Risk Management Procedure (ISO 14971)

This procedure establishes the framework for applying risk management to medical devices throughout their lifecycle, in accordance with ISO 14971:2019. It defines how hazards are identified, risks are estimated and evaluated, risk control measures are implemented and verified, and overall residual risk is assessed to ensure the safety and performance of medical devices.

This procedure applies to risk management activities for all medical devices designed, developed, manufactured, and distributed by [Company Name]. Risk management encompasses the entire product lifecycle including: - Concept and feasibility - Design and development - Verification and validation - Manufacturing and production transfer - Post-production (market surveillance, complaint analysis, field corrective actions) - End of life / decommissioning

Risk Management Team Leader: Typically the Design Lead or Quality Engineer; responsible for coordinating risk management activities and maintaining the Risk Management File. Risk Management Team: Cross-functional team including Engineering, Quality, Regulatory, Clinical, Manufacturing, and other relevant disciplines. Participates in hazard identification, risk analysis, and risk control decision-making. Quality Manager / Management Representative: Ensures the risk management process is established and maintained, reviews and approves Risk Management Reports. Top Management: Defines the risk acceptability criteria (Risk Policy) and provides resources for risk management activities.

4.1 Risk Management Plan - A Risk Management Plan (FRM-RM-001) shall be established for each device or device family before design input activities begin - The plan defines: scope, lifecycle phases covered, roles and responsibilities, criteria for risk acceptability, verification activities, activities for production and post-production information collection - Risk Acceptability Matrix: Define severity and probability categories and the criteria for acceptable, ALARP (As Low As Reasonably Practicable), and unacceptable risk levels Severity Categories: - Negligible (1): Inconvenience or temporary discomfort - Minor (2): Non-serious injury, temporary impairment - Serious (3): Injury requiring medical intervention - Critical (4): Permanent impairment or life-threatening - Catastrophic (5): Death Probability Categories: - Remote (1): < 1 in 1,000,000 - Unlikely (2): 1 in 1,000,000 to 1 in 100,000 - Occasional (3): 1 in 100,000 to 1 in 10,000 - Probable (4): 1 in 10,000 to 1 in 1,000 - Frequent (5): > 1 in 1,000 4.2 Hazard Identification - Identify hazards associated with the device considering: energy hazards, biological/chemical hazards, operational hazards, information hazards, usability hazards - Use structured techniques: preliminary hazard analysis (PHA), FMEA (Design and Process), fault tree analysis, use-related risk analysis (per IEC 62366-1) - Consider reasonably foreseeable misuse - Document in the Risk Analysis Worksheet (FRM-RM-002) 4.3 Risk Estimation - For each identified hazard, estimate: severity of harm, probability of occurrence of the hazardous situation, probability of the hazardous situation leading to harm - Record risk estimates in the Risk Analysis Worksheet 4.4 Risk Evaluation - Compare each estimated risk against the Risk Acceptability Matrix - Classify as: Acceptable (no further action required), ALARP (risk reduction should be pursued where practicable), Unacceptable (risk control measures mandatory) 4.5 Risk Control - Apply risk control measures in the following order of priority: 1. Inherent safety by design (eliminate the hazard) 2. Protective measures in the device or manufacturing process 3. Information for safety (labeling, IFU, training) - For each risk control measure: document the measure, verify implementation, validate effectiveness, assess whether new hazards are introduced - Update the Risk Analysis Worksheet with post-mitigation risk levels 4.6 Evaluation of Overall Residual Risk - After all individual risks have been controlled, evaluate whether the overall residual risk posed by the device is acceptable - If overall residual risk is not acceptable, perform a benefit-risk analysis - Document conclusions in the Risk Management Report (FRM-RM-003) 4.7 Risk Management Review & Report - Complete the Risk Management Report (FRM-RM-003) at the end of design and development (prior to design transfer) - The report summarizes: risk management plan execution, risk analysis results, risk control measures and verification, overall residual risk assessment, conclusions - Approved by the Quality Manager and Risk Management Team Leader 4.8 Production & Post-Production Monitoring - Monitor post-market data for new hazards or changes in risk: complaints, adverse events, literature, competitive device issues - Update the Risk Management File when new information warrants a risk re-assessment - Production and post-production risk information shall be reviewed at least annually

- Risk Management Plan (FRM-RM-001) - Risk Analysis Worksheet (FRM-RM-002) - Risk Management Report (FRM-RM-003) - Risk Control verification records - FMEA worksheets (Design and Process) - Post-production risk monitoring records

- ISO 14971:2019 Medical devices — Application of risk management to medical devices - ISO/TR 24971:2020 Guidance on the application of ISO 14971 - ISO 13485:2016 Clause 7.1 Planning of Product Realization - IEC 62366-1:2015 Usability Engineering - FDA Guidance: Factors to Consider Regarding Benefit-Risk in Medical Device Product Availability, Compliance, and Enforcement Decisions