Risk management plan in line with ISO 14971 and ISO/TR 24971

• The scope of the planned risk management activities, identifying and describing the medical device and the life-cycle phases for which each element of the plan is applicable
• Assignment of responsibilities and authorities including the definition of the Risk Management Work Group (RMWG)
• Requirements for review of risk management activities
• Criteria for risk acceptability, based on the manufacturer’s policy for determining acceptable risk, including criteria for accepting risks when the probability of occurrence of harm cannot be estimated
• Verification activities
• Activities related to collection and review of relevant production and post-production information
• Risk management process
• Management responsibilities
• Qualification of personnel
• Risk management file
• Risk analysis
• Intended use and identification of characteristics related to the safety of the medical device
• Identification of hazards
• Estimation of the risk(s) for each hazardous situation
• Risk evaluation
• Risk control
• Risk reduction
• Risk control option analysis
• Implementation of risk control measure(s)
• Residual risk evaluation
• Risk/benefit analysis
• Risks arising from risk control measures
• Completeness of risk control
• Evaluation of overall residual risk acceptability
• Risk management report
• Production and post-production information

Risk management process steps to be documented in Risk management plan

1. Identification of Risks and Hazards

The first step in the risk management process is the identification of potential risks and the associated hazards that may arise from the use of a medical device. This involves a thorough analysis of the device's design, intended use, and the environments in which it will be employed. It also considers any relevant clinical data, user behaviors, and foreseeable misuse scenarios.

2. Risk Estimation

Once the risks and hazards are identified, the next step is to assess their potential impact. The most common approach here is using the Failure Mode and Effects Analysis (FMEA) based method. This assessment involves two key elements:

a) Determination of Occurrence of Harm (O). This evaluates the likelihood of a risk leading to harm. It considers factors such as the probability of exposure to the hazard and the probability of harm occurring as a result.

b) Determination of Severity of Harm (S). This assesses the potential consequences of a risk materializing. It involves determining the level of harm that could occur, ranging from minor inconvenience to severe injury or even loss of life.

That said, there are a number of other methods for risk estimation apart from FMEA. To find out which method is the best for your particular medical device, please refer to ISO/TR 24971.

3. Risk Control through Mitigation Measures

Based on the estimation of occurrence and severity, risk control measures are implemented to reduce or eliminate identified risks. These measures may include design modifications, the addition of safety features, incorporating warnings or instructions for users, or providing protective equipment. All these measures should be documented.

4. Risk Benefit Analysis for Residual Risks

After applying risk control measures, some residual risks may still exist. A risk benefit analysis is conducted to weigh these remaining risks against the benefits of using the medical device. This involves a careful evaluation of the potential benefits to patients and healthcare providers in comparison to the remaining level of risk.

5. Evaluation of Overall Residual Risk

The final step in the risk management process is the assessment of the overall residual risk. This involves considering the combined impact of all identified risks, even after applying mitigation measures. The goal is to ensure that the residual risk is at an acceptable level, taking into account the benefits provided by the device.

Typical content of the Risk Management Plan

Below is the standard content of the Risk Management Plan. However, it's essential to assess its suitability for your specific medical device and modify it accordingly.

1. Overview
2. Validity of this Risk Management Plan
3. Definitions and abbreviations
4. Identification of subject device
1. MDSW description
2. Device risk-based classification
5. Risk management process
6. Product life cycle
7. Management responsibility
8. Qualification of personnel
9. Scope of planned risk management activities
10. Assignment of responsibilities and authorities
11. Requirements for review of risk management activities
12. Verification activities
13. Production and post-production
14. Risk Control Strategy
15. Risk Management Process Flow
16. Risk Management Process Description
17. Documents & Records
18. Detailed description of risk management process steps
1. Identification of hazards
2. Identified hazards
19. Criteria for risk estimation
1. Determination of Occurrence (O)
2. Determination of Severity (S) and severity levels
3. Determination of Risk Priority Number
20. Risk control record
21. Possibility of reduction of Occurence during mitigation process
22. Criteria for risk estimation and acceptability
23. Risk-Benefit Analysis for residual risks
24. Evaluation of overall residual risk