Combining Product Risk Management & Design Controls ISO 14971 ISO 13485, Clause 7.3

Design Controls “Waterfall Diagram” 820.30h) – Design Transfer 820.30j) – Design History File (DHF) QSIT Major Subsystem

Two Hump Diagram R D Product Launch 510(k) DHF Begins

Two Hump Diagram + Typical Stages of Design Product Launch 510(k) Concept Phase Feasibility Phase Development Phase Pilot Phase Release Phase Design Transfer DHF Begins

When to Start a DHF? After the design plan has been developed Upon approval of the design project It’s not uncommon to start a DHF late and to retroactively assemble the file from documents that were already created in team meetings.

Organize Chronologically DHF Contents Design Plan User Needs Design Inputs Design Outputs – including labeling Verification Protocols & Reports Validation Protocols & Reports Process Validation & work instructions Design Review Meeting Minutes IOVV / Design Requirements Matrix Risk Management File Initial PMS Plan Clinical Data Summary and/or Clinical Evaluation Report Initial DMR/TF Index Regulatory Approval Organize Chronologically

Each Gate is a Design Review Meeting 5 or 6 Phase Gates 7.3.1 – Design Plan Approval 7.3.2 – Design Inputs Approval 7.3.3 – Design Outputs Approval 7.3.5 & 7.3.6 / 1st in Humans Study Approval Pilot Launch Approval Commercial Launch Approval Each Gate is a Design Review Meeting Clause 7.4 ISO 13485 Clauses Referenced

Design Reviews ISO 13485, Clause 7.3.4 Reviews shall… Be systematic and according to design plan Evaluate ability of design & development to meet requirements Identify problems and propose necessary actions Include participants representing various functions of the design team from that stage Results and necessary actions shall be recorded Include a reviewer not involved in that stage (21 CFR 820.30e)

Design Planning ISO 13485, Clause 7.3.1 The plan shall… Define stages of design & development Define the review, verification, validation & transfer activities for each stage Define responsibilities & authorities Management shall manage interfaces Document planning output and update as needed Concept Phase

Design Inputs

Input Output Verification Validation Also called a Design Requirements Matrix

Risk Management / Design Controls Clause 7.3.2e) of ISO 13485 states that Risk management shall be an Input into Design & Development Clause 6.3 of ISO 14971 requires verification of effectiveness of risk controls Clause 6.7 of ISO 14971 requires verification of completeness of risk controls

Risk Management File ISO 14971, Clause 3.5 File for each medical device The risk management file shall provide traceability for each identified hazard to: the risk analysis the risk evaluation the implementation and verification of the risk control measures the assessment of the acceptability of any residual risk(s) The records and other documents that make up the risk management file can form part of other documents and files required. Should contain at least references to all required documentation. The risk management file can be in any form or type of medium.

Risk Management Activities Needed Risk Management Plan Hazard Identification Risk Assessment Risk Control Option Analysis Risk Control Effectiveness Verification Risk / Benefit Analysis Risk Management Report

Risk Management Plan ISO 14971, Clause 3.4 (See Annex F for Example) The plan shall include at least the following: the scope of the planned risk management activities, identifying and describing the medical device and the life-cycle phases for which each element of the plan is applicable assignment of responsibilities and authorities requirements for review of risk management activities criteria for risk acceptability, based on the manufacturer's policy for determining acceptable risk, including criteria for accepting risks when the probability of occurrence of harm cannot be estimated verification activities activities related to collection and review of relevant production and post-production information For each risk management plan the manufacturer should choose appropriate risk acceptability criteria May implement a matrix indicating which combinations of probability of harm and severity of harm are acceptable or unacceptable The risk management plan is part of the risk management file Record of the changes shall be maintained in the risk management file Plan developed in accordance with the risk management process. Refer to Annex F for guidance on developing a risk management plan. Risk acceptability criteria determined according to manufacturer’s policy (based upon applicable regulations and International Standards, accepted state of the art, and known stakeholder concerns)

Hazard Identification ISO 14971, Clause 4.3 Documentation on known and foreseeable hazards associated with the medical device in both normal and fault conditions Maintained in the risk management file Annex C, Annex E, Previous Risk Analysis & TPLC Database (http://bit.ly/FDATPLC)

