Medical Device Risk Management James Pink

Requirements The medical device industry is highly regulated and based upon a device specific risk rating for dealing with the level of regulation to be applied prior to market acceptance All modern medical device regulations cite ISO14971:2007 as being the standard to apply for medical devices

Global Harmonisation requirements GHTF safety and performance requirements require risk management to be used as a basis of identifying, evaluating, controlling and continuously monitoring the effectiveness of risk controls.

The need for risk management Source GHTF Study Group 1 4

The need for risk management Source GHTF Study Group 1 5

The need for risk management 6

Does it mean anything to me as adrug manufacturer If you have a drug delivered by means of a combination product then you are required to ensure that the device meets all safety and performance criteria of medical device regulations. As a result you are required to ensure that devices for drug-device combinations are being designed, manufactured, supplied and used in a way that all risks are controlled and the risks are outweighed by the clinical benefit.

The need for risk management 8

Risk management process ISO14971:2007 requirements 9

Risk Management Organisation Proof of concept Failures in Test Technology limitations User feedback including failures and hazards Summarise knowledge with respect to risks Design Planning Clinical literature Review Standards Competitor products Create Risk Management Plan Designing Simulations and Validations Testing results Supplier Part approvals Bench Testing Clinical investigations Risk Management Reviews Design Transfer Process Validation data Supplier qualification data Manufactured variance analysis Process FMEA Risk Controls and Transfer to Validation, Complaints, Vigilance, Change control and Supply chain Clinical Validation Clinical follow-up trends Published articles Complaints investigations Usability trends Survivorship Other PMS analysis New Risks, Frequencies and severities This slide describes the typical risk management organisation. Essentially best practice would be to identify specific roles and responsibilities within the organisation for the management of risk management activities relating to product and process. For instance if you are a Project leader then you will need to understand that your responsibilities lie with ensuring that information is generated for use by the risk management team and all outcomes of identifying characteristics, determining hazards and hazardous situations as well as their mitigation and review should be described and summarised. For a typical Design project where feedback has been received and proofing studies have identified a potential successful product, it is important to assemble as much data on risk as possible. Responsibility for undertaking proof of concept is generally within the Research departments of orthopaedic organisations and typically there is a wealth of data to demonstrate performance. For instance if the organisation decided to use a new material with a new geometry (For instance an anatomically relevant spigot as opposed to the usual method then there would be a series of anatomical reviews, tests, Finite element models, material analysis, prototypes and bench tests. Instrumentation would be considered for each phase of the surgical technique as would all elements of the surgical technique be scrutinised in order to ensure that the Surgeons are capable of operating under the new technique within the realms of current expected training programmes. Design control detection would then be much more robust based upon the available information produced at proof of concept stages The personnel within the team would be responsible for various elements of the risk management activities however the RM Team are essentially the ones who would meet more often and use data being fed into the risk management process to determine hazards, their probability and severity as well as 10

Risk management process Input Activity Output New Product development New Process introduction Change to Product Change to process Significant Change Adverse Incident trends Adverse Manufacture trends New markets / users PMS Trends CAPA Trends Risk Management controls Management Review analysis Adverse trends awareness Manufacturing limits & Controls Supplier limits & Controls Surgeon Training points Post Market Clinical Follow-up Complaints investigator training Change control team awareness CAPA investigator awareness Resources Meetings, Measures and actions Risk Management Team Risk Management experts Risk Management database Customers and Clinical leads PMS Meetings Product Review meetings Supplier Meetings Change control meetings Intra project Risk Analysis meetings Risk Management review meetings Management Review meeting Surgeon / User feedback Clinical Evaluation updates New Standards, risks and controls Records The risk management process requires to be defined by the organisation and should ideally explain how the process is activated, operated and reviewed with respect to ensuring that the organisation is able to plan for risks and their control, detect adverse trends relating to their initial probability and severity ratings as well as react to any potential changes in use, manufacture, design and acceptability in order to ensure that the risk management activities remain in accordance with state of the art and controls are implemented and reviewed. The concept relates back to the PDCA process as Risk management should be planned, undertaken, checked and any actions that do not provide confidence that risk is reduced should be re-evaluated and either alternative options sought or clinical benefit over risk evaluation undertaken. Like any process, the risk management process has an input. These inputs are defined in the table above but people involved in risk management should be aware that processes throughout the organisation should enact risk management. For instance it is common for an organisation to undertake a risk analysis for a new product however it is less common for a new manufacturing process to impact the Design risk analysis although the process could theoretically affect all previous decisions relating to the effectiveness of controls within a process. Risk management activities should be undertaken for.... New Products Line Extensions Changes in manufacturing technology Changes in the user environment Manufacturing changes that can affect sterility, geometry, mechanical properties, material, packaging or cleanliness. Changes in Supplier. The criteria and methods for undertaking risk management should be written including the method of obtaining clinically relevant data, determining risk acceptability, undertaking hazard analysis (including Design, Process and application FMEA), Documentation and Recording methods, Writing Risk management plans, Reviewing risk management activities, determining risk acceptability criteria, evaluating risk controls, writing benefit / risk reports and the risk management plan. Usually these are written as standard operating procedures with a series of templates to help the users undertake the process in a systematic and reproducible manner. Risk Management Plans Risk Management FMEA’s Risk Management Reports 11

