ISO 14971 Risk Analysis File

The requirements contained in this International Standard provide manufacturers with a framework within which experience, insight and judgment are applied systematically to manage the risks associated with the use of medical devices.
ISO 14971 Standard was developed specifically for medical device/system manufacturers using established principles of risk management. For other manufacturers, e.g., in other healthcare industries, this International Standard could be used as informative guidance in developing and maintaining a risk management system and process.
ISO 14971 Standard deals with processes for managing risks, primarily to the patient, but also to the operator, other persons, other equipment and the environment.
As a general concept, activities in which an individual, organization or government is involved can expose those or other stakeholders to hazards which can cause loss of or damage to something they value. Risk management is a complex subject because each stakeholder places a different value on the probability of harm occurring and its severity.
It is accepted that the concept of risk has two components:
a) the probability of occurrence of harm;
b) the consequences of that harm, that is, how severe it might be.
The concepts of risk management are particularly important in relation to medical devices because of the variety of stakeholders including medical practitioners, the organizations providing health care, governments, industry, patients and members of the public.
All stakeholders need to understand that the use of a medical device entails some degree of risk. The acceptability of a risk to a stakeholder is influenced by the components listed above and by the stakeholder’s perception of the risk. Each stakeholder’s perception of the risk can vary greatly depending upon their cultural background, the socio-economic and educational background of the society concerned, the actual and perceived state of health of the patient, and many other factors. The way a risk is perceived also takes into account, for example, whether exposure to the hazard seems to be involuntary, avoidable, from a man-made source, due to negligence, arising from a poorly understood cause, or directed at a vulnerable group within society. The decision to use a medical device in the context of a particular clinical procedure requires the residual risks to be balanced against the anticipated benefits of the procedure. Such judgments should take into account the intended use, performance and risks associated with the medical device, as well as the risks and benefits associated with the clinical procedure or the circumstances of use. Some of these judgments can be made only by a qualified medical practitioner with knowledge of the state of health of an individual patient or the patient’s own opinion.
As one of the stakeholders, the manufacturer makes judgments relating to safety of a medical device, including the acceptability of risks, taking into account the generally accepted state of the art, in order to determine the suitability of a medical device to be placed on the market for its intended use. This International Standard specifies a process through which the manufacturer of a medical device can identify hazards associated with a medical device, estimate and evaluate the risks associated with these hazards, control these risks, and monitor the effectiveness of that control.
For any particular medical device, other International Standards could require the application of specific methods for managing risk.

Medical device manufacturers must develop a system to identify the dangers that a medical device poses, to predict the risks associated with these dangers, and to evaluate the controllability and the efficiency of the control. They must document and continue this system throughout the lifetime of the device. This process must include:
Risk analysis,
Risk evaluation,
Risk control,
Post-manufacturing and production information.

Professionals who know;
How the medical device is manufactured,
How the medical device works,
How the medical device is produces,
How the medical device is used in an application,
How the risk management process will be applied must be involved in this process.

For a medical device getting evaluated, the manufacturer must construct and preserve a risk management file. In addition to the requirements of other points of ISO 14971 standard, risk management file must include the items below to ensure the traceability of the risks.
Risk analysis,
Risk evaluation,
Application and verification of risk control precautions,
Evaluation of acceptability of risks
Note 1- Records and documents that form the risk management file, might compose a section of other files and documents required for the manufacturer’s quality management system. It is not necessary to have the physical copies of every record and document in the risk management file, however at least it has to have the indicator or the references to every required document.
Note 2- Risk management file can be in any shape or type.

Most of the time, there is more than one certain way to reduce a risk. There are three main mechanisms that are being used:
Inherent safety by design,
Protective precautions taken for medical devices and during the production
Safety information
These are the standard measures to reduce the risk. If applicable, the product must be designed to be safe. If there still are risks, protective precautions such as fences and alarms must be used. The least preferred precaution is a written warning or a contraindication.

Risk management report is the most important section of the risk management file. It is designed as the summary of all results of the risk management process. This report is the proof to demonstrate that the manufacturer is following the risk management plan and the results verify that the intended purpose of the system is achieved.

TıbbiCE Consulting, Training and Validation Services, offers consulting, training and validation services to domestic and overseas medical device producers during their CE and ISO 13485 Certification (93/42/EEC) process. With its expert staff from different backgrounds including but not limited to biology and biomedical, mechanical and metallurgy engineering, TıbbiCE Consulting, Training and Validation Services is the medical device consulting company with the largest expert staff in Turkey.

TıbbiCE Consulting, Training and Validation Services’ principle for product and quality management system is to give a “Purpose-driven, Solution and Customer Satisfaction Oriented” service that grounds on data confidentiality with its expert consultants.
We share the knowledge and experience we have gained in 9 years through working with more than 140 medical device producers and being involved in the CE and ISO 13485 Certification processes of more than 300 medical devices. We conduct the certification process professionally and aim to complete it in optimum time.