ISO 14971 Content Deviation #4 Risk/Benefit Analysis

  • Post author:
Read Time: 5 minutes
Written by: John Lafferty.

During the process of harmonisation of ISO 14971: 2007 as an EN standard, it became apparent that the standard did not comply with all the requirements of the Medical Devices Directives (MDDs), namely 90/385/EEC, 93/42/EEC and 98/79/EC. Seven discrepancies were identified; these discrepancies are described in EN 14971 as “Content Deviations”.

This blog deals with Content Deviation No. 4 – Risk/Benefit Analysis

Risk/Benefit Analysis involves weighing the clinical benefits derived from the device against the risks inherent in using the device, known as the residual risks (i.e. those risks that have not been designed out). Clauses 6.5 and 7 of ISO 14971 suggest that a Risk/Benefit Analysis is only required for risks that would otherwise be deemed unacceptable. Annex D.6.1 of ISO 14971 gives guidance that Risk/Benefit Analysis is not required for every risk. However, Essential Requirements 1 and 2 contained in Annex 1 of the MDDs require that a Risk/Benefit Analysis be performed for each risk and for the overall residual risk. In addition, Essential Requirement 6a of the MDDs also requires a Risk/Benefit Analysis as part of the conclusion in the clinical evaluation report (see MEDDEV 2.7.1 rev 3 for guidance on the format and content of a clinical evaluation report).

MDR Requirements

The Medical Devices Directives require that a Risk/Benefit Analysis be performed for each individual risk and the totality of all residual risks—not just the risks that have been identified as unacceptable and irrespective of the magnitude of those risks. Performing Risk/Benefit Analysis on risks that were hitherto described as acceptable or negligible risks may seem like an unnecessary and purely academic exercise; however this is required in order to conform to the Directives.
In order to comply with the Essential Requirements of the European Directives relating to Risk/Benefit Analysis (i.e. the fourth content deviation between the ISO 14971 Standard and the Essential Requirements of the European Directives), a change is required to a manufacturer’s risk management process and procedures. To comply with EN ISO 14971:2012, it must be ensured that it is clear in the procedures that Risk/Benefit Analysis is required for every risk regardless of magnitude. In the case of risks that cannot be justified by Risk/Benefit Analysis those risks cannot be considered acceptable and the product cannot be placed on the market unless those risks are eliminated or reduced to the point where they are outweighed by the clinical benefits of using the device. Risk/Benefit Analysis must take into account the risks of using the device given the current state of the art and alternative therapies that are available. This may mean that where new technologies become available, risks that were previously acceptable may no longer be justifiable.

Two Classes of Risk

In a previous blog, we determined that all risks must be reduced as far as possible, meaning an end to the concept of ALARP for devices sold in Europe. Combined with the requirement to perform Risk/Benefit Analysis, this effectively leaves only two classes of risk; those that have been reduced as far as possible and can be justified by Risk/Benefit Analysis and those that cannot be justified by Risk/Benefit Analysis.

Clinical Input

Clinical input is an essential component of Risk/Benefit Analysis. For companies that are currently involved in developing new products, access to clinical input should present no difficulty, but for companies that have older product lines, or are producing ’me-too’ devices or low risk devices, access to clinical input may require developing new relationships with clinicians where these do not already exist. Another possible difficulty could be reluctance by clinicians who have not been involved in the development stages of the product to sign off on Risk/Benefit Analysis especially considering the litigious environment in which clinicians operate today.
However, clinical input need not always be direct clinical input. All devices placed on the market in Europe require a clinical evaluation. In some cases this is achieved by a review of published clinical literature and post-market surveillance data so some form of clinical input will be available for every device already on the market. It is recommended that Risk/Benefit Analysis be included in the clinical evaluation process using the device’s residual risks as inputs to the clinical evaluation. The clinical evaluation report should include a statement as to whether these risks are outweighed by the clinical benefits of using the device.

Cross References

The risk management report and the clinical evaluation should be cross-referenced. Both documents should provide traceability to each risk identified in the risk analysis, and decisions on risk acceptability should be based on the conclusions of the clinical evaluation. Risk Management Reports should state clearly that Risk/Benefit Analysis has been preformed for the individual risks and for the totality of risk and that these risks are outweighed by the clinical benefits of using the device.

Updates Following Modifications

The clinical evaluation and risk benefit analysis will need to be updated periodically following modifications to the device, in the event of adverse incidents and on foot of other post-market surveillance information. The need to do this should be included in the company’s Risk Management procedure as part of the system for period review of risk and in the company’ procedures on clinical evaluation and post market surveillance. Compliance with Content Deviation Number Four will require updates to a number of procedures and to the format of Clinical Evaluation reports and Risk Management Reports. From the procedures and reports it should be clear that the total and individual risks associated with using the device are clearly out weighed by the clinical benefits.
Another blog on our website deals with Content Deviation #5 Risk Control for CE Marking Medical Devices.

Course on Quality Risk Management and ISO 14971 for Medical Devices

To find out more, why not come along to our Quality Risk Management and ISO 14971 – Medical Devices course, which we run through our training partner SQT Training. To enquire further or to book, simply log on to SQT Training

John Lafferty – Tutor

John Lafferty is the tutor on the above training course. John also delivers courses in areas such as Quality Systems, Process Validation, Software Validation and Quality Risk Management on behalf of SQT. John runs a Quality Management Consultancy, Northridge Quality & Validation, which specialises in providing assistance to the Medical Devices and Pharmaceutical sector.