|
3 min reading time
During the next three years I guarantee that every single medical device manufacturer will eventually become sick and tired of hearing the phrase “risk-based approach.” I’ve been there for about 5 years, but there are a few new updates to the standards and regulatory requirements that are worth mentioning: – The European national version of ISO 14971 (i.e., EN ISO 14971:2012) is causing many manufacturers to respond to Notified Body audit findings to address the 7 deviations identified in Annexes ZA, ZB and ZC.. – ISO 9001 is being revised to emphasize a risk-based approach (i.e., ISO 9001:2015). – ISO 13485 is being revised to emphasize a risk-based approach (i.e., ISO 13485:2016). For medical device manufacturers, have there been any significant changes to the regulations? No. No changes to the MDD, AIMD or the IVDD. Revisions are being negotiated between the EU Parliament and the Council, but the earliest possible draft would be April 2016. Implementation would be fall of 2016 with a 3-year transition period–at the earliest. Minor change to Canadian MDR in July 2015, but not affecting the application of risk management. No change by the FDA to 21 CFR 820. So what’s the big deal? Definitions, how many times the word “risk” appears in the Standards and the emphasis upon risk management by quality system auditors. First, ISO 9001 has a new proposed definition for risk. Unfortunately, the definition is not even close to the ISO 14971 definition. This is one of many reasons I think ISO 9001 certification will be practical for most medical device companies in the future. In addition, ISO 9001:2008 used the word “risk” only 3 times while the proposed draft of ISO 9001:2015 includes 43 instances of the word “risk.” Second ISO 13485 continues to reference ISO 14971, and the definition of risk has not changed, but the usage of the word “risk” has increased from 4 to 47 times in the latest draft of the Standard. By way of comparison, 21 CFR 820 only uses the word “risk” once. If you want to apply a risk-based approach you have to do two things. First, you need to be able to estimate the severity of quality issues. Second, you need to be able to estimate the probability of occurrence for those quality issues. If you are going to take a risk-based approach to quality system management, you need to monitor and measure the actual frequency of occurrence for those quality issues and verify that the severity of the problems is really as terrible as you thought it would be–and not worse. Then you need to implement risk controls to reduce those risks. Therefore, I anticipate most companies will beef up their monitoring and measuring of quality system processes (Clause 8.2.3), analyze more data (Clause 8.4), apply statistical techniques (21 CFR 820.250) and implement corrective actions in a timely manner (Clause 8.5.2/8.5.3 and 21 CFR 820.100). None of this is really new, but auditors will beat this drum really hard for the next three years. Next Tuesday, September 29, Joe Hage will be hosting a free live webinar with Green Light Guru on the topic of “Risk Management for Medical Devices: An Overview of ISO 14971 & How To Apply a ‘Risk Based Approach’ to Your QMS Processes to Address the Upcoming ISO 13485 Changes.” In order to register for the webinar, please click on the following link to register for the presentation: http://medgroup.biz/ISO-13485-webinar. If you are interested in reading more about the application of risk management to medical device manufacturing, you might try reading some of my 13 blogs on the topic: http://medicaldeviceacademy.com/category/risk-management/. source: https://www.linkedin.com/groups/2070960/2070960-6052448567082176516 Marked as spam
 Posted by Asked on September 23, 2015 12:00 am
671 views
|
Meet your next client here. Join our medical devices group community.
Private answer
Clarisa Tate
Thank you for the blog; good info. I know 21 CFR 820 doesn't really point to risk the way ISO 13485 does. We all know it takes a lot to make changes to the CFR so FDA tend to create or update guidances instead. Wouldn't it be appropriate to look at that too besides ISO 14971? For example: there are risk-related guidances both at premarket review and at postmarket application. Here are examples of FDA draft guidances they've wrote about regarding risks:
http://www.fda.gov/ucm/groups/fdagov-public/@fdagov-meddev-gen/documents/document/ucm451440.pdf http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/UCM404773.pdf http://www.fda.gov/ucm/groups/fdagov-public/@fdagov-drugs-gen/documents/document/ucm155480.pdf I just find it interesting that both the EU and US are focusing on risk (management of it, how industry presents it, etc.) more and more in the past few years. Marked as spam
|
|
Private answer
Somashekar BV
Risk based thinking (RBT) is applied at every element of the QMS to enhance the success of the company and its QMS operation.
The 14971 targets the risk to patient and user of the medical device which one has to consider throughout the medical device life cycle. Both are mutually exclusive. Both have the target risk areas defined, and they can easily coexist. RBT / Risk based approach does not call out for any specific way of documentation, and therefore the company can choose any which was to address risks. The 14971 gives guidelines of how the risks have to be documented and the risk document kept live ... Marked as spam
|
|
Private answer
Thobekile Nkala
Thanks guys where can I access the ISO 13485 draft I need to consult for my thesis. I am looking at the drug-device combination products Drug Eluting Stents in particular, how the regulatory pathway has evolved since the launch of Cypher (first in market) both in the US and EU. Just wondering if the proposed draft has impact on combination products, Joe Hage mentioned changes to the CE marking. Please help I would like to have a read of that.