Risk management process Example Risk Management Complaints Analysis Change Control Clinical Evaluation CAPA Validation New Product Development A new product development project is initiated. The process requires a plan, defines the information sources and identifies how clinical benefit will be derived from customers. Risk reviews, tools and methods are all defined including the forms, procedures and records required A Final report is written defining residual risks, controls and clinical benefit 12

Risk management process Example Risk Management Complaints Analysis Change Control Clinical Evaluation CAPA Validation New Product Development A change in Valve supplier is proposed for the MDI. The process defines what will happen, how the change is categorised based upon importance and defines the level of process risk management, controls and reviews necessary. Risk reviews, tools and methods are all defined including the forms, procedures and records required 13

Risk Management - Acceptability ISO14971:2007 requirements THIS HAS TO COME FROM A JOINT REVIEW WITH YOU AND YOUR SUPPLIER 14

Risk management acceptability Probability 5 = <1 in 100 4 = 1 in 100 3 = 1 in 1000 2 = 1 in 10,000 1 = >1 in 100,000 Based upon Surgical procedures Severity 5 = Death 4 = Revision / irreversible 3 = Reversible injury 2 = Minor Injury 1 = Inconvenience Increasing probability of occurrence of Harm Increasing severity of Harm 15

Risk management acceptability Probability 5 = <1 in 100 4 = 1 in 100 3 = 1 in 1000 2 = 1 in 10,000 1 = >1 in 100,000 Based upon Surgical procedures Severity 5 = Critical to safety 4 = Critical to function 3 = Customer Image 2 = Upset the customer 1 = Inconvenience Increasing probability of occurrence of Harm Increasing severity of Harm Device fails to deliver appropriate uniform dose over time 16

Risk management acceptability 17

Risk management acceptability 18

Risk management acceptability 19

Risk management acceptability 20

Risk management acceptability 21

Risk management acceptability 22

Risk management acceptability Tips Ensure that you are focussed on the current state of the art with relation to drug - device performance Ensure that you are able to define hazardous situations based upon the major associated failures Be aware that the level of acceptability will be based around your critical to safety and quality requirements. The final clinical harm will be required so that contract design suppliers and manufacturers are aware of the severity of failure. 23

Risk management plans ISO14971:2007 requirements 24

Risk management plans Lifecycle phases Concept and Definition Design and Development Transfer to Manufacture and limited market placement Post Market Lifecycle phases If a drug manufacturer uses a device they must develop risk management plans that will ensure all elements of risk are covered from design through to manufacture 25

Valve and Actuator Fatigue Risk management plans Step 1 - Undertake literature review Step 2 - Review previous designs Step 3 - Undertake Design Verification Step 4 - Undertake Design Validation Step 5 - Assign probability value Step 6 - Include in Clinical Evaluation Hazardous Situation Hazard Harm Design Feature Probability Severity Valve affects Dose plume Mechanical fatigue Too much drug Valve and Actuator Fatigue ? 3 5 26

Risk management plans Hazardous Situation Hazard Harm Design Feature Risk Verification Report Risk Management Meeting date 21/12/2009 Summary Verified information source from Clinical evaluation report C01989 issue 2 2 Design FMEA conducted 21/12/2008 verified 3 Test report T18786 revision 1 verified 4 Reviewed Test report and confirmed risk control acceptable Conclusion Risks identified in the risk analysis coincide with the original information sources and risk management activities defined within the RM Plan document D001 revision 3 Controls within Design have been reviewed and reduction of probability is consistent with the control Signed ____________Date 21/12/2009 Hazardous Situation Hazard Harm Design Feature Probability Severity Valve affects Dose plume1 Mechanical fatigue Too much drug Valve and Actuator Fatigue2 ? 33 5 27

