5 mind hacks to make risk management feel effortless

Do it right, make it easy.

The first time I became aware of this thing called risk management, was when I had to read and understand a long and dense procedure for a mandatory training.

That was more than 10 years ago, early in my Quality career at a leading MedTech. It was a highly intimidating experience for me!

Not long after that came an introduction to ISO 14971, the International Standard for application of risk management to medical devices. At that time, the second edition of 2007 was 90-pages long, full of strange terminology and dense information packed in 10-annexes.

I found myself struggling to barely keep my head above water!

No wonder, most professionals in the medical device Quality and Regulatory space find it difficult to understand and correctly apply the core principles of risk management.

43% of the respondents in my recent LinkedIn poll said that a limited expertise in risk was their most significant challenge in implementing an effective risk management process.

So, if you are feeling this way, you are not alone. I have been there before!

The irony, I feel, is that we make risk-based decisions in our lives on a daily basis, often, without even thinking about it consciously. From the moment we wake up each day, to the time we turn off the lights to go to sleep, we are confronted with situations that require us to analyze and evaluate risks before making a decision that could have a significant impact.

Yet, when it comes to practicing risk management in our professional life, we find it very confusing and challenging.

In my view, this is not a question of technical capability. Rather, I think this is more of a mindset issue.

In this article, I want to share with you 5 mind hacks you can use to develop the right attitude that will make risk management feel effortless!

1. Simplify - don’t overdo “risk management”

Think about it for a moment - we know that driving in the rush hour on the highway, with stop-and-go traffic and distracted drivers is a hazardous situation. Yet, we don't do any fancy statistics to analyze our personal risk when we step out of the door and get going.

There is no explicit requirement for you to always do a quantitative risk analysis. In fact, when data quality is poor, it is better to use a qualitative approach. As more information becomes available, you can refine your analysis with a more accurate estimate of risk.

Keep it simple and don't over-complicate your decision making process.

2. Rise up - go beyond compliance

When you treat risk management only as an exercise to satisfy regulatory requirements, you are doing your work with hands tied behind your back. It is painful and ineffective!

Compliance is not the goal of risk management. When you focus on compliance, you operate out of the fear of potential non-compliance.

Instead, operate out of knowledge, not out of fear. Trust the process that involves identifying potentials risks and effectively implementing appropriate risk control measures. Once you have done that to the best of your ability, you monitor and take action when needed.

3. Let go - focus on the probable, not the hypothetical

If a highwire artist worried about falling into the abyss, they would never be able to complete their act.

It is not that they don't consider the risk of falling and dying. It is certainly possible. But they focus on minimizing the likelihood by planning ahead, building skills and confidence. As a result, their act is dangerous but not unsafe.

If you keep thinking about all the possible what-ifs, without any context, then you will end up with death as the final outcome of every situation. This is as true in life as for a medical device. Even a simple, presumably low-risk medical device can lead to death as the final outcome through a series of events, many of which may not be directly in your control.

It is better to focus on the probable, not the hypothetical. Thinking about potential sequence (or combination) of events is useful only to the extent that we can identify opportunities to break the chain of events by additional risk mitigations. Otherwise, it is an academic exercise, and overthinking sequence of events is not useful.

4. Think relative - risk is not an absolute concept

Risk is not high, medium or low. It is either acceptable or unacceptable relative to the anticipated benefits.

Risk-based decisions involve a considerable amount of judgment. Evaluating the balance between benefits and risk is not an easy task, and a deep understanding of the context is important.

Keep the big picture in mind - a medical device with an inherently high level of risk is still useful, especially if there are no better options for the life-critical medical condition it is designed to treat. When the risk level has been reduced to as far as possible, the device can be considered safe and acceptable. Otherwise, the device is unsafe and not acceptable.

5. Keep moving - risk management is a journey, not a destination

Risk management is not a one-and-done process. It does not stop when a product is launched; rather it continues throughout the entire lifecycle of your medical device.

In fact, the post-market phase of the lifecycle of a medical device is arguably the most critical phase.

It is only after a medical device is widely used in the market that you can fully understand different risks. Until then, you are simply working with your most informed guess.

That is why you have to simplify and create an efficient process. You cannot keep moving if the process is burdensome. You may have a beautiful, fully compliant risk management file. But it is your ability to detect safety signals before they become a trend, that will determine the effectiveness of your risk management process.

In conclusion

risk management is not hard. Sure, there is a technical aspect to it, which requires us to first understand the language of risk. However, it is just like any other business process which needs to be managed efficiently to achieve desired goals.

Let us keep it simple and not overdo risk management. Let us rise up and shift our focus from compliance to effectiveness. Let us not indulge in too many hypotheticals, and instead focus on the probable. Let us not treat risk as an absolute concept but think of it in the context of anticipated benefits. Finally, let us build an efficient process that will help us to keep moving and keep improving the safety of our medical devices.

If we can slightly shift our mindset, we can make risk management feel effortless!