Risk Assessment Tools ISO 14971, Annex G Preliminary Hazard Analysis Fault Tree Analysis (FTA) Failure Mode & Effects Analysis (FMEA) Hazard & Operability Study (HAZOP) Hazard Analysis and Critical Control Point (HACCP)

dFMEA

Problems with dFMEA Bottom-up approach doesn’t facilitate complaint investigations RPN scores encourage prioritization of risk controls that deviates from MDD (EN ISO 14971:2012) No traceability to specific IFU Warnings & Precautions

Traceability of Risks http://imdrf.org/docs/ghtf/final/sg3/technical-docs/ghtf-sg3-n15r8-risk-management-principles-qms-050520.pdf

Integration of Risk Activities with Design Phases Risk Control Option Analysis Hazard Identification Risk Control Effectiveness Verification Risk Management Report Risk Assessment Risk Management Plan Risk / Benefit Analysis R D Product Launch 510(k) Concept Phase Feasibility Phase Development Phase Pilot Phase Release Phase Prior to commercial release of products, the best practice is to combine the risk management plan with the design plan. This diagram is called the “two-hump diagram”. The first hump is referred to as “R” for research. The second hump is referred to as “D” for development. To this basic diagram I have added the phases of the design control process and various risk management activities. Sometimes companies are late in initiating a design history file (DHF), but the risk management plan should be initiated prior development as part of the initial design project plan. Design Transfer DHF Begins

Starting the Lifecycle Loop Post-Market Surveillance Initial Risk Analysis Estimates Frequency of Occurrence for Hazards Post-Market Surveillance (PMS) Report Estimates Frequency of Harm Clinical Evaluation Report (CER) Assesses the Clinical Risk/Benefit of the New Product Risk Analysis Clinical Evaluation

Combined IOVV & Risk Traceability http://medicaldeviceacademy.com/design-control-proceduresforms/

Initiating Combined Matrix Perform Hazard Identification Work Backward to User Needs Fill in 1st Two Columns These are the first steps of the design process that often lead up to creating a Regulatory Pathway Summary Document & Design / Risk Management Plan

Preparation for Approval of Design Inputs Identify Applicable Harmonized Standards Identify Performance Testing Predicate Devices 510(k) Summary Special Controls Guidance Documents Search ISO Standards Are their internal specifications?

Perform Risk Assessment Identify Possible Risk Control Methods Severity of Harm Probability of Occurrence (P1) Preliminary Screening against Design Inputs Reiterate Risk Controls & Design Specifications Finalize Design Specifications (Approve Outputs)

V&V Verification of Risk Control Effectiveness Preliminary Estimation of P2 based upon literature (Need to perform literature search…Clinical Evaluation Report) Results of Clinical Evaluation and Risk / Benefit Analysis should determine: if Clinical Study is Needed If Post-Market Clinical Follow-up Study is Needed

Draft IFU Identify Residual Risks Warnings Precautions Contraindications This is critical for Adverse Events, Investigator Brochures and Litigation of Injuries or Death

Draft PMS Plan Post-Market Surveillance (PMS) Plan Needs to collect data for any residual risks Should verify estimated risks Should identify any missing hazards Should identify incorrect severity of harm Should include justification of no PMCF Study or… PMCF Protocol PMCF Report Should include updated Risk Management Plan

Risk Management Report This is a Summary Technical Document (STED) that summarizes all the risk management activities and references the document control numbers for the Risk Management Documents This should also include the dates of activities and personnel involved The frequency of review and update of the risk management documentation should be included

Other Training Webinars http://medicaldeviceacademy.com/design-controls-implementation-21-cfr-820-30/ http://medicaldeviceacademy.com/implementing-risk-management-process-compliant-iso-149712007-address-seven-deviations-identified-en-iso-149712012/

Q & A rob@13485cert.com What if your customer requires an FMEA? What does the FDA prefer for risk management documentation? Annex I of the MDD says to reduce risk "As Far As Possible". How do you know you have done that? Who needs training on risk management and design controls? What's the best way to store and maintain a risk management file? rob@13485cert.com

Do You Need Help with Design Controls or Risk Management? Rob Packard rob@13485cert.com +1.802.281.4381 rob13485