Risk management file ISO14971:2007 requirements 28

Risk management file Requirement Risk Management Plan Clinical Evaluation – PHA* Identification of Characteristics Design FMEA Application FMEA Process / Supplier FMEA Risk Management Report 29

Risk Analysis ISO14971:2007 30

Risk analysis Annex G activities 31 Preliminary Hazard Analysis Proof of concept Failures in Test Technology limitations User feedback including failures and hazards Summarise knowledge with respect to risks Design Planning Clinical / Scientific literature Review Standards Competitor products Create Risk Management Plan Draw up Hazards Designing Simulations and Validations Testing results Supplier Part approvals Bench Testing Clinical investigations Risk Management Reviews Design Transfer Process Validation data Supplier qualification data Manufactured variance analysis Process FMEA Risk Controls and Transfer to Validation, Complaints, Vigilance, Change control and Supply chain Clinical Validation Clinical follow-up trends Customer Performance evaluation Published articles Complaints investigations Usability trends Other PMS analysis New Risks, Frequencies and severities Annex G activities MDI Preliminary Hazard Analysis MDI Clinical / Scientific evaluation Preliminary report MDI DFMEA Revision 1 MDI DFMEA Revision 3 MDI PFMEA Revision 1 MDI PMCF Revision 1 31

Risk analysis 32

Preliminary Hazard Analysis Review of FDA Guidance provides the following summary of requirements.... Characteristic Hazardous Situation Potential Harm Severity Dose content uniformity Insufficient Dose uniformity - Design characteristic failure / Actuator / Valve insufficient dose delivered too high dose delivered depends on customer / drug Degradation of Dose uniformity over time – Design characteristic failure of actuator / valve over the lifetime of uses As above As Above Aerodynamic particle size Particle size is > 5Microns - Design characteristic failure of the MDI (Size and shape of expansion chamber / stem Spray Pattern and Plum geometry Inappropriate spray pattern and or plume geometry – Design characteristic failure / Actuator / Valve Leaching Drug chamber / contact materials leaching - polynuclear aromatics (PNAs), nitrosamines, monomers, plasticizers, accelerators etc. Toxicological effects depends on customer / drug and patient contact 33

The preliminary clinical / Scientific report Description of the intended performance Describe reasonable performance expectations Describe indications and claims if known Standards and Regulatory guidance review Literature review based upon common features / exclusion and inclusion criteria Summary of current methods and their limitations including current techniques, instrumentation and surgical technique, current outcomes and expected clinical benefit Evaluation of your experiences from similar devices Confirmation from your customer relating to some of the most important aspects for their Drug Master file. = Compilation of Hazards / Hazardous situations to be included in future risk analysis = Consideration relating to risk acceptability 34

The preliminary clinical report Ensure that previous risk analysis are reviewed. Review of Design failures (Where output could not be achieved) Review of failed validations Review of limitations – Technology, Process, Supply chain or Drug delivery Review of customer complaints relating to similar designs or similar intended use 35

Risk analysis – PHA for MDI. Hazard Forseeable sequence of events Hazardous situation Information Source Harm Mechanical Dose content uniformity After several actuations the dose content uniformity is compromised Design [See Design FMEA for Valve and actuator design] Process See Process FMEA Use [See usability / AFMEA] FDA Guidance Design and Test data on file Insufficient dose Overdose No dose Chemical Leaching Unintended leaching of toxic compounds from the container / plastic components enter into the drug and are delivered to the patient [Selection of the material and manufacturing method – See DFMEA] [See PFMEA – Inappropriate moulding parameters – incorrect material spec] Design Data on file Toxicological / Poisoning 36

Risk management in Design Tip Ensure that there are regular reports relating to the design progress but ensure that risks identified and their references are reported within the phase as this concentrates the minds of the people undertaking the design project 37

Risk management documentation in design Risk Management Plan Clinical / Scientific Reports R&D Reports Process Validation reports Supplier qualification reports Design Validation reports Usability reports Identification of characteristics affecting safety Design FMEA Process FMEA Application FMEA Risk management summary Post market clinical follow up and risk reviews Transfer to manufacture risk management control plans 38

