Medical Device Risk Management, What Should Follow the Analysis Table?

The Risk Management Table Exists, But It's Hard to Find the Basis for Judgments

Even if the risk management table records risk levels and measures taken, it might be difficult to answer the following questions:

"What product specifications have been reflected in these measures? Where has the effect been confirmed? Can we maintain the same judgment after recent changes?"

This article covers how to connect recorded risks and the evidence found in the product.
It is an example for practical explanation, not a real customer case.

Distinguishing Failures, Risk Situations, and Hazards

FDA risk management basic training materials distinguish between risk factors, risk situations, and hazards, explaining the concept of risk while considering the probability and severity of hazard occurrences.

The terms failure or error alone do not adequately reveal who is exposed to what kind of harm.

FDA, Risk Basics for Medical Devices, Slides 5–16

Let's assume we are reviewing overheating in a hypothetical electric medical device.
Below are some pathways to explain the concept and do not substitute for the analysis of a specific product.

By explaining “the occurrence of overheating” in this way, design reviewers and testing personnel can easily discuss the conditions to be reviewed together.

Since hazards can arise even during normal use, it is essential not to limit the analysis scope solely to failure pathways.

Three Connections to Make Before Reducing Risk Level Numbers

ISO 14971:2019 addresses risk factor identification, risk estimation and assessment, risk control, and monitoring control effectiveness across the product lifecycle.

It also requires manufacturers to establish objective risk acceptance criteria but does not set a uniform acceptable level for all products.

ISO 14971:2019 Official Introduction

Therefore, rather than simply writing down “risk level reduction after action,” it is advisable to record the following three aspects together:

The structure below is a practical summary suggestion from MedQraft and is not a format prescribed by the standards.

1. What has been reflected in the product?
   For example, if a temperature limitation function was reviewed, connect it to the corresponding design requirements and the applicable product version.
   Distinguish between the actions being reviewed and the actual actions that have been reflected.

2. Under what conditions was it confirmed?
   Connect the examination or review record number and version, evaluation conditions, and results.
   Do not express that the overall risk is resolved beyond the applicable scope of the test results.

3. How was that result judged?
   Record remaining risks and uncertainties, additional confirmation matters, the judge, and the judgment date.
   If evidence is lacking, manage unresolved issues instead of filling in blanks with arbitrary low scores.

In the above overheating example, “addition of temperature limitation function” and “risk of thermal damage has been sufficiently lowered” are separate judgments.
It is essential to confirm where the records that confirm the function's reflection and evaluate the intended effect are located.

If FMEA Has Been Created, Check the Following Connections

FDA training materials introduce FMEA as a technique used along with PHA and FTA for risk analysis.
It is necessary to review the completion of one analysis technique separately from the overall completion of risk management activities for the product.

FDA, Slides 26–28

If the team is already using FMEA, it may be more efficient to start by supplementing a connection table instead of entirely changing the forms.

This connection table is not an exhaustive list of all necessary risk management activities for the product.
It is a diagnostic tool to find points where connections in judgment are broken from existing materials.

In the Next Meeting, Track One Risk Item

Trying to tidy up the entire risk management document at once may lead to excessive time spent on form modifications.

It is suggested to first select one important risk item to search for data in the following order:

Pathways Where Hazards Occur → Actions Reflected → Evidence Confirmed → Judgments on Remaining Risks → Records of Re-evaluation after Changes

By indicating which step you cannot find data, it can be distinguished whether additional analysis is needed, whether verification materials are lacking, or whether only links between documents need to be organized.

MedQraft currently reviews held quality documents and operational procedures and discusses the scope of tidying up to connect risk management records with design, changes, and verification tasks.

Reference Materials and Scope of Application

• ISO 14971:2019 Official Introduction: Scope and basic processes of medical device risk management.
• ISO/TR 24971:2020 Official Introduction: Guidelines to assist with applying ISO 14971.

Separate standard requirements and guidelines should be checked.

• FDA, Risk Basics for Medical Devices: Educational materials on terminology and risk analysis techniques.

This article does not cite the past explanations of U.S. Quality System Regulations in the foregoing materials as current regulations.

This article is general information based on publicly available materials.
Actual application scope and judgment criteria should be determined by verifying the intended use, characteristics, regulatory standards in the target market, and original texts of applicable standards.