Risk Management: Top Management Responsibilities, Policy for Risk Acceptability and Competence

Clause 4 of the standard starts with management, not with analysis techniques. Before anyone fills in a risk table, top management needs to provide resources, assign competent people, define a policy for risk acceptability and check from time to time that the process works. In organizations with only a few people these things are sometimes done without a single document that brings them together.

In this article we look at what is required of management, what a policy looks like, how it turns into criteria in the risk management plan, and what competence is required of the people who do this work.

What is required of top management

Clause 4.2 of the standard places three obligations on top management:

  • Provide evidence of its commitment to the process by providing adequate resources and assigning competent personnel (4.3).

  • Define and document a policy for establishing criteria for risk acceptability.

  • Review the suitability of the process at planned intervals, and document decisions and actions.

The standard defines top management as the person or group of people who direct and control a manufacturer at the highest level (3.29).

According to the TR, the emphasis on this level comes from the fact that only it has the power to assign responsibilities, set priorities and provide resources.

If the organization consists of separate entities, such as divisions, top management is whoever directs and controls the entity that implements the process, and each entity can have its own process.

The requirement also appears in the MDR.

Article 10 requires a risk management system as described in Section 3 of Annex I, and the quality management system has to include it.

Annex I Section 3 states that risk management is a continuous iterative process throughout the entire lifecycle, requiring regular systematic updating.

If the manufacturer has a quality management system in place, the review of the suitability of the process can be part of the management review (4.2).

The documents described in clause 4.2 can also be incorporated within the quality management system documents and referenced from the risk management file (Note 3 to clause 4.2).

The policy for risk acceptability

The standard does not define what level of risk is acceptable (see article 1). That level is set according to a policy that management defines, and the policy provides a framework from which the criteria for each device are derived. According to clause 4.2, this framework ensures that the criteria:

  • are based on applicable national or regional regulations and relevant international standards

  • take into account available information, such as the generally acknowledged state of the art and known stakeholder concerns.

Annex C of the TR lists the elements a policy should typically address:

Element

What it defines

Purpose

What the policy is meant to achieve, and which devices the criteria apply to

Scope

To whom, where and when the policy applies

Factors and considerations

Regulations in the markets, standards for the type of device, the generally acknowledged state of the art, validated stakeholder concerns

Approaches to risk control

How risk is reduced: as low as reasonably practicable, or as far as possible

Approval and review

Who approves the policy, and how often it is reviewed

The policy has to be documented, for example as part of the quality management system documentation.

It does not have to be part of the risk management file (Annex C.2).

It can allow specific criteria for each type of device or device family, depending on its characteristics and intended use, and it has to include guidelines for establishing the criteria for overall residual risk (TR 4.2.2).

On the fourth factor, stakeholder concerns, the TR adds that they can come from direct communication with users, clinicians, patients or regulatory bodies, and from indirect communication such as news reports, social media and patient forums. The perception of risk acceptability varies between groups, depending on each group's background and interest.

How to word the approach to risk control

The policy also sets the approach to reducing risk. Note 1 to clause 4.2 gives three options:

  • reducing risk as low as reasonably practicable (ALARP);

  • reducing risk as low as reasonably achievable (ALARA);

  • reducing risk as far as possible without adversely affecting the benefit-risk ratio (AFAP).

The TR adds two lines of consideration.

The first is practicability, technical and economic.

Technical practicability refers to the ability to reduce risk regardless of cost. Examples where it is questionable: a risk control measure that diminishes the effectiveness of the device or compromises its intended use (such as reducing the power of an electrosurgical unit below its effective level), a procedure for use so complex that it increases the probability of use error, so many alarms or warnings that they hamper the operator, and communicating so many residual risks that the user cannot tell what really matters.

Economic practicability refers to the ability to reduce risk without making the device an unsound economic proposition, because the risk control measures would make it so expensive that it would no longer be available. The TR stresses that the economic consideration relates to the benefits for public health and for society as a whole, and is not a rationale for accepting unnecessary risk (Annex C.4).

The second line is the magnitude of the risk.

Residual risk is classified into three categories: it exceeds the criteria, it is so small that it can be regarded as negligible, or it lies between the two and requires checking whether it can be reduced further. The policy decides whether risk reduction continues for negligible risks too, before risk evaluation. For this the TR shows a three-region matrix (Figure C.1).

In the European context there is one more point. Annex I Section 2 of the MDR defines "as far as possible" as reducing risk without adversely affecting the benefit-risk ratio, and that definition is the same as the third option in the standard's list. A policy for a device intended for the European market has to meet this definition. If the policy is based on a principle of economic practicability, it is worth explaining in the policy how this fits with the definition.

