ISO 14971:2019 Risk Management for Medical Device: Keeping up with current expectations

Have you looked at your risk management processes recently? With the update to internationally recognized standard ISO 14971: Medical devices — Application of risk management to medical devices late in 2019, many manufacturers have taken a hard look at strengthening their post-production procedures over the past year to make improvements to how risk is managed throughout the entire product lifecycle.

As product developers, it is ingrained in us to always be focusing on risk throughout the design process. We factor in decisions on the product safety architecture that are informed by risk analysis and scrutinize residual risks present in the design. We become confident that benefits outweigh the risks for the product we’re releasing. But what happens after release? It is not a new concept that the risk management process must continue after product launch. However, arguably some of the most significant updates to ISO 14971 in 2019 are focused around providing more detail on expectations for the post-production risk management process being an active process for collecting and evaluating information (as opposed to a passive process of responding to complaints), specifically:

• Requiring that the manufacturer establish, document and maintain a system to actively collect and review information during production and post-production phases, considering appropriate methods for collecting and processing this information.
• Including a specific list of information to be collected by the manufacturer, including information from monitoring of the production process, information from those responsible for installation, use, and maintenance of the device, information generated from supply chain, publicly available information, and information related to state of the art.
• Requiring that this information be reviewed for possible relevance to safety and documenting the results of these reviews
• Requiring specific actions to be taken for reviewing impact on the risk management file of the particular medical device as well as the overall risk management process based on any collected information relevant to safety.

The 2019 update to ISO 14971 also provides additional emphasis and guidance on assessing the balance of overall residual risks and the benefits, and explains that the ISO 14971 process can be applied to all types of hazards and risks associated with a medical device, for example biocompatibility, data and systems security, electricity, moving parts, radiation or usability.

If you haven’t looked at your risk management process over the last year in response to ISO 14971:2019, it might be time for a refresh as we look forward into 2021. This could mean transforming a ‘check the box’ annual review of adverse event data to a program that actively seeks post-production data with a higher level of engagement from a cross-functional team – shifting medical device risk management toward a truly living process after product launch.