Risk Analysis & Product Requirements

Posted by Bob Duffy on December 14, 2010 in Design, Device Tips

Design Validation, Design Verification, Product Requirements, QSR, Risk Analysis, Specifications

In the QSR the words ‘risk analysis’ appear only once, under Design validation (21CFR820.30(g)) where it says “Design validation shall include software validation and risk analysis, where appropriate.” I have found that many medical device development teams have methods to perform risk analysis, but struggle with how to connect risk analysis with the rest of the design and development process. Consequently, they often lack a clear and simple process that results in meeting the requirement for risk analysis as part of Design Validation.

In a previous Device Tip, I discussed the value of establishing a hierarchy of product documents during a design and development project. So where does Risk Analysis fit in the product document hierarchy?

I have found the most effective place for Risk Analysis is the top of the product document hierarchy. And this makes sense because the patients and healthcare professionals that are the Users of medical devices expect that the Manufacturer has already taken measures to reduce risks to acceptable levels.

So how can one make this work? Here’s the tip:

Incorporate mitigations (risk reduction measures) from the Risk Analysis into the Product Requirements and Specifications.

By incorporating risk reduction measures into the Product Requirements and Specifications, they will be verified and validated right along with all the other requirements and specifications during Design Verification and Design Validation.

If this is done in conjunction with solid requirements traceability, you will get the added bonus of ensuring that requirements that were derived from risk reduction measures, will not be “accidentally” changed or worse deleted later in the product life cycle.

The key element here is to use the Product Requirements as the central depository of mitigations derived from risk analysis.  This ensures that, at minimum they will be verified and validated.

I have found the following process provides a straightforward approach to meet the requirement that “Design validation … include … risk analysis”:

1. Perform Hazard Analysis early in the design and development process, and incorporate these risk reduction measures into the Product Requirements and Specifications
2. Perform design Failure Modes Effects Analysis during the actual “design”, and incorporate these risk reduction measures into the Product Requirements and Specifications
3. Perform process Failure Modes Effects Analysis as the design is taking shape and manufacturing process is beginning to be defined, and incorporate these risk reduction measures into the Production Specifications in anticipation of Design Transfer

More details on Risk Management and Product Requirements

The following process provides a straightforward yet more detailed approach to meet the requirement that “Design validation … include … risk analysis”:

1. At the beginning of the project, conduct a Hazard Analysis to identify potential risks associated with the use of the planned product, even in the absence of device failure
2. If the initial risk for a given hazard is broadly acceptable, not further action is necessary for that hazard.  If the initial risk for a given hazard is NOT broadly acceptable, identify risk reduction measures (mitigations) for that hazard.
3. Add all the mitigations to the Product Requirements that are necessary to reduce residual risks to acceptable levels.
4. Incorporate the mitigations to the product design.
5. When the initial system design is complete, conduct a Design Failure Modes Effects Analysis to identify hazard associated with failure of modules or subsystems of the product.
6. If the initial risk for a given hazard is broadly acceptable, not further action is necessary for that hazard.  If the initial risk for a given hazard is NOT broadly acceptable, identify risk reduction measures (mitigations) for that hazard.
7. Add all the mitigations to the Product Requirements that are necessary to reduce residual risks to acceptable levels
8. Incorporate the mitigations to the product design.
9. When the initial detailed design is complete, update the Design Failure Modes Effects Analysis to address risks associated with product component failures.
10. Add all the mitigations to the Product Requirements that are necessary to reduce residual risks to acceptable levels
11. Incorporate the mitigations to the product design.
12. Perform process Failure Modes Effects Analysis as the design is taking shape and manufacturing process is beginning to be defined, and incorporate these risk reduction measures into the Production Specifications in anticipation of Design Transfer
13. During Design Verification, verify that all mitigations have been implemented.
14. During Design Validation, validate that all mitigations are effective in reducing the specified residual risks to acceptable levels.

The following diagram shows the Risk Management activities during the typical flow of Design and Development, from product concept through detailed design.