From the policy to the criteria

The criteria for risk acceptability are set in the risk management plan for each device (clause 4.4 d), based on the policy. They can include qualitative requirements and quantitative limits for specific properties, preferably based on international standards. When the probability of occurrence of harm cannot be estimated, the criteria can be based on the severity of harm alone (Annex C.3).

The plan must also define criteria for acceptability of the overall residual risk and the method to evaluate it (4.4 e). These can differ from the criteria for individual risks, and there is more on this in the article on overall residual risk. The rationale in Annex A of the standard is that the criteria need to be set before risk analysis begins, so that the risk evaluation in clause 6 is objective.

Table C.1 in the TR shows how this chain works for four types of elements in the policy. Here are two examples:

  • A regulatory requirement. The policy states that the criteria meet the safety requirements of the regulations in each market. The matching criterion: the device remains safe in single fault condition, including software failure. The evaluation is done by inspecting test results, standard conformance reports or certificates.

  • Stakeholder concerns. The policy states that the criteria address concerns identified in the literature, in usability studies, in focus groups or in post-production monitoring. Two example criteria from the table: risk related to bovine materials is a public concern and is therefore eliminated by design, and accidental use of the same needle-based device on several patients is a concern for healthcare organizations, so warnings are required for the risk to be deemed acceptable.

A change to the plan, including a change to the criteria in the middle of the device's life, must be recorded in the risk management file (clause 4.4).

Reviewing the suitability of the process

Top management reviews at planned intervals whether the risk management process continues to be effective, and documents decisions and actions.

The TR suggests that the review cover, among other things, three aspects:

  • the effectiveness of the implemented risk management procedures

  • the adequacy of the criteria for risk acceptability, which can lead to adapting the criteria for specific devices

  • the effectiveness of the feedback loop of production and post-production information (clause 10.4).

The link to clause 10.4 is explicit. When the information collected is relevant to safety, the manufacturer evaluates its impact on the risk management activities already carried out, and the results of that evaluation are an input to management's review (10.4, item 2). Note 2 to clause 4.2 also states that the results of reviewing production and post-production information can be an input to the review.

It is important to tell two reviews apart:

  • The suitability review in clause 4.2 looks at the whole process, and repeats at intervals the organization sets.

  • The risk management review in clause 9 looks at how the plan for a particular device was carried out before its release to the market, and its result is documented in the risk management report.

For medical electrical equipment, IEC 60601-1 excludes the periodic review of the suitability of the process from the risk management it requires (its clause 4.2.2), because its scope is limited to type examination and does not extend to lifecycle monitoring. The exclusion applies only to compliance with 60601-1. The review remains a requirement of 14971, so you meet it within the quality management system.

Competence of the people doing risk management

Clause 4.3 requires that persons performing risk management tasks be competent on the basis of education, training, skills and experience appropriate to the tasks.

Where appropriate, they need knowledge of and experience with the particular device (or similar devices) and its use, the technologies involved or the risk management techniques employed. Records must be maintained.

The rationale in Annex A explains that representatives of several functions are usually needed, and that the balance and relationship between them should also be considered. The competence records do not have to be in the risk management file, because of confidentiality and data protection considerations.

Table 1 in the TR gives examples of functions and the knowledge required of each.

Three details from the table deserve attention:

the role of a risk management owner who knows the process, a medical or clinical expert who knows actual use and the possible benefits and harms, and the responsibility of everyone who reviews and approves records to have expertise in the area they review.

The TR notes that some activities can be performed by external consultants or specialists.

In that case, the required competence must be documented, together with the objective evidence that it is fulfilled.

For the training of risk management specialists, the TR lists topics worth considering, among them managing a risk management program for medical devices, the concepts of risk and acceptability, probability and statistics, estimating severity and probability, risk control methods and verifying their effectiveness, and methods for analyzing production and post-production information.

What to check in your company

  • A startup before certification. Who is actually top management, and where is it written that it provides resources for risk management? A short policy that covers the five elements in the table is enough. If an external consultant or a clinical advisor takes part, document their competence and the evidence for it.

  • A company with a product on the market. When was the policy last reviewed, and is the review of the suitability of the process documented with decisions and actions, for example in the management review? Does the input include trends from complaints and from monitoring the product on the market? Does the wording of the approach to risk reduction fit the MDR definition of "as far as possible"?

  • A company making a change. Adding a device family or changing the post-market process: does the policy allow criteria for the new family, and was the plan updated with its changes recorded in the file?

  • Competence. Does every function relevant to your device have a named person, with competence records you can show?

In the next article: the risk management plan and the risk management file, that is, what the plan must contain and how to build traceability.