Facebook
  1. Home
  2. Insights
  3. Blog
  4. Managing risk for medical devices part 3

Managing risk for medical devices

Risk estimation in ISO 10993-1

In this series, we review ISO 14971 (Application of risk management to medical devices)—its history, the principles embedded within it and how it relates to other standards and regulation.

The revision of ISO 10993-1, currently in the final draft stage, has not been without controversy. However, it can be argued that the proposed amendments are not substantive from a conceptual viewpoint; the principles relating to the biological risk evaluation of medical devices and the risk management process itself remain unchanged. The revision clarifies good practice rather than changes it. 

ISO Technical Committee 194 is responsible for international standards on the biological and clinical evaluation of medical devices. When the Committee agreed to publish the new version of ISO 10993-1 in October 2024, it acknowledged that additional guidance was needed urgently in several key areas—biological risk estimation being one of them. From discussions within the ISO Working Group and preliminary work on this subject, it was apparent that there were widely differing views amongst Working Group experts on what risk estimation entailed. Here, we explore what it means in the context of evaluating the biological risk associated with medical devices.

Risk estimation as defined in ISO 14971 and practiced in ISO 10993-1

As specified by ISO 14971, risk estimation is the final step of the risk analysis process. It entails assigning values (not necessarily quantitative—ISO 14971 does not specify the use of any particular risk estimation methods) to the likelihood and severity of harm occurring as a result of exposure to a hazard. A risk estimate is needed because it has to be compared to pre-defined criteria to judge the acceptability of the risk. 

Although some elements of a biological risk analysis can be quantitative, it is unrealistic to expect the overall biological risk estimate to be quantitative. It is also unrealistic to try to shoehorn biological risk estimation into a semi-quantitative model such as a risk matrix, which is often based on a failure mode and effects analysis (FMEA). While the outcome of a biological evaluation is an appropriate input into a risk matrix, the risk estimates that inform the biological evaluation are derived using different methods. 

Fundamentally, biological evaluation (also called biocompatibility assessment) is an application of toxicology. It must, therefore, be investigated using toxicological methods. In the past, ISO 10993-1 has often been misunderstood, either because this was not realised or because those using it did not understand toxicology. Thus, ISO 10993-1 needed to be revised to ensure that toxicological risk management principles and processes were inescapable in a biological evaluation. To properly implement ISO 10993-1, one must understand toxicology and appreciate that biological risk management is entirely consistent with ISO 14971.

Because ISO 14971 permits any method of risk estimation, as long as it is appropriate for the circumstances, the starting point for guidance on biological risk estimation is not ISO 14971, but toxicology, since this provides the only risk estimation methods that are relevant. 

Toxicological Risk Analysis

The toxicological risk analysis of medical device constituents, normally leading to a quantitative estimate of the risk of harm to humans, is covered comprehensively by ISO 10993-17. However, this standard is not applicable to all aspects encompassed within the scope of ISO 10993-1. The important point to remember here is that the same toxicological risk assessment principles apply to all aspects of a biological evaluation, even when a quantitative approach is not possible.

Some people have questioned how assigning values to the probability of occurrence of harm and the severity of that harm is applicable to a biological evaluation—although this is how risk estimation works in all circumstances. The likelihood of harm is estimated from exposure considerations, and the severity of harm is determined by characterising the biological hazard. The quality and relevance of the available data are then factored into the risk estimate. The method may look different from other examples of risk analysis, but the principles are exactly the same.

Risk perception and acceptability criteria

The process for assessing biological risk also looks different because of how the perception of risk impacts acceptability criteria. Risk perception colours all aspects of risk management and should be, at least theoretically, the starting point for any risk management activity. Risk perception directs regulations and standards. Importantly, ISO 14971 requires that the criteria for risk acceptability are based on regulations and take into account the state of the art and stakeholder concerns. So, what do the state of the art and stakeholder concerns say about acceptability criteria for biological risks from medical devices?

In some cases, during the manufacture of a medical device, it is impossible to avoid the presence of chemical residues at levels that can lead to toxic effects or physical characteristics that can lead to an inappropriate tissue response. Fortunately, such circumstances are rare; in the vast majority of cases, it is not necessary to entertain any significant risk of biological harm to achieve the benefit provided by the medical device. This dictates the state of the art, and stakeholders would be rightly concerned if patients suffered significant biological harm from the routine use of medical devices.

The inescapable conclusion from this situation is that biological risk estimates need to be geared towards acceptability criteria that reflect the expectation that no appreciable risk of harm to health should arise from medical device materials or manufacturing processes, unless accepting the risk is essential to achieving the desired clinical benefit. This premise must be the starting point for the guidance that is needed for biological risk estimation for medical devices.

Jeremy Tinkler, ERT

Regulatory Affairs Director, ICON plc

Member of the Joint ISO/IEC Working Group responsible for ISO 14971

In this section

Connect with us