Risk management in design Proof of concept Failures in Test Technology limitations User feedback including failures and hazards Summarise knowledge with respect to risks Design Planning Clinical / Scientific literature Review Standards Competitor products Create Risk Management Plan Draw up Hazards Designing Simulations and Validations Testing results Supplier Part approvals Bench Testing Clinical investigations Risk Management Reviews Design Transfer Process Validation data Supplier qualification data Manufactured variance analysis Process FMEA Risk Controls and Transfer to Validation, Complaints, Vigilance, Change control and Supply chain Clinical Validation Clinical follow-up trends Customer Performance evaluation Published articles Complaints investigations Usability trends Other PMS analysis New Risks, Frequencies and severities Clinical literature Prelim Hazard Analysis Previous RA Risk Analysis Outcomes Risk Report Design Standards Intended Use Reliability data Competitor products Characteristics Customer feedback Recalls and advisory Hazard identification Manufacturing data Risk Mgt Plan 39

Typical Controls in Design. Functional Testing / Bench Testing Testing against a Standard – Validation i.e. ISO11137, ISO11607, ISO7206-4, IEC 60601-1 – FDA Guidance Simulation – Finite Element – Wear performance Hand Calculation Prototype study Choice of Materials Choice of processes and Technology Focus Group (Human Factor Analysis) Clinical Literature Searches Concept Reviews (Focus Group) – Surgeon / Clinical / User opinion CAD Assembly / Tolerance Study Design of Experiments Tolerance Stack Analysis Assembly Testing Scientific / Engineering Constant Review of Similar Designs Measurement Systems analysis Clinical Investigations Validations MTBF – Stability testing REMEMBER The control will be used in order to give you assurance when you are doing a test that you have covered a risk........

Typical controls in Design ISO Standards FDA Guidance Customer Testing methods Bespak Testing methods 41

Risk Management in process Risks Moulding Machining Assembly Cleaning Labelling Packaging Sterilisation Distribution Storage Material processing 42

Risk Management in process Risks Moulding Machining Assembly Cleaning Labelling Packaging Sterilisation Distribution Storage Material processing Process hazards should derive from the DFMEA Validation activities should be initiated with risk management 43

Risk Management in process Risks Moulding Machining Assembly Cleaning Labelling Packaging Sterilisation Distribution Storage Material processing How Moulding can initiate the hazard Hazards Leaching Inappropriate material Incorrect Heat and pressure Incorrect additives Inappropriate mould time ????? Moulding controls Sequence of events Material verification Process Validation of Moulding parameters Goods inwards Verification of raw materials QC Sampling for Leaching inappropriate cross linking of polymer leads to plasticiser free radical inappropriate material formulation / ingredient selected 44

Typical Controls in Process. Testing Points Trained in a SOP Gauge R&R Process Validation Monitoring and Measurement (SPC Process or product parameters) Poke Yoke Settings Checkmate Verifications / Closed Loop Systems Software validation 5S / Line Clearances Identification and Traceability Physical Location controls Start up verifications In process verifications Routine Maintenance Calibration ISO13485:2003 / Ordinance or FDA Control requirements. Supplier Evaluation – First Article / PPAP Routine Audits

Risk Controls – Risk benefit ISO14971:2007 requirements 46

Risk controls – risk benefit ISO14971:2007 requirements 47

Risk Management Report

Typical Risk Management Report Summarises the Way you did risk management Summarises that the risk controls have been implemented (And verified) Summarises where you got the information Provides a succinct summary of the results of the activities and how controls will be reviewed on an ongoing basis

Keeping risk management alive

Concept diagram - MDI Risk controls effective? Database 51 Define the need Define the need Define the Scope of the Project Define the Scope of Project Develop the Product Develop the Product Develop the Product Implement Process Develop the Product Place on Market Area MDI Operator / User COPD Patient Delivery method Valve / Actuator Intended Use Particle Size Number of uses Drug type Indications for use Critical to quality requirements Technology Moulding / Machining Risk control Verification Risk Manage Report PHA PHA What the clinical benefit would be Clinical Benefit V Risk Design Validation Process Validation Reasonable expected performance Select the Risk Management Plan to use Customer Acceptability DFMEA Risk controls effective? change to risk? Generic RM Plan Dev Lifecycle Custom RM Plan Dev Lifecycle Hazards relating to the current use, Technology PFMEA On Market RM Plan Lifecycle Change RM Plan Lifecycle NO YES Database 51