Nine Best Practices For Creating And Implementing A Risk Management Plan
Executive Summary
As regulatory scrutiny increases, device manufacturers are putting added emphasis on risk management to avoid expensive remediation, reputational damage, and, more importantly, negative impact on safety. Methodical risk management also offers many other benefits, such as information for new product development, business expansion, and improved decision-making.
One of the biggest risks medical device manufacturers can take is conducting a less-than-thorough risk assessment and management process. In the past 10 years, there has been example after example of the expense and reputation-damaging effects that accompany poor risk management. Companies including Allergan, Medtronic, Edwards Lifesciences, Zimmer Biomet and many others have spent millions of dollars on remediation initiatives during that time—money that could have been saved with better risk management efforts.
Now, with increased scrutiny from regulatory bodies, including updated, more stringent International Organization for Standardization (ISO) standards and the European Union Medical Device Regulation (EU MDR) certification process, it is even more essential for manufacturers to get risk management right. Typically, failure to conduct thorough risk management leads to playing catch-up on difficulties that arise after launch and spending millions that otherwise could have gone to developing innovative products.
Unfortunately, simply putting more focus on risk management is not enough. Companies need to implement the most effective form of risk management and put it at the core of all their operations to give themselves the best chance for success.
Why Holistic, Methodical Risk Management?
When managing risk today, companies that don’t implement a systematic approach and make risk management a central part of all operations risk negative consequences.
For example, in 2017 Zimmer Biomet had to launch a potentially reputation-damaging recall of 33 implantable spinal fusion stimulators after a routine monitoring procedure found the products contained high levels of potentially harmful chemicals. The FDA said the use of the stimulators could lead to chronic infections, additional surgical procedures, paralysis, and even death. Zimmer Biomet quickly sent notices to customers to quarantine the products until company sales representatives could remove them from their premises.
In 2019, Edwards Lifesciences informed users that fluids leaking into the AC power outlet of its blood pressure and pulse monitors posed an electrical short circuit risk that could ultimately cause a fire. The FDA said the devices posed the risk of serious injury to patients and healthcare professionals, including electrical shock, burns, cardiac arrest, or death. (Also see "US FDA Announces Class I Recalls For Integra, Edwards Surgical Devices" - Medtech Insight, 24 May, 2019.)
Holistic, methodical risk management carried out from the beginning of the product life cycle is designed to prevent incidents like this from occurring. This risk management approach helps ensure that a medical device manufacturer assesses risks proactively and takes steps to reduce and even eliminate the risks before damage is done. Companies avoid remedial activities that zap earnings and manpower, shorten regulatory clearance times, and ensure conformance—all while boosting company credibility and brand reputation.
What A Good Risk Management Plan Looks Like
Methodical risk management applies to all stages of a product's lifecycle and covers the potential hazards associated with the device, user, patient, and environment. It also includes production and post-production surveillance to ensure that risk management is always up-to-date and accurate. In addition, methodical risk management utilizes effective techniques like the following:
Preliminary hazard analysis. This screening process is conducted early in the product life cycle. It is designed to identify dangers, hazardous circumstances, and events that can cause harm at a time when many details of the medical device may still be unknown.
Hazard and operability study. This is a structured examination of an entire facility or system. It is commonly used in the early phases of the development process to investigate deviations from expected performance and to identify hazards to personnel, equipment, and the environment.
Hazard analysis and critical control point (HACCP). This system utilizes a comprehensive, seven-point system to identify hazards. It is often used in the later phases of the development process to test and then optimize design concepts or changes.
Fault tree analysis. Also known as event tree analysis, this system is used to identify the causes of a system failure. It is valuable in safety engineering early in the development process for identifying and prioritizing hazards, hazardous circumstances, and potential risk control methods and for analyzing the consequences of adverse circumstances.
Failure mode effect analysis (FMEA). Developed by the U.S. military in the 1940s, FMEA is designed to identify potential failures that could result in product malfunctions, inadequate product life, reduced process reliability, customer discontent, and more.
