Regulatory Open Forum

 View Only
  • 1.  Risk Management SOP

    Posted 20-Jun-2023 16:44

    Are we supposed to have all participants in the hazard analysis thoroughly trained in risk management SOP ? I have the SOP, but the employees have not been trained on it. 



    ------------------------------
    Nawal Tiouri
    Quality & Regulatory Engineer
    Ypsilanti MI
    United States
    ------------------------------


  • 2.  RE: Risk Management SOP

    Posted 21-Jun-2023 01:24

    Hello Nawal,

    The simple answer is yes.  A risk management SOP is like any other standard operating procedure in the quality system.  If individuals are following a procedure, must adhere to work instruction, use a process defined by a SOP, then the expectation is they are trained on the procedure and training documented.



    ------------------------------
    Richard Vincins ASQ-CQA, MTOPRA, RAC
    Vice President Global Regulatory Affairs
    ------------------------------



  • 3.  RE: Risk Management SOP

    Posted 21-Jun-2023 01:42
    Edited by Carolin Bombeck 21-Jun-2023 01:42

    Dear Nawal,

    I fully agree with Richard.

    ISO 14971:2019 requires management to assign "competent personnel (see 4.3) for risk management". This means that "Persons performing risk management tasks shall be competent on the basis of education, training, skills and experience appropriate to the tasks assigned to them. Where appropriate, these persons shall have knowledge of and experience with the particular medical device (or similar medical devices) and its use, the technologies involved, or the risk management techniques employed. Appropriate records shall be maintained. NOTE Risk management tasks can be performed by representatives of several functions, each contributing their specialist knowledge." This paragraph does not directly refer to the training of the Risk Management SOP, but nevertheless the RM participants have to know the process and the requirements according to the standard. After all, the team is responsible for assessing the risks that may affect the safety of patients, users and third parties.

    If you have implemented a QMS according to ISO 13485, this also places requirements on the training and competencies of employees performing work affecting the product quality (Chapter 6.2), which is indeed the case in the context of the introduction of risk control measures. Paragraph b) then specifically describes "provide training or take other actions to achieve or maintain the necessary competence."

    Thus, the participants of the risk management should be trained accordingly on the SOP.


    ------------------------------
    Carolin Bombeck
    Lübeck
    Germany
    ------------------------------



  • 4.  RE: Risk Management SOP

    Posted 22-Jun-2023 10:57

    Why do employees have to be "trained" on the SOP? Isn't the whole purpose of the SOP to describe steps and provide guidance on how to perform relevant tasks and activities?

    They should be competent and maybe trained on the process, or certain aspects of it, but forcing every employee that may have direct or indirect interaction with the process to train on a procedure (and worse, annually re-train) is a tremendous waste of time and resources.



    ------------------------------
    Michael Zagorski RAC
    Director of Regulatory Affairs
    Pittsburgh PA
    ------------------------------



  • 5.  RE: Risk Management SOP

    Posted 21-Jun-2023 08:32

    There is not a requirement to train on the entire risk management process. If you go to ISO TR 24971:2020 4.3 there examples of the competencies for various functions associated with the risk management system. 

    All companies implementing ISO 14971 risk management systems should have access to this 85-page invaluable reference written by the technical committee that developed ISO 14971:2019, the medical device risk management standard. 



    ------------------------------
    Edwin Bills
    Edwin Bills Consultant
    ASQ Fellow CQE, CQA, CQM/OE, RAPS RAC
    elb@edwinbillsconsultant.com
    ------------------------------



  • 6.  RE: Risk Management SOP

    Posted 21-Jun-2023 08:38

    Hi Nawal

    @Edwin Bills  makes a good point here. Training is only one aspect of competence.

    Those involved in any aspect of risk management should be trained in the overall SOP. But that does not mean they are competent in specific risk management activities such as hazard analysis. 

    There may be confusion about the term hazard analysis. Hazard analysis is one aspect of risk analysis. Risk analysis involves risk identification and risk estimation. Identifying hazards and hazardous situations are one aspect of risk identification. You should look at your process of risk identification to see who is involved and how their specific expertise contributes to this step in the risk management process. Generally speaking, risk analysis is done in a cross functional setting with experts representing different functions such as R&D, Engineering, Quality, Medical Safety, Regulatory etc. 

    I don't mean to make it sound complex; but the key point here is that training is not equal to competence. 



    ------------------------------
    Naveen Agarwal, Ph.D.
    Problem Solver | Knowledge Sharer.
    Let's Talk Risk!
    @https://naveenagarwalphd.substack.com/
    ------------------------------



  • 7.  RE: Risk Management SOP

    Posted 21-Jun-2023 10:53

    Yes. People who participate in a QMS activity should be trained on your company's SOP. Consider, for example, a risk management system that follows ISO 14971:2019. It provides the steps but leaves the details up to the company. For example, the risk matrix is usually specific to a company based on the risk management policy.

    FDA QSR 820.25(b) asks each manufacturer to, "establish procedures for identifying training needs and ensure that all personnel are trained to adequately perform their assigned responsibilities".



    ------------------------------
    Dan O'Leary CQA, CQE
    Swanzey NH
    United States
    ------------------------------



  • 8.  RE: Risk Management SOP

    Posted 21-Jun-2023 12:26

    @Dan O'Leary states you should be following 21 CFR 820. 25 b). But as the Proposed QMSR is expected to be released in December according to FDA, perhaps you should be moving to the more modern requirements in ISO 13485 6.2 for "a) determine the necessary competence..." and "b) provide training or take other actions to achieve or maintain the necessary competence." 

    @Naveen Agarwal also states, perhaps reflecting on the differences between the CFR and 13485,  "Training is only one aspect of competence".  He goes on to say, correctly, [Training] does not mean they (those trained) are competent in specific risk management activities.  

    The position of the ISO TC 210 JWG1 technical committee on ISO 14971 is reflected in ISO TR 24971:2020 4.3 where we discuss: Note  Risk Management tasks can be performed by representatives of several functions, each contributing their specialist knowledge.  In our discussion in the technical committee we felt that those "representatives of several functions" did not need to know everything about all of risk management, but rather should be competent in the contributions from their specialist knowledge.

    So the bottom line is that those performing risk management activities need to know their responsibilities in sufficient depth to perform those responsibilities in risk management.  To know how their contributions fit in the process, then some training on the complete process may be required.  But you need to identify the necessary competence as required in ISO 13485 6.2 a).



    ------------------------------
    Edwin Bills
    Edwin Bills Consultant
    ASQ Fellow CQE, CQA, CQM/OE, RAPS RAC
    elb@edwinbillsconsultant.com
    ------------------------------



  • 9.  RE: Risk Management SOP

    Posted 22-Jun-2023 05:40

    Dear Nawal

    As several replies have pointed out, you do not need to have all the employees involved in the hazard analysis as experts in the risk management process, but they need to be trained and deemed competent for their role in the hazard analysis process. This then implies that the roles and responsibilities for the various team members need to be clearly defined in your procedure and associated training.

    And following on from Ed Bills' 2nd reply citing ISO TR 24971:2020, that also likely includes the pre-requisite for their involvement in the hazard analysis team (e.g. their expertise/competence in a specific topic relating to the hazard analysis such as the clinical use of the device). In the EU, we have seen an increase in the times that this question is asked by Notified Body auditors (e.g. Who is providing the clinical knowledge in this team? Who understands how the device is manufactured?).


    Regards

    Ed



    ------------------------------
    Ed Ball
    Manager, Intelligence & Innovation
    United Kingdom
    ------------------------------