Facebook
  1. Home
  2. Insights
  3. Blog
  4. Managing risk for medical devices

Managing risk for medical devices

Which risk management principles are right for medical devices?

In this series, we review ISO 14971 (Application of risk management to medical devices)—its history, the principles embedded within it and how it relates to other standards and regulation

The value in having standards drawn up by experts is that they should be able to withstand the test of time as well as pressure from outside influences. Such is the case with ISO 14971, created in 1998 by a joint International Organisation for Standardisation (ISO)/International Electrotechnical Commission (IEC) Working Group (JWG1). 

In 2012 the European Commission (EC) raised legal objections to several harmonised standards. In particular, the Commission determined that compliance with ISO 14971 could not guarantee conformity with the Essential Requirements relating to risk as contained in the European Medical Devices Directive (MDD). In response, JWG1 pointed out that the differences between the standard and the Essential Requirements were due to imprecise wording in the Directive, rather than to inadequacies in ISO 14971. The Commission’s position was that the wording of the MDD was the only thing that mattered. The two bodies were at an impasse until the MDD was replaced by the Medical Device Regulation (MDR), which, through lobbying, national standards bodies ensured reflected the principles set out in ISO 14971.

The drive to develop a common understanding of risk

Further controversy around managing risk in the medical device sector arose in 2021 when the ISO and IEC technical management boards aimed to adopt a common understanding of risk management principles and use the same definitions across all industry sectors. 

The risk model they chose was that of ISO 3100:2018, as it provides guidelines on a common approach to managing risks faced by organisations and defines risk as “the effect of uncertainty on objectives.” This concept relates risk not only to potential harm but also accepts that it can have positive consequences.  Proponents of adopting the ISO 3100 model held that it could be applied universally since it is based on the valid concept, embedded in ISO 14971 as well, that risk is all about investigating the role of uncertainty in predicting outcomes. Users of ISO 14971 would do well to remember this. 

ISO 3100 also impacts the medical devices sector through ISO 9001, which is universally applicable and underpins the requirements of ISO 13485 for medical device quality management systems. ISO 9001 requires that quality assurance be centred on systematic, proactive, risk-based thinking. It relates the concept of risk to the uncertainty of achieving an expected result and refers to opportunity as the possibility of exceeding expectations and going beyond stated objectives. These principles are viewed as sound by industry experts. 

A Joint ISO/IEC Task Force was set up in 2021 with the goal of recommending a common understanding of risk across all sectors in three years. In the process, it soon became apparent that the model chosen for universal application was incompatible with the concept of risk as applied to healthcare. In healthcare, risk terminology is enshrined in healthcare regulation and is, therefore, not negotiable. 

The way the healthcare sector deals with risk is clearly defined in ISO/IEC Guide 51, on which ISO 14971 was based. It is consistent with principles applicable across all sectors that focus on avoiding harm to people or damage to property. These principles have been implemented effectively for over 30 years and have been adopted by the International Medical Device Regulators Forum (IMDRF) and many national and regional regulations, including the MDR. It took much less than three years for the ISO and IEC technical management boards’ proposal to be abandoned.

Essentially, we conclude that the model we use in the healthcare sector is fit for purpose and consequently, cast in stone. 

In this section

Connect with us