Safety is important, but not the only objective for risk management

Insights from a Let's Talk Risk! conversation with Jayet Moon and Arun Mathew

Note: this article highlights key insights gained from a conversation with Jayet Moon and Arun Mathew as part of the Let’s Talk Risk! with Dr. Naveen Agarwal series on LinkedIn. Listen to the full recording of the discussion below.

The term risk is generally understood as something to be avoided or minimized. One of the dictionary definitions of risk is a possibility of loss or injury¹. In the medical device and pharma industries, risk is generally associated with harm to patients. Regulatory agencies expect the benefits of a medical product to outweigh the risks associated with its use before it can be considered as safe and effective. As a result, the dominant view of risk in the medical device world is that risk needs to be controlled and minimized for patient safety and regulatory compliance. ISO 14971², the international standard for application for risk management to medical devices, defines risk as the combination of the probability of occurrence of harm and the severity of that harm.

But risk also means opportunity. “No risk, no reward”, is a often invoked as a mantra to encourage achievement, especially in business. Sometimes the highest risk maybe the one you did not take when it was worth taking! Risk, therefore, can be perceived both as a negative force to be avoided, or as a positive force to be leveraged.

Differences in risk perception influences how different people think about risk. That is why we cannot talk about risk only in the context of loss or harm. When it comes to risk, context matters and managing risk becomes a balancing act.

Here are 3 key insights that emerged from our discussion:

Think of risk broadly as effect of uncertainty on objectives

Safety is an important business objective, but not the only one. As engineers and quality/regulatory professionals, we are mostly focused on safety-related risks during new product development and during post-market design changes. We want to make sure our products continue to function reliably and remain compliant with regulatory requirements. Safety and reliability is our focus for good reason; after all, this is the primary responsibility of our functional role in the organization.

Top management looks at risk in a more holistic way. All business decisions require trade-offs to achieve the most optimal outcome in light of competing priorities and objectives. Risk management at this level is about managing uncertainty in all objectives, not just a select few.

It is not that top management want to deliberately compromise safety and reliability when making important business decisions. They intuitively understand the consequences of poor safety and reliability. However, they may not always have a full understanding of relevant technical details.

Understanding of technical details of safety risks decreases as you go up the chain.

It then becomes a matter of communication. When we view risk in a more holistic way, our thinking is not limited to only a single dimension of risk. It is not just safety or just reliability; it is both. All relevant factors, including cost, should be considered appropriately so that we can facilitate decisions that support continued safety and effectiveness of our medical devices.

There is always tension and competition among different business objectives. It is our role to collect, analyze and present information in a holistic to facilitate business decisions that do not undermine safety and reliability.

Utilize post-market surveillance data for both safety and reliability

Safety risk management dominates our current approach to risk management in the medical device industry. ISO 14971 is a safety risk management standard; it is not explicitly concerned with reliability. Safety does not necessarily imply reliability, and vice-versa. In this environment, organizations have to figure out how to devote appropriate attention to both safety and reliability to remain competitive in the marketplace.

Reliability is the twin sibling of safety.

Clause 10 of ISO 14971 requires a systematic process for production and post-production activities, to collect and review information with relevance to safety, and take appropriate actions in a timely manner. It does not explicitly call out information review and actions to address reliability issues. As a result, many organizations are missing out on improvement opportunities to address malfunctions or defects that may be important from the perspective of customer experience, but may not lead to any harm.

Customer complaints data, for example, is a rich source of information on malfunctions or other such defects that can feed into design for reliability or other continuous improvement projects. Information from other sources of customer feedback can also be useful in exploring opportunities for improvement that help build and sustain a competitive advantage in the marketplace.

On the other hand, clinical literature, registries and other sources of real-world data is useful in identifying new harms or monitoring the occurrence rates of known adverse events. This information can feed into decisions related to safety risk management.

It is important to appreciate that review of post-market data is not a one-dimensional way to manage risk of your medical device. There are many ways to utilize this information as you manage different risks and help achieve business results. Safety and reliability improvement are just two such examples.

Connect the post-market surveillance process with the design and development process

An important aspect of risk management process, according to ISO 14971, is that it spans the entire lifecycle of a medical device and not limited to a certain phase.

During design and development, there is a strong focus on “what can go wrong?”. The goal is to identify and reduce risks to an acceptable level and the device is considered safe and effective for the purpose of regulatory approval. At the time of launch, we only have an estimate of risk based on limited testing, which may or may not include a human clinical trial. The design at launch is our best guess, which we think meets regulatory requirements and has a fair chance of market success.

