ISO 14971 – Risk Management

ISO 14971 – Medical Devices – Application of risk management to medical devices

The requirements contained in the current version of ISO 14971 provide manufacturers with a framework within which experience, insight and judgement are applied systematically to manage the risks associated with the use of medical devices.
ISO 14971 was developed specifically for medical device/system manufacturers using established principles of risk management. For other manufacturers, for example, in other healthcare industries, this international standard could be used as informative guidance in developing and maintaining a risk management system and process.
ISO 14971 deals with processes for managing risks, primarily to the patient, and also to the operator, other persons, other equipment and the environment.

6 phases

The six phases of the risk management process are: risk analysis, risk evaluation, risk control, evaluation of overall residual risk acceptability, risk management report and production and postproduction information. During the implementation of risk control measures, it is possible that
additional risks are introduced to the device, and these risks should be subjected to the risk management process like all other risks. In addition, it is possible that risks are only identified once the device has entered production, and therefore, it is necessary to control these risks if and when
they arise. The risk management process and its iterative nature are shown in the Figure below and covered in the standard.

ISO 14971 process

ISO 14971 process


Each phase In details


Each of the phases of the risk management process is outlined as follows:
Risk analysis: During the risk analysis phase, all possible hazards of the medical device are identified.
These hazards are then evaluated in terms of the probability of occurrence and the severity of harm.
The standard does not specify metrics to use for evaluating the probability and severity of harm allowing organisations to select a method that is most suited to them. The organisation may choose to do this evaluation either qualitatively or quantitatively depending on the device under development
and the organisational culture.
Risk evaluation: Using the probability of occurrence and severity of harm, the organisation must determine if risk control measures are necessary. If there is a low probability of harm and the resulting harm is not severe, then an organisation may decide that the risk is acceptable. The level of risk that
is acceptable can be dependent on the benefits afforded by the medical device and therefore can vary between devices. For example, the level of acceptable risk associated with a computerised tomography scanner would be higher than that of a blood pressure monitor as the benefits afforded by the computerised tomography scanner would be greater.
Risk control: Once it has been determined that a risk is unacceptable, the organisation has a responsibility to implement a risk control measure to address that risk. The standard outlines three broad categories of risk control:

  1. Inherent safety by design;
  2. protective measures in the medical device itself or in the manufacturing process; and
  3. information for safety.

Each risk that requires control should apply one of these options, using the priority ordering outlined previously, that is, if possible, address the risk through inherent safety by design; if not possible, then the risk should be controlled with protective measures, and finally if this is not possible, then the organisation should provide information relating to the risk.
When a risk control measure is implemented, the organisation has a responsibility to ensure that no residual risk is present in the device. If there is residual risk, then the organisation should subject these risks to the risk management process.
Evaluation of overall residual risk acceptability: Once all risk control measures have been controlled, the organisation must review the remaining risks to determine if they are acceptable. If they are not, the organisation should determine if the benefits of the medical device outweigh the risks associated with the device.
Risk management report: Before the product is released, the organisation should carry out a review of the risk management process and produce a risk management report. As part of this review, the organisation should ensure that the risk management process has been carried out appropriately, the overall residual risk is acceptable and the appropriate mechanisms are in place to obtain relevant information related to safety during production and post-production.
Production and post-production. During these phases of the product life cycle, the organisation should monitor the medical device to ensure that no previously unrecognised hazards or hazardous situations are present, and that the estimated risk arising from a hazardous situation are still acceptable. If this is not the case, the information should be fed back into the risk management process.

If you need some help for the implementation of ISO 14971 please contact us for a preliminary discussion.