Some Considerations on Risk Management According to ISO 14971 for Medical Devices in Peru
Q.F. Walther Ricardo Vicente Mallma
Associate Consultant and Medical Devices Regulatory Affairs Coordinator
SCR Consulting Peru
ABSTRACT
The risk management report is one of the regulatory requirements for the registration of medical devices in Peru. According to Supreme Decree 016-2011-SA: Regulation for the Registration, Control and Sanitary Surveillance of Pharmaceutical Products, Medical Devices and Health Products and its subsequent amendments, this document must comply with the applicable ISO standard, with ISO 14971 being currently required. This article aims to provide guidance on how to approach this document, outlining the stages involved in the risk management process and emphasizing the importance of this document for people’s health.
Keywords: Risk, hazard, hazardous situation, harm.
As its name indicates, the international standard ISO 14971: Medical devices – Application of Risk Management to Medical Devices provides guidance and direction regarding the risk management process for medical devices. In this article, we will address some relevant aspects that will allow for a better understanding of this standard, as well as its significance in relation to national public health.
Therefore, it is essential to have a clear understanding of the exact concept of the term ‘risk.’ The Royal Spanish Academy (RAE) defines it as the ‘contingency or proximity of harm’; on the other hand, ISO 14971 defines it as the combination of the probability of occurrence of harm and the severity of that harm; and finally, Peruvian regulations,according to Supreme Decree 003-2020-SA: Regulation that establishes the classification rules and essential principles of safety and performance of medical devices, define it as the combination of the probability of harm occurring and the severity of that harm. According to these definitions, it is observed that the Peruvian regulation’s definition is the same as that of ISO 14971, and for regulatory purposes, this definition will be adopted.
Not being able to estimate or control a potential risk can result in harmful events for patients, who could be a family member, acquaintance, or even ourselves. This is where the importance of risk management in public health lies. The purpose of risk management is to identify, assess, analyze, evaluate, and mitigate potential issues with medical devices. Each of these stages will be reviewed in detail in the following sections.
As can be seen in Illustration 1: Overview of the Risk Management Process, the risk management process is composed of 7 stages, which do not necessarily have only one beginning and one end, but these stages are cyclical since new risks may be found or occur during the production stage or during the marketing stage of the medical device.
(own authorship)
- 1. Risk management plan
It mainly identifies the activities to be performed in risk management throughout the product’s life cycle. It also defines the roles and responsibilities of each member in charge of elaborating the risk management document, as well as sets the criteria to be used at each stage of the risk management process.
- 2. Risk analysis
As a first step to carry out the risk analysis, it is important to define the use that the medical device will have, since the hazards associated with its use, including inappropriate uses, will be identified on the basis of such use.
For the identification of hazards, it is important to know the indications for the use of the device, so that potential hazards can be identified at each stage of use. These hazards generally focus on patient harm; however, harm to users, the place of use and the environment must also be considered.
As well as the identification of hazards, the identification of hazardous situations is crucial in the analysis. These hazardous situations are preceded by a predictable sequence of events. For example, a hazardous situation could be a generalized infection in a patient and in this particular case the sequence of events could start with mishandling or incorrect storage of a surgical device, which is sterile, leading to contamination of the device, which ultimately results in infection of the patient. Each hazardous situation can have multiple hazards.
Finally, for each identified hazard, its risk needs to be estimated. Therefore, in order to estimate risks, descriptions are usually defined for various levels for both severity and occurrence (see Table 1: Severity and occurrence levels); these descriptions are defined by the manufacturer. Remember, risks are defined as the combination of the probability of harm occurring and the severity of that harm.
Finally, the final estimate will be made by crossing the information on both severity and occurrence and this can be done using a Risk Acceptability Matrix, where the risks are finally estimated as low, medium or high or with another category assigned by each manufacturer. The following table (Table 2: Risk Acceptability Matrix) provides an example of the above-mentioned matrix using the criteria adopted in Table 1:
- 3. Risk evaluation
At this stage, it is necessary to assess whether the risks are acceptable or require risk reduction. Generally, the green areas of the risk acceptability matrix are defined as acceptable, the red areas as unacceptable, and the orange areas as ‘as low as reasonably practicable,’ commonly known by the term ALARP (As Low As Reasonably Practicable). It is worth mentioning that, in the European regulations, which our regulations are generally based on, there is a requirement to reduce risks as much as possible. This means that even risks assessed as acceptable must still be considered for further reduction.
- 4. Risk control
The measures taken to reduce unacceptable risks are referred to as risk control. Risk control should have a more significant impact on the probability of harm occurring, as reducing the severity of a hazard is more plausible in practice. Many of the measures adopted in risk control are reflected in the addition of warnings or precautions in the instruction manuals of medical devices.
After implementing risk controls, the residual risks must be assessed to determine if they are all acceptable, and if any are not, other means to reduce those risks must be identified. However, there may be risks that remain unacceptable, and in such cases, a risk-benefit analysis must be conducted. An unacceptable risk may be considered acceptable if the benefit outweighs the risk, based on objective evidence and without financial reasons.
5. General risk evaluation
This is the stage where the overall risk of the product is evaluated as acceptable or unacceptable, based on the individual assessment of each risk.
- 6. Risk management revision
This is the stage where a review of all the activities in the risk management process is conducted, and where all the results will finally be documented in a Risk Management Report
- 7. Production and post-production information
As initially mentioned, the risk management process is cyclical; for practical purposes, it is a living document that must be constantly updated based on new information acquired during production processes or from the market itself. Hazard identification initially is based on the design of the medical device, but generally, these hazards represent only about two-thirds of the total hazards, as the remaining third often appears during the post-market stage, where conditions differ from those in laboratories.
After reviewing the risk management process according to ISO 14971 for medical devices in Peru, it is evident that our regulations are based on international standards, which denotes a genuine interest for public health in the country, since the medical devices entering Peru will comply with the minimum necessary conditions that will guarantee their safety. As could be seen in this analysis, knowledge of the structure of ISO 14971 (Medical Devices – Application of Risk Management to Medical Devices) is of vital importance to comply with the regulatory requirement requested by DIGEMID.