23 July 2021
How to Reduce Risk As Far As Possible
A previous post discussed the various and often confusing terms used for reducing risk in medical devices. This post provides the methods that can be used to address those requirements.
The European Union Medical Device Regulation 2017/745 (EU MDR) and the European Union In Vitro Diagnostics Regulation 2017/746 (EU IVDR) list several methods that can be used to manage risk. Some of the terms used are:
- Reduce risk as far as possible → diminish the size, amount, extent or number to the greatest degree or amount that is attainable
- Eliminate risk → get rid of or remove from consideration
- Minimize risk → reduce or keep to a minimum
- Remove risk → get rid of
- Minimize risk as far as possible → reduce or keep to a minimum to the greatest degree or amount that is attainable
- Reduce risk to the lowest possible → diminish the size, amount, extent or number as low as can be attained
- Avoid risk as far as possible → keep away from or prevent the occurrence to the greatest degree or amount that is attainable
In Annex I General Safety and Performance Requirements, Chapter I – General Requirements of both the EU MDR and the EU IVDR, the requirement to reduce risks as far as possible “means the reduction of risks as far as possible without adversely affecting the benefit-risk ratio”.
Clause 4.2 of ISO 14971:2019 states that “the manufacturer’s policy for establishing criteria for risk acceptability can define the approaches to risk control: reducing risk as low as reasonably practicable, reducing risk as low as reasonably achievable, or reducing risk as far as possible without adversely affecting the benefit-risk ratio.”
ISO TR 24971 Annex C, C.4 distinguishes between practicability and practicality. “Practicability(being practicable) refers to risk control options that are considered viable or capable of being put into practice. This is not to be confused with practicality (being practical), which refers to measures that are useful or convenient. Practicability has two components, namely technical practicability and economic practicability.”
- Technical practicability is the ability to reduce the risk regardless of cost.
- Economic practicability is the ability to reduce the risk without making the medical device or product economically unviable.
- Economic practicability should not be used as a rationale for the acceptance of unnecessary risk.
Risk reduction — risk control option analysis
The table below summarizes the required priorities for risk reduction, options to control / reduce risk, the element of risk affected — Severity (S) or Occurrence (O), and some examples. It is only via design or redesign options that severity can either be eliminated, removed or reduced. All other risk control methods can only reduce the probability of occurrence of harm. Considering inherent safety by design should be the first and highest priority for risk reduction. All design options should be identified and implemented before moving to protective measures. Information for safety should only be used as a last resort after all possible design and protective measures have been identified and implemented.
In order to reduce risk as far as possible, all risk control measure options must be considered and documented. If all possible risk control options that were considered are not implemented as risk control measures, rationale should be provided as to why those particular options were not implemented. ISO TR 24971:2020 states that “several options exist to reduce risks associated with a medical device. These can be used alone or in combination. The manufacturer can explore different options to reduce the risks to acceptable levels in a reasonably practicable way.”
The table below illustrates a method of documenting such actions and decisions.
* – Rationale for not implementing Option 1 – Design may include that the additional design risk control measure (i) did not adversely affect the residual risk acceptability and the benefit-risk ratio and/or (ii) would not reduce risk levels any further…etc.
The example above demonstrates the due diligence conducted to (i) identify all possible options, and (ii) implementing all those risk control measures that reduced risk as far as possible without adversely affecting the benefit-risk ratio. In addition, it forces manufacturers to consider and implement all possible design risk control options as the first priority, followed by implementing protective measures (alarms, inspection and testing etc.). Information for safety and instructions for use / labeling should be the very last resort.
As the following diagram illustrates, a label to caution users of a sharp edge on a device does almost nothing to reduce the risk of the user or patient from cutting themselves. A protective measure could still lead to a potential cut if the protective covering tears and exposes the sharp edge. It is only by removing the sharp edge via a redesign that the hazard can be completely eliminated. The hazard has been “designed out”. The costs and efforts typically increase exponentially from implementing labels to protective measures to an effective design option. It is for this reason that the standard and the regulation require that safe design options be the first and highest priority in identifying risk control measures.
ISO TR 24971:2020 clause 7.1.1 states that “options a) to c) are listed in descending order of priority with regard to their generally recognized effectiveness in reducing risk. The manufacturer should take this order into account before deciding on the most appropriate (combination of) risk control measures.” Options a) to c) refer to
- Inherent safety by design,
- Protective measures, and
- Information for Safety.
In summary
The EU MDR and EU IVDR mandate several methods of managing risk. Reducing risk as far as possible is the most common requirement. Manufacturers must demonstrate that they have identified all possible risk control measures and have implemented as many of them as reasonably possible and practicable. The risk control option analysis as described in clause 7.1 of ISO 14971 provides the requirements and priorities for such an activity. Rationale for not implementing some of the identified risk control measures must be documented. This demonstrates the due diligence conducted to identify all possible risk control options and implementing all those risk control measures that reduced risk as far as possible, without adversely affecting the benefit-risk ratio.