In addition to these components, sound risk management requires a closed-loop feedback mechanism. This helps manufacturers understand the shortcomings of a product and determine whether it is performing as intended and being used as intended. This mechanism enables manufacturers to determine whether product enhancements or corrections are needed.
How To Implement Holistic, Methodical Risk Management
-
Start immediately. Begin early in the product life cycle and proceed with a disciplined approach. Risk management efforts should be proactive instead of reactive.
-
Do the research. If a new product is being developed, it is important for the company to review what information is already available on similar devices, what literature is available to review, whether user surveys can be conducted, and what expert judgement could be gathered. This information can be leveraged to estimate risk proactively rather than starting the risk management process after launch when complaints start coming in.
-
Write it down. Always document the extent of intended risk management actions, defining and explaining the medical device and the life cycle stages to which each aspect of the plan applies.
-
Be precise. Clearly define roles and responsibilities for everyone involved in the risk management process so there is no confusion and no details that can fall between the cracks.
-
Use the right tools. Determine what risk analysis and hazard identification tools will be employed. Examples of tools that can be used include preliminary hazard analysis; hazard and operability study; HACCP, FMEA of design, software, and process; usability risk analysis; and fault tree analysis.
-
Know the risks. Specify risk acceptability criteria for individual and overall risks, as well as a method to evaluate residual risks against the benefits of the device. Also, list activities for verifying effectiveness and implementing risk control measures and include a mechanism to collect and review production and postproduction information.
-
Update frequently. Risk management files are living documents, and risk estimates are snapshots in time. That means risk files need to be regularly and consistently reviewed to ensure their accuracy. The frequency of these reviews should be defined in the risk management plan.
-
Don’t forget security. Consider cybersecurity, software verification and validation, and essential software characteristics in the risk management plan if it applies to the device.
-
Keep track of changes. If the plan changes during the medical device's life cycle, it is important to keep a record of the updates in the risk management file.
Following these nine steps can help ensure that medical device companies routinely gather the evidence they need to determine how well a product fulfilled its intended usage. This information aids manufacturers in ensuring that their products are effective, safe, and performing as intended. It can also help them prepare for any unanticipated failures that may be discovered and rectify any existing problems.
Companies can avoid nonconformance and liability issues, as well as identifying counterfeit products. They can also use risk management data to uncover potential for new products, find ways to expand their businesses, and make informed decisions for any necessary field actions. More importantly, this can help manufacturers understand that the device is safe and effective.
Put Risk Management At The Forefront Of Operations
When creating a methodical risk management process, it is important to understand that what worked for one device may not work for another. In other words, for each new product, the risk management process should be created from the ground up, considering the product’s intended use, where and by whom it will be used, and other essential factors.
More tips for success include making sure that risk management receives feeders from all operations, that all appropriate data collection sources are identified, and that a feedback loop system is established for product and postproduction activities. A periodic review schedule to assess the ongoing effectiveness of risk analysis is also essential.
One more thing to keep in mind: it is important for company officials to understand the differences between quality and risk management. Quality management is focused on testing and improving processes that directly affect operations and product quality. Risk management is monitoring and mitigating risks in a product’s development cycle.
While quality and risk management are closely related, the differences make it vital that companies don’t simply rely on quality management to manage risk. Companies need a comprehensive risk management process used throughout the product lifecycle to address hazards resulting from interactions between the patient, user, environment, and devices.
The bottom line is that companies should start risk management as early as the device development phase, including developing a schedule to assess risk analysis consistently. Given the regulatory, reputational, legal and medical risks posed by faulty devices, it is crucial for businesses to place risk management at the center of all operations and adopt a mindset and culture that values transformation and prioritizes risk management in all activities. Anything less and companies jeopardize falling behind competitors and losing market share in the rapidly evolving medical device industry.
About the Author: Mruga Patel is the manager of design quality engineering at a leading medical device manufacturer and has more than 10 years of experience in the medical device industry. Mruga is a subject matter expert on risk management and manages a team of engineers that oversees a wide variety of product portfolios. She has experience in the design and development of medical devices (class I, II and III implants and instruments), fielding notified bodies and FDA audits, supplier qualification and audits, and conducting internal audits. For more information, contact [email protected].