Marked as spam
|
|
|
Private answer
Dr. Patrick Druggan
There is so much that can be done to quantify risk and to reduce it. We've been mapping design space for sealing processess of sterile barrier systems and determining their assurance level. It is about assigning the consumer risk to below improbable based on the classification in ISO 14971. Too many organisations simply QC products, and do not use statistical analysis to determine the probability of a customer receiving a defective product. This needs to change.
Marked as spam
|
|
|
Private answer
Anil Bhalani
The FDA uses the term "safe and effective". It is legally stronger and is the reason why compliance to FDA is perceived to be more valuable than any ISO certification and CE Mark. You can choose to get to making your device "safe and effective" by using a risk based approach or another.
The ISO committees in my opinion lack working experience and in no way match the education, skills and experience of the FDA. ISO should go back to ISO 13485: 2003 and also learn to write their documents in plain 8th grade English. Marked as spam
|
|
Private answer
Pedro Fregoso
Nice summary Robert,
I am not convinced that an ISO 9001 certification would be practical for Medical Device companies just to satisfy the proposed definition for risk since ISO 13485 is based on ISO 9001. By ISO 13485 definition, all requirements specific to organizations providing medical devices, regardless of the type or size of the organization apply in this ISO 13485 International Standard. Thanks for sharing your summary and the related links. Marked as spam
|
|
|
Private answer
Ee Bin Liew
When the 13485 FDIS is available soon (not yet released), then all can take a look. There's a definition of risk within the context of the standard and should be used according to that context. Why is it important to refer to the FDIS? because it is the closest thing to the published revised standard as only editorial comments are allowed, and anything before that could have technical changes. Why is it important to use risk in the context of the definition within the standard? that's to minimise the number of interpretations out there (this is a huge problem nowadays) and allow us to converge towards one way of working/thinking.
putting it simply, risk management is your way of working on weighing pros and cons of everything. Having a greater focus means standards and regulations are trying to be less prescriptive in certain areas for organisations to take more self-responsibility, and also highlights to organisations the need to take this weighing of pros and cons more seriously. Cheers, Ee Bin Marked as spam
|
|
Private answer
Marked as spam
|
|
Private answer
Hans Jörg Müller
Have dealt with risk management issues already for many years my opinion is that companies should be advanced of the regulations. You do risk because you want to prevent damage and lower risk aspects in the productions and other processes and not because the norm tells you to do it. The customer usually reacts more quickly than the norms. If the customer does not make a longer constract with you because of risk problems it is very hard to get him back - so prevention is a very sucessful risk strategy
Marked as spam
|
|
Private answer
Edwin Bills, ASQ Fellow, RAC
ISO 13485 FDIS has been sent to ISO for publication. We should see it soon. There are some nice tables in the Annexes for comparisons to the 2003 edition and also to the 9001 2015 edition, as well as to the European directives. The published FDIS will include Z Annexes as the CEN version was developed in parallel with the ISO version.
Marked as spam
|
|
|
|
|
Private answer
David Turner
I think most robust QMSs (I prefer to call it a Business Management System - BMS - by the way) already consider risk at multiple levels, but some don't always take it to the level being suggested by the writers of the ISO standards. For example, DFMEAs are commonly used during the design phase, and PFMEAs are used during the process development phase. But whether we realize it or not, we assess risk during the validation process by completing GR&Rs, and risk is calculated during calibration via "measurement uncertainty". Examples of more subtle risk management applications include the following (just to name a few): (1) Internal Audit scheduling should be based on risk, which has been suggested in the wording that organizations schedule audits "based on status and improtance of the activity". If a process fails to work properly or if the procedures are not followed and the consequence is litigation, injury, or death, it would be deemed a high risk process, and therefore should be audited more frequently. (2) During contract review (for a contract manufacturer, for example), if acceptance of the PO has risk implications, we would want to know that going in...before acceptance of the PO. (3) Preventive Maintenance systems can look at probability and risk of equipment going down - from both a business perspective as well as a product liability perspective - and steps taken to mitigate that risk such as increasing frequency or looking at maintaining inventory of spare critical parts. (4) We can use risk analysis for developing training methods. If ineffective training methods will result in risk implications, we may increase the level of training by providing more, or more frequent training, or change the methods of proving competency before allowing the trainee to work independently. (5) Purchasing and supplier selection and supplier control are probably already risk-based for most of us, but we could add the record of evaluation to our records to demonstrate that we're excercising more control over those high risk suppliers or we've added verification steps to mitigate the risk.
These are just a few examples. The list goes on and on, but my point is that risk mitigation should be a part of every aspect of every business, and we can do this without adding substantial cost or complexity to our BMSs. Marked as spam
|
|
|
Private answer
Hans Jörg Müller
Usually norms are behind reality a few years - my experience show in med device that they started alreday risk management but on a low an unsufficient level - only after recall actions they improve risk management activities - and still no on conceptual bases not connected - you find hundreds of risk management projects in a single company but not a comitement from CEO to really work systematically on this topic
Marked as spam
|
|
Private answer
Marcus Gould
Further to your article Rob, the MHRA have just issued a guidance document detailing how risk based activities should be used for the implementation and maintenance of a QA programme in GLP facilities.
https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/464086/GLP_QA_programme.pdf Marked as spam
|
|
|
|
