In this first article, we discuss the Amendment 1 change to Clause 4.2 of IEC 60601-1, which required compliance with ISO 14971. This revised requirement was extensively restructured, and the particular requirement addressing production and post-production information was:
4.2.21 General requirement for RISK MANAGEMENT
A RISK MANAGEMENT PROCESS complying with ISO 14971 shall be performed. For compliance with this standard, all elements of the ISO 14971:2007 RISK MANAGEMENT PROCESS shall be applied except:
– the planning for and execution of production and post-production monitoring (subclause 3.1, fourth dash, subclause 3.4, item f), and Clause 9 of ISO 14971:2007), and
– periodic reviews of the suitability of the RISK MANAGEMENT PROCESS (subclause 3.2, fourth dash, of ISO 14971:2007).
Note that another element, periodic review of the Risk Management process, was also excluded from consideration by the Amendment 1 revision. The motivation for these exclusions was the fact that the Scope of IEC 60601-1 is that of a Type Examination standard. This means that any assessment of a device against the requirements of the standard represents a “snapshot in time”. That is, at the time of an assessment, a representative sample of the product would need to comply with all applicable requirements.
Contrast this with the scope of ISO 14971, which reads, in part:
This International Standard specifies a process for a manufacturer to identify the hazards associated with medical devices, including in vitro diagnostic (IVD) medical devices, to estimate and evaluate the associated risks, to control these risks, and to monitor the effectiveness of the controls.
The requirements of this International Standard are applicable to all stages of the life-cycle of a medical device.
Note that the requirements for risk control, and monitoring effectiveness of the controls, are applicable at all stages of the life-cycle of a device. As we look deeper into the requirements, we also see that ISO 14971 defines risk management as follows:
risk management – systematic application of management policies, procedures, and practices to the tasks of analyzing, evaluating, controlling, and monitoring risk
Again, the definition reinforces that management includes “controlling” and “monitoring” risk. Harold Koontz and Heinz Weihrich, in “Essentials of Management, An International Perspective”, define controlling as:
“…the measurement and correction of performance in order to make sure that enterprise objectives and the plans devised to attain them are accomplished.”
That is, to manage and control risk, a feedback loop must exist; and this is also why review of production and post-production device performance is absolutely key to help ensure safety and efficacy. As has been quoted more succinctly to the author of this paper by regulatory officials:
“How do you manage risk without post-production measurement?”
This is fully recognized within ISO 14971, and is reflected in the requirement of clause 3.1 which states:
“The manufacturer shall establish, document and maintain throughout the life-cycle an ongoing process for identifying hazards associated with a medical device, estimating and evaluating the associated risks, controlling these risks, and monitoring the effectiveness of the controls.” (emphasis added)
Many examples can be cited in recent events where failure to monitor field performance and take appropriate action has resulted in significant costs and penalties for the parties involved. Two examples from the automobile industry include ignition switches and airbags. Therefore, to assess the effectiveness of a risk management process on an on-going basis and to ensure that enterprise objectives (including safety) are being met, it is of paramount importance to understand whether production and post-production information is being reviewed with appropriate actions taken based upon the feedback obtained.
One final point worth noting in this discussion is that, despite the fact that IEC 60601-1 has excluded assessment of the planning for and execution of production and post-production monitoring in type examinations using that standard, medical device manufacturers are still responsible for performing the production and post-production review tasks. The Corrective and Preventive Action (CAPA) process required by Section 820.100 of the FDA Quality System Regulation (QSR) aligns quite well with the requirements of clause 9 and others of ISO 14971. FDA explains its expectations for fulfilling the requirements of Section 820.100 in the Preamble to the QSR as follows:
“FDA…has written…[Sec. 820.100(a)(2)]…to require investigation of the cause of nonconformities relating to process, product, and the quality system….this section… requires that nonconforming product discovered before or after distribution be investigated to the degree commensurate with the significance and risk of the nonconformity…”
Clearly, it is helpful to understand why integration of the two types of standards (type examination and process) necessitated removing assessment of the planning for and execution of production and post-production monitoring from consideration in type examinations according to IEC 60601-1. However regardless of whether the activity is assessed by a Certifier or not, the regulatory imperative is inescapable. It must be understood that the risk management monitoring of production and post-production performance is not only needed, but critical to help ensure safe and effective devices in the marketplace. Production and post-production monitoring, and management action, is foundational to the success of both a CAPA and risk management program.
In this article, we covered the reasons for eliminating an assessment of a manufacturers’ review of production and post-production information during a type test examination; and also explained why this does not free a manufacturer from regulatory expectations for performing such activities. In our next article in the series, we will review the frequently misunderstood concept of Essential Performance.
Return to GxP Lifeline to read the second part of this article Thursday, January 21.
Mark Leimbeck is a program manager for the Medical Regulatory Advisory Services of UL’s Health Sciences Division. He is responsible for developing new services and training, and he represents UL on international standards and other technical development committees.
Leimbeck has worked with UL for over 30 years in a variety of roles, including operations manager and principal engineer for multiple product categories. He currently serves as the chair of the UL Health Sciences Council and is a member of the IECEE Risk Management Task Force.
Leimbeck is a registered professional engineer (PE) and a registered RABQSA auditor. He holds a bachelor’s degree in electrical engineering technology from Southern Illinois University and a master’s degree in business administration from the University of Chicago.