of the harm or reduce the probability of occurrence of
the harm, or both.

Are there instructions for when risk control measures would likely reduce the probability Vs other types of controls that reduce the severity? 

Thanks!