We all know that Risk Management is an important part of a medical device’s quality management system. It also plays an important role in establishing objective evidence for the conformity with the General Safety and Performance Requirements (GSPR) of the EU 2017/746 (IVDR) IVD Medical Device Regulation.
When carrying out a risk assessment, the state-of-the-art standard ISO 14971 can be used as an effective resource. The harmonisation of ISO 14971:2019 has an important role in the context of IVDR compliance. The harmonized version of the standard (EN ISO 14971:2019/A: 11:2021) was published in December of 2021. Annex ZB provides a comparison between the standard and Annex I of the IVDR.
The most important difference between ISO 14971:2019 standard and the IVDR risk management requirements is that the standard only requires a benefit-risk analysis to be performed if risks are unacceptable and further risk control is not practical. On the other hand, IVDR requires that a benefit/risk analysis for all and the overall residual risks. Therefore, medical device manufacturers must include a benefit/risk analysis in technical file submission regardless of risk acceptability.
The risk management process of an IVDR shall be implemented parallel to the risk management plan and risk management policy of the manufacturer.
IVDR risk management requirements
Risk management is as a continuous iterative process throughout the entire lifecycle of a device, requiring a systematic update. IVDR risk management requirements are defined mainly is in several parts of the regulation. A summary of the requirements can be listed as:
- Article 10, Sections 2 & 8(e) – Risk Management System,
- Annex I, General Safety Performance Requirements 1 to 8,
- Annex II, Section 5 Benefit- Risk Analysis and Risk Management,
- Annex III, Section 1(b) -Reassessment of the benefit-risk analysis and risk management using post-market surveillance data.
Risk management file for the IVDR
Manufacturers must prepare a risk management file for IVDR as a part of the QMS and technical documentation (Annex II, Section 5).The requirements of IVDR risk management file can be found in ISO 14971:2019, ISO/TR 24971:2020 and GHTF guidance document for risk management . Annex H of ISO/TR 24971:2020 is specific to IVDR risk management requirements. This annex provides general guidance to the manufacturer’s risk management process. Annex H covers the following main topics:
Risk Analysis
Each identified hazard must be analysed. This analysis must include:
- Intended use and reasonably foreseeable misuse,
- Characteristics related to patient safety,
- Known and foreseeable hazards to patients
- Identification of potential harms,
- Identification of hazardous situations,
- Identification of foreseeable sequences of events,
- Estimation of the probability of occurrence of harm.
Most IVD medical devices have two users:
- a user who performs all or part of an examination (“analytical use”)
- a clinician who receives, interprets and acts on the examination results (“clinical use”).
In the case of IVD medical devices intended for self-testing, the patient can be the only user.
Risk Control
Risk control activities should focus on reducing the probability of events under the control of the manufacturer and should be carried out taking into account the following:
- Inherently safe design and manufacture,
- Protective measures in the IVD medical device or manufacturing process,
- Information for safety,
- Role of standards and analytical performance criteria,
- User education and training.
Benefit Risk Analysis
The benefit-risk analysis is used to determine if the residual risk is outweighed by the expected benefits of the intended use of the medical device.
Disclosure of the residual risks
Manufacturers should take into account the information needed by medical laboratories and clinicians to evaluate the inherent residual risks and determine the need for further risk reduction measures and the followings:
- Performance specifications
- Limitations of the IVD medical device
- Generally recognized limitations of use
Production and post-production activities
Manufacturers must establish an effective system to monitor post-production information (complaints, adverse events, and product nonconformities). This system includes:
- Monitoring analytical performance
- Monitoring clinical performance
In line with the above, IVDR Manufacturers must prepare a risk management file including the Risk Management Plan, Risk Identification & Analysis and Risk Management Report.
If you need further clarifications on specific topics related to risk management or require assistance on risk management requirements of your medical devices, do not hesitate to contact us. Our experts would be happy to help you.