Stop Managing Risk After the Fact: The Case for Patient-Centered Safety from Day One
A proactive approach to patient safety and regulatory confidence leveraging early integration of risk management in medical device development.
This is a guest article by Jeff Block, Aaron Joseph, Richard Matt, Jafar Shenasa, and Joe Sitomer.
Traditional approaches to risk management in medical device development often treat it as a late-stage compliance activity—a checkbox exercise performed primarily for documentation purposes. This reactive approach leads to costly redesigns, delayed market entry, and most critically, potential safety gaps that could harm patients.
We recommend a fundamental paradigm shift:
Integrate risk management at the earliest stages of new product development, beginning with the statement of intended use.
By proactively initiating risk analysis early, organizations can:
Design safer products from the outset
Reduce development costs by avoiding late-stage design changes
Accelerate time to market through smoother regulatory reviews
Demonstrate rigorous risk management to regulators and stakeholders
Build a stronger safety culture within the organization
In this article we present a detailed comparison of traditional versus recommended approaches, illustrated through an example with a hypothetical medical device: a VR headset for migraine treatment.
The Structural Flaws in Late-Stage Risk Management
The ISO 14971 standard is clear that risk management should be initiated at the earliest stages of development and should be an ongoing activity throughout the product lifecycle. Yet in practice, what we see again and again is risk management as a design freeze deliverable—a requirement to complete a phase gate.
The consequences are predictable. When you start risk analysis with a completed design, you are no longer asking, “What could harm a patient?” You are asking, “How do we justify the design we already have?” Those are fundamentally different questions and they lead to different outcomes.
Late-stage risk findings that genuinely require design changes create the worst kind of project crisis: redesigns after V&V, re-negotiations with suppliers, and labeling overhauls requiring new human factors studies. The consequences are severe—either major delays and budget overruns, or post-market adverse events that require significant responses or costly recalls.
From Compliance-Focused to Strategic Value
Medical device companies must elevate risk management from a regulatory checkbox exercise to a strategic design optimization tool that drives safer products and more efficient development. The fundamental principle is embedding risk management as a core, value-adding process throughout the entire product lifecycle rather than treating it as an end-of-development compliance burden.
Early Integration
Start risk management activities early, even before formal design controls begin. Perform an initial analysis of hazards and harms, benefit-risk assessment, and regulatory strategy planning at project inception. Use risk analysis to drive design decisions and define product architecture from the start, not just document design decisions after the fact. Iterate continuously as the design evolves—risk management is an ongoing process, not a one-time event.
The Patient-Centric Benefit-Risk Approach
Define the medical treatment or diagnostic process and expected benefits upfront, starting with the patient condition and the intended use. Then systematically identify potential hazards and harms before beginning design of the device. And finally, perform iterative benefit-risk assessments to guide design decisions throughout development.
Cross-Functional Collaboration and Expertise
Engage the entire product team in risk management, not just Quality and Regulatory functions. Involve clinical experts, engineering, manufacturing, marketing, human factors, and other stakeholders early and throughout the process. Don’t rely on engineers to determine severity of harms—clinical input is essential. Facilitate cross-functional discussions to align on risk analysis methods, tools, and risk acceptability criteria.
Organizational Culture
Companies that follow the traditional compliance-focused approach often view formal risk management as a regulatory burden that is secondary to product design and development.
Companies that follow the recommended patient-centric approach embrace a proactive, safety-first culture where risk management is integral to product design and development. All team members understand their role in patient safety.
Comparative Analysis
The following table provides a side-by-side comparison of how risk management is executed under compliance-focused (traditional) versus patient-centric (recommended) methodologies across key dimensions of the product development lifecycle.
Why Early Integration Matters
This comparison between traditional and recommended approaches reveals substantial benefits across financial, operational, and patient safety dimensions:
Safer Products: Non-obvious hazards, those emerging from device–user–environment interaction, are identified early, not after they surface post-market, so effective risk controls can be integrated into the design.
Lower Cost of Quality: Comprehensive risk integration anticipates design changes well before V&V phases, significantly reducing the need for late-stage design modifications and additional validation efforts. The probability of delayed time to market and adverse events in the field is reduced as well.
Predictable Submissions: Clear traceability from intended use through hazards to risk controls gives reviewers confidence and reduces deficiency letters and additional information requests.
Case Study: VR Headset for Migraine Treatment
Scenario: The product team is starting development of a hypothetical Virtual Reality (VR) headset which is intended to reduce migraine frequency through immersive relaxation therapy and biofeedback.