We don’t know what we don’t know!

In the post-market phase, you are monitoring the data to see if what you thought during the design phase is accurate. If there are changes, you have to take action either through design changes or process improvement to address those risks.

Building a robust feedback loop between the post-market surveillance process and the design and development process is extremely important. It is also an expectation of regulatory authorities to ensure that your medical device continues to remain safe and effective throughout its lifecycle. There are many examples of recalls and warning letters that point to deficiencies in design and process control. These reports seem to indicate an industry-wide challenge in adequately connecting different processes within the quality management system to manage risks.

One way to connect the post-market surveillance process back to design and development is through the management review process within the quality management system. Risk management, when integrated adequately within the quality management system, can facilitate this connectivity.

Here are a few other ideas and insights that emerged from our discussion during audience Q&A:

• Business risks and safety risks compete all the time: There are many scenarios where changes are needed in a currently marketed product. It raises a question about how best to handle the older version of the product which may still be in circulation. If the proposed changes are intended to address a safety issues, it raises a business risk of leaving the older version in the market which may be less safe. That is why it is important to ensure that senior leaders have a good understanding of the technical details related to safety risks. A risk-based decision is optimal only when all relevant information is available and understood by the decision makers. Leaders need to take time to understand this information before making critical decisions.

• There is a risk to QMS when procedures are not followed: It is not uncommon to find during audits or inspections that quality procedures are not being followed. In other cases, Human Resource may find violations against policies and other procedures. These violations should be taken seriously. If an FDA investigator finds that procedural violations have a potential to adversely affect product safety and effectiveness, they will very likely escalate it as a serious non-compliance. These violations may pose a serious risk to the quality management system (QMS). It is important to find the deeper issues behind procedural violations, not just assume that people are deliberately choosing to be non-compliant.

• High severity events that apparently link to use-error require deeper understanding of sequence of events: One or more factors related to design, process or use may trigger a sequence of event that results in a hazardous situation leading to harm. When field data indicates a link between a high severity outcome and use-error, it is important to look deeper for other initiating events that may have led to the use-error in the first place. In some cases, it may be enough to address the use-error with additional risk control measures, but they may not be effective in preventing recurrence. That is why it is important to take a deeper look and address the underlying contributing factors that may need to be addressed through design and/or process improvements.

• How far risks should be mitigated is a difficult question to answer: EU-MDR requires that all risks need to reduced to as far as possible (AFAP)³. But how far is “as far as possible”? How can we evaluate whether risks have been reduced to AFAP? It is important to understand that the question of AFAP is best answered in the context of the benefits of intended use. A point of confusion here is that AFAP may be misunderstood to mean “as low as possible”. Industry practice is to use a risk matrix with zones of acceptability and unacceptability based on combinations of Severity and Probability levels. However, it is important to understand that there is no absolute reference standard that can provide a level of acceptability or unacceptability. A best practice, therefore, is to adapt your risk acceptability matrix to different products (or product families) in your portfolio based on benefit-risk considerations. Another good practice is to rely on state-of-the-art product safety standards that may provide methods and criteria for effect risk control measures⁴.

About Jayet Moon

Jayet Moon is the author of Foundations of Quality Risk Management, published by the American Society for Quality (ASQ). He is a chartered quality professional in the UK and holds several certifications from the ASQ. In his current role as a Quality Manager at Terumo Medical Corporation, he is helping to integrate best practices in safe design and development of medical devices through is vast experience in engineering and post-market safety surveillance.

About Arun Mathew

Arun Mathew is currently an associate director of quality systems and risk management at AbbVie. He has over 17 years of diverse industry experience in roles ranging across quality, manufacturing and regulatory functions. His expertise includes medical standards, risk management, computer system validation, process validation, CE marking and FDA submissions.

About Let’s Talk Risk with Dr. Naveen Agarwal

Let’s Talk Risk with Dr. Naveen Agarwal is a weekly live audio event on LinkedIn, where we talk about risk management related topics in a casual, informal way. Join us at 11:00 am EST every Friday on LinkedIn.

Disclaimer

Information and insights presented in this article are for educational purposes only. Views expressed by all speakers are their own and do not reflect those of their respective organizations.

1. Source: Merriam-Webster dictionary

2. ISO 14971: Medical devices - Application of risk management to medical devices (Currently in its 3rd edition)

3. EU-MDR: See General Safety and Performance Requirements in Annex I, Chapter I, of the Regulation (EU) 2017/745.

4. ISO/TR 24971:2010 - Annex E, Role of international standards in risk management.