ISO 14971: medical device risk management explained

Risk management is the thread linking a medical device's design, manufacture and life on the market. The ISO 14971 standard sets the process, and the MDR makes it a general requirement. This guide presents the steps and the points a notified body examines.

The standard and its status

ISO 14971:2019 is the third edition of the standard. It applies to all medical devices, including software and in vitro diagnostic devices. Its application guidance is the technical report ISO/TR 24971:2020.

In Europe, EN ISO 14971:2019/A11:2021 is harmonised under the MDR and the IVDR: applying it gives a presumption of conformity with the general safety and performance requirements it covers. Its Annex ZA maps its clauses to MDR Annex I.

Key vocabulary

• Hazard: potential source of harm.
• Hazardous situation: circumstance in which people, property or the environment are exposed to one or more hazards.
• Harm: injury or damage to the health of people, or damage to property or the environment.
• Risk: combination of the probability of occurrence of harm and its severity.
• Residual risk: risk remaining after risk control measures have been implemented.
• Benefit: positive impact or desirable outcome of using the device on a person's health.

Top management responsibilities

Before the process itself, top management must:

• provide sufficient resources and competent people;
• define and document a policy establishing criteria for risk acceptability, taking into account the state of the art and known stakeholder concerns;
• periodically review the suitability of the risk management process.

The process, step by step

1. Risk management plan

For each device: the scope and life-cycle phases covered, assignment of responsibilities, review requirements, risk acceptability criteria (including for overall residual risk), verification activities and how production and post-production information will be collected.

2. Risk analysis

• Describe the intended use and reasonably foreseeable misuse.
• Identify characteristics related to safety.
• Identify hazards and hazardous situations, in normal and fault conditions.
• Estimate the risk of each hazardous situation: probability and severity of harm.

3. Risk evaluation

Compare each estimated risk with the plan's acceptability criteria to decide whether it must be reduced.

4. Risk control

Risk control measures apply in an order of priority:

1. inherent safety by design and manufacture;
2. protective measures in the device or its manufacturing process;
3. information for safety, and where appropriate user training.

Each measure is verified: implementation and effectiveness. The residual risk is then evaluated, a benefit-risk analysis is performed where it is not acceptable under the criteria, and risks arising from the measures themselves are assessed.

5. Overall residual risk

Once all measures are in place, the manufacturer evaluates the overall residual risk against the benefits of the intended use, with the method and criteria set in the plan. Significant residual risks are disclosed to users.

6. Risk management review

Before market entry, a review checks that the plan has been implemented, that the overall residual risk is acceptable and that methods are in place to collect production and post-production information. Its conclusions are recorded in the risk management file.

7. Production and post-production activities

The process does not stop at CE marking. The manufacturer collects and reviews information from production, complaints, vigilance, literature and the state of the art, then re-evaluates risks and updates the file. This is the link with post-market surveillance.

What the MDR adds

MDR Annex I makes risk management a general requirement:

• risks must be reduced as far as possible without adversely affecting the benefit-risk ratio;
• the manufacturer establishes, implements, documents and maintains a risk management system, a continuous iterative process throughout the life cycle;
• post-market surveillance information feeds this process.

These are the points on which Annex ZA of EN ISO 14971:2019/A11:2021 clarifies how the standard and the regulation fit together.

Links with other standards

• ISO 13485: risk management applies to product realisation (§ 7.1) and to quality system processes.
• IEC 62366-1: usability engineering addresses use-related risks.
• IEC 62304: a software safety class depends on the harm a failure could cause.
• ISO 10993-1: biological evaluation sits within the risk management process.
• Cybersecurity: IT security threats are treated as sources of hazards.

Frequent findings

1. Acceptability criteria missing or inconsistent with management's policy.
2. A frozen analysis, never updated with post-production data.
3. Information for safety used as the first measure, when it comes last.
4. Effectiveness of measures not verified.
5. Overall residual risk not evaluated, or evaluated without a defined method.

Risk management standards and their link with the MDR evolve with the state of the art: following them is part of medical device regulatory monitoring.