Traditional Approach: Under the traditional approach, the engineering team designs the new product for visual quality, comfort, battery life, and manufacturability. Risk management begins late in development. What gets missed under this traditional approach:
Seizure risk: No early consideration of photosensitive epilepsy — seizure risk is not controlled in the initial design
Falls and injury: Spatial disorientation from VR immersion is not addressed in the design or labeling
Psychological harm: No screening for contraindicated conditions such as severe depression, PTSD, or dissociative disorders
Delayed diagnosis: Patients managing symptoms with the device may delay seeking attention for brain tumors or aneurysms
Medication interaction: Migraine medications that impair coordination were not considered alongside VR-related disorientation
Patient-Centric Approach: Under the patient-centric approach, the team starts with the question: “Given this intended use and product concept, what could go wrong for the patient or user?” Harms are identified first — seizure, delayed diagnosis, falls, psychological deterioration, etc. — then traced back to hazardous situations and specific sources of risk. Risk controls are incorporated into the product and labeling as they are developed. For example:
Inherent safety: Algorithm enforces maximum flash rate < 3 Hz; peripheral vision dampening reduces overstimulation
Protective Measures: Pre-use screening questionnaire; mandatory physician consultation; automatic session termination on symptoms
Information for safety: Prominent seizure warnings; contraindications list; patient training materials
The risk management file is then updated continuously as the design evolves. Human factors testing uncovers additional risks (e.g., dizziness from removing the headset too quickly). Clinical data refines patient selection criteria. Every design change triggers an analysis of potential changes to risks.
Conclusion
We recommend treating risk management as an early, integrated, continuous process rather than a late-stage compliance activity. The VR headset case study demonstrates how this approach identifies critical safety issues that traditional methods often miss, while simultaneously reducing costs, accelerating timelines, and fostering a culture of safety.
This shift in approach requires organizational commitment and cultural change. It demands that cross-functional teams collaborate from day one, that intended use and indications for use are clearly defined before device design begins, and that benefit-risk assessments are actively iterated throughout development. In this way, potential harms to patients and users drive design decisions rather than follow them.
Early integration of risk management produces better-designed products overall with better user interfaces, stronger clinical effectiveness, and greater customer confidence.
About the Authors:
Jeff Block: brings more than 25 years of experience in the medical device industry, including the past 15 years focused on risk management. His expertise spans sterilization, automated assembly, design quality, QMS support, and comprehensive risk management practices, including tool selection, integrated risk strategies, and the application of risk ratings to support product and business decision-making. As a consultant with ProPharma Group, Jeff partners with organizations of all sizes and specialties to implement effective quality and risk management solutions that support the development of safe, high-quality medical products. He is based in the Chicago, Illinois area.
Aaron Joseph: is a biomedical engineer, systems engineer, and design quality assurance consultant based in the Boston Area. He has over 20 years of experience in medical device development across a broad range of products: surgical robotics systems, laser eye surgery equipment, wearables, medical imaging, drug inhaler devices, catheters, and multiple IOT and SaMD products. Aaron helps clients with risk management and design controls, software validation, training, and implementation of software tools for documentation automation. He has worked on Risk Management Files and risk management procedures at more than 25 medical device companies.
Richard Matt: is the principle consultant at Aspen Risk Management Consulting. His background includes over 30 years of experience working in a wide variety of Class I, II, and III medical manufacturers, both therapeutic and diagnostic products, and every kind of combination product possible - even one product that was a combination device / drug / biologic in one. In this time, Richard observed the conflict between the importance of properly assessing benefit-risk and common practices that lacked a systematic and objective approach. In response, he has developed a patent-pending method that enables modeling of patient benefit and risk at whatever level of complexity is required to draw the proper conclusion and avoids the fatal error of converting risk levels to numbers.
Jafar Shenasa: is a regulatory strategy leader with three decades of experience shaping how medical devices and digital health products reach patients worldwide. He currently advises medical device and digital health companies and serves as a mentor with CDL- Biomedical Engineering stream, Stanford StartX, and Equalize. He previously served as a Digital Health Advisor at the FDA's Digital Health Center of Excellence. At Proteus Digital Health, Jafar led the FDA, EU, and China approvals of the first-in-category ingestible sensor medical device and was instrumental in securing FDA approval for the first drug-device digital medicine in 2017. He also drove the FDA De Novo approval of AppliedVR's virtual reality therapy for chronic pain, with broader regulatory experience spanning cardiovascular, mental health, oncology, neurology, and several other therapeutic areas.
Joe Sitomer: is an experienced and versatile biomedical engineering leader based in the SF Bay Area. Over the course of his long career in medical device development, he has filled many roles including software engineer, program manager, systems engineer, and engineering manager. He has worked on dozens of medical device projects including innovations in medical imaging, cardiology, medical information systems, and surgical robotics systems. His experience includes a wide range of environments including small and large companies, startup environments, and academics. Over his career, Joe has developed a pragmatic approach to compliant medical device development without stifling innovation or productivity. His focus on systems thinking, reusability, and scalability have helped drive multiple successful product launches. He promotes a “shift left” philosophy for accelerating medical device development and smoothing regulatory submissions, including risk management, requirements management, human factors, and cybersecurity.
Disclaimer: This article is intended for educational and informational purposes only and should not be interpreted as legal, regulatory, or professional advice. The views expressed here are solely those of the author and do not necessarily represent those of their organization or employer.