AAMI Risk Management Summit Risk Terminology and Expectations: A Regulatory Perspective

Size: px

Start display at page:

Download "AAMI Risk Management Summit Risk Terminology and Expectations: A Regulatory Perspective"

Deborah Cook
5 years ago
Views:

1 AAMI Risk Management Summit Risk Terminology and Expectations: A Regulatory Perspective Melissa Torres PMA/HDE Program Director (Acting) Office of Device Evaluation Center for Devices and Radiological Health 1

2 Overview Risk terminology Quality System (QS) regulation ISO 14971: 2007 GHTF guidance document Implementation of Risk Management Principles and Activities within a Quality Management System FDA guidance documents Benefit/Risk 2

3 FDA s Expectations for Risk Management Risk management activities should be integrated throughout a manufacturer s Quality Management System. Although the requirement for risk analysis is in design validation, risk management activities should begin early in the design and development process. 3

4 Risk Based Decisions in the QS Regulation and Preamble Scope 4, 13 Preamble Comment Design Controls 81, Purchasing Controls Traceability Production and Process Controls Nonconforming Products Corrective and Preventive Action (CAPA) Servicing 200 4

5 QS Regulation and Risk Analysis 21 CFR (g) Design Validation Each manufacturer shall establish and maintain procedures for validating the device design. Design validation shall be performed under defined operating conditions on initial production units, lots, or batches, or their equivalents. Design validation shall ensure that devices conform to defined user needs and intended uses and shall include testing of production units under actual or simulated use conditions. Design validation shall include software validation and risk analysis, where appropriate. The results of the design validation, including identification of the design, method(s), the date, and the individual(s) performing the validation, shall be documented in the DHF. 5

6 Risk Based Decisions in the QS Regulation: Design Controls... When conducting a risk analysis, manufacturers are expected to identify possible hazards associated with the design in both normal and fault conditions. The risks associated with the hazards, including those resulting from user error, should then be calculated in both normal and fault conditions. If any risk is judged unacceptable, it should be reduced to acceptable levels by the appropriate means Fed. Reg. at 52620, Comment 83 6

7 ISO Risk Analysis and Risk Management Risk analysis is the systematic use of available information to identify hazards and to estimate the risk. Risk management includes: Risk Analysis Risk Evaluation Risk Control Production and Post-Production Information 7

8 Risk Based Decisions in the QS Regulation: CAPA FDA agrees that the degree of corrective and preventive action taken to eliminate or minimize actual or potential nonconformities must be appropriate to the magnitude of the problem and commensurate with the risks encountered FDA does expect the manufacturer to develop procedures for assessing the risk, the actions that need to be taken for different levels of risk, and how to correct or prevent the problem from recurring, depending on that risk assessment. 61 Fed. Reg. at , Comment 159 8

9 Risk Management GHTF Guidance Document Risk management activities should begin as early as possible in the design and development phase, when it is easier to prevent problems rather than correcting them later. Relying on design and development processes to control risk is not sufficient. After release of the device to market, risk management activities should be linked to quality management processes. 9

10 Risk Management GHTF Guidance Document Incorporation of risk management activities during: Design and Development Activities Traceability Purchasing Controls and Acceptance Activities Production and Process Controls Manufacturing, Measuring and Monitoring Equipment Work Environment and Personnel Process Validation Servicing Corrective and Preventive Actions (CAPA) 10

11 Risk Management GHTF Guidance Document: Phases of Risk Management Activities Phase 1: Determination of levels of risk that would be acceptable in the device. (Risk Acceptability Criteria) Phase 2: Identification of hazards that may occur due to characteristics or properties of the device during normal use or foreseeable misuse. (Risk Analysis) Phase 3: Estimated risks are compared to the risk acceptability criteria. (Risk Evaluation) Phase 4: Risk control and monitoring activities. (Risk Control/Production and Post-Production Information) 11

12 FDA Guidance Documents Benefit-Risk Guidances (IDE, PMA/de novo) Identification of probable risks and probable benefits that are supported by valid scientific evidence. 12

13 FDA Benefit/Risk Determinations Assessment of Benefit Type of benefit Probability of patient experiencing benefit Duration of effect Assessment of Risks Severity, types, number and rates of harmful events Probability of a harmful event Duration of a harmful event Risk from false-positive/false-negative (diagnostics) 13

14 ISO Risk/Benefit Analysis If residual risk is not judged acceptable and further risk control is not practicable, the manufacturer may gather and review data and literature to determine if the medical benefits of the intended use outweigh the residual risk. If this evidence does not support the conclusion that the medical benefits outweigh the residual risk, then the risk remains unacceptable manufacturer shall decide which information for safety is necessary to disclose the residual risk. 14

15 Summary Risk terminology may differ; however, expectations are similar between the QS regulation, ISO 14971, GHTF guidance, and FDA guidance documents. In order to ensure consistency in the application of risk management requirements, it may be helpful to harmonize terminology. Risk management activities must be embedded throughout a manufacturer s Quality Management System and address the lifecycle of the device. 15

Planning the Risk Management File Audit

Planning the Risk Management File Audit This is a strategy to help prepare for a risk management file (RMF) audit. It incorporates requirements from the international standard ISO 14971:2007 as well as