What are the four different types of medical device risk analysis?

Everyone in the medical device industry is familiar with ISO 14971 as the standard for risk management, but did you know that are four different kinds of risk analysis?
I’m not talking about four different tools for risk management, but four different quality system processes that need risk analysis. The one most people are familiar with is risk analysis associated with the design of a medical device. Do you know what the other three are?
The first is design risk management, and this is typically documented by medical device manufacturers on a design FMEA (dFMEA). The second type is process risk management where you document your risk estimation in a process FMEA (pFMEA). The third type is software hazard analysis, and the fourth type is a Use-Related Risk Analysis (URRA).
Each of these types of risk management documentation requires different information and there are reasons why you should not combine these into one risk management document or template.
Thank you to our other guest that posted the question about IFUs. "Can you use only the IFU to prevent use-related risks?" The answer is no. Not everyone reads the IFU, and you cannot guarantee that everyone will understand the instructions and remember any warnings or precautions. This is the reason why we have color-coding, design features that eliminate the possibility of a use error, we provide training to users, and we are required to monitor use-related risks for medical devices. Formative usability testing is intended to identify use-errors we did not anticipate, to help us develop instructions for use (IFU), and to help us develop training for users. Summative testing is intended to validate that the design, training, and IFU are effective at preventing use errors. All three of these aspects work together--not the IFU alone. In fact, there is an entire alarms standard that identifies protective measures that shall be used for electromedical devices to prevent use errors (i.e. - IEC 60601-1-8).
Thank you to Rick Stockton for his participation in today's live video. Here's a link to another interview we did with Rick on the topic of risk: • Interview with Rick St...
Links to webinars on risk (both will be updated in March 2022):
medicaldeviceacademy.com/risk...
medicaldeviceacademy.com/2497...
Related standards:
Design Risk Analysis (dFMEA) - ISO 14971:2019 and IEC 60812:2006
Process Risk Analysis pFMEA) - ISO 24971:2020 and IEC 60812:2006
Fault-Tree Analysis (FTA) - ISO/TR 24971:2020 and IEC 61025:2006
Software Hazard Analysis - ISO/TR 80002-1:2009
Use-Related Risk Analysis - IEC 62366-1:2015

[@nabilriazgt]

Great talk. I can't think of any as big as those 4.

[@dolichophallus]

Thank you for the information. This is a great roadmap for Novice and Intermediate Quality personnel in this industry.

[@suziekay]

Connected medical devices will require security risk analysis to be done and documented....

[@MedicalDeviceAcademy]

That's a great point. You need separate documentation for RF wireless coexistence testing. The FDA is not requiring a different format for the risk analysis. Therefore, a design FMEA can be used for the RF wireless functionality and it can be included in your overall device risk analysis. However, the FDA requires specific risks to be addressed in your risk analysis and specific verification testing and labeling requirements associated with the wireless functionality. The same comments apply to EMC testing, but only in the case of software and human factors is the FDA requiring that risks be documented differently (i.e., without the probability of occurrence).

[@mattivds]

Hi, thanks for the information. What about a hazard traceability matrix?

[@MedicalDeviceAcademy]

For software hazard analysis, the traceability matrix is required by the FDA but it is not typically called a hazard traceability matrix (but it is one). For human factors, the use-related risk analysis (URRA) needs to include traceability to your risk controls and the hazards. For other types of risk analysis, you also need traceability.

[@iiL1GHTT]

Thanks jamal

[@MedicalDeviceAcademy]

You're welcome.

[@fabiolaolivares596]

ISO 14971 could help me to Identify Risks in medical devices manufacturing process or it is only For products?

[@MedicalDeviceAcademy]

ISO 14971 is the standard used for risk management of medical devices. It includes process risk analysis, design risk analysis, and other types of risk analysis. However, it is a risk management standard and covers much more than just the risk analysis. It covers the entire product lifecycle. For more detailed help on process risk analysis you might get more useful information from resources specific to the FMEA process. This process was developed in the 1940s and it is used by aerospace and automotive companies to analyze risks associated with failure modes that occur with each component you manufacture and/or assemble. The pFMEA tool typically has 3 factors (S = severity, O = occurrence, and D = detectability). Detectability is specific to detection of defects during manufacturing or assembly (i.e., proactive detection), and it should not be used for detecting that a device is hot, or sharp, by the user. Ideally your method of detection is automated and validated (e.g., automated vision system inspection).

[@baljindersinghsidhu3959]

Thank you..

[@MedicalDeviceAcademy]

You're welcome