Risk management plan: The most important advantages

The risk management plan is one of the most important documents in technical documentation. Accordingly, authorities and notified bodies examine this plan intensively.

However, it is not only from a regulatory perspective that medical device manufacturers benefit from a precise risk management plan. This article

• lists the regulatory requirements and
• shows how manufacturers benefit from a precise plan.

1. What a risk management plan is

In a risk management plan, a manufacturer documents information on procedures, activities, methods, and tools for the risk management of a specific device throughout its entire life cycle.

This information is usually available as a controlled document. It is also possible to store this information as structured data, as with the real-time compliance system.

2. What advantages the risk management plan offers

Advantage 1: Regulatory compliance and fast approval

Standards such as ISO 14971, Chapter 4.4, and laws require risk management plans. For example, the MDR and IVDR have identical wording in Annex I Section 3:

If manufacturers meet this requirement, they avoid regulatory hassles with approvals, inspections of technical documentation, and audits, for example, and possible consequences such as delayed approval.

Advantage 2: More efficient development

If a plan is in place, everyone involved knows what needs to be done and when. This is particularly important for successful risk management, to which many different roles contribute:

• development
• risk manager
• quality management
• clinical expert team
• top management
• customers and users

A plan ensures that all activities are coordinated and take place at the right time. It helps to avoid uncoordinated activities and blind performance.

Advantage 3: Better devices

If all risk management activities are carried out by the right people, using the proper methods and at the right time (this is precisely what the risk management plan determines), these activities are particularly effective. This means that risks are identified and controlled with particular reliability. This results in safe devices.

The risk management plan is also necessary in order to derive the product-specific requirements for risk management from the often generally applicable standard operating procedure for risk management. Only the product-specific activities lead to the safety of the device being optimized.

Advantage 4: Better processes

The risk management plan also helps at the meta-level: it is part of the PDCA cycle ("Plan-Do-Check-Act"). Without a plan, nothing can be done ("Do") and checked ("Check"). The deviation from the status quo to the plan results in the necessary actions ("Act") to improve not only the specific plan but also the entire risk management process.

3. What the risk management plan contains

The minimum requirements for the content of risk management plans are set out in

• the ISO 14971, Chapter 4.4 and
• the position paper of the Team-NB from 2023 (see p. 18).

ISO 14971 requires the following elements:

• scope of risk management activities
• responsibilities
• requirements for the activities
• criteria for risk acceptance
• method for assessing residual risks
• activities for verification of risk control measures
• activities during production and in the post-production phase

The following sections contain further information.

a) Scope of application

The scope of application has various dimensions that the risk management plan should consider:

Organizational structure

The persons and departments affected by the document must be specified here. These should also be involved in the creation and release of the risk management plan.

Suppliers carry out many activities in the development and production of medical devices. The plan must, therefore, regulate whether it also relates to them.

Object

The plan should specify which device or devices it relates to. In the case of systems, this can also relate to only part of the system, possibly only accessories for a device or consumables.

Workflow organization and processes

It should be clarified which processes and life cycle phases the plan covers. Does it only apply to the initial development or also to later design changes? Does it cover the post-market phase?

b) Responsibilities

Risk management is a team sport. Typical roles have already been mentioned above. The risk management plan ensures that no roles are forgotten and that all necessary competencies are available.

c) Requirements for the activities

Methods and procedures

Various activities must be carried out as part of risk management, e.g., hazard analysis, risk evaluation, definition of risk-minimizing measures, and review of their effectiveness.

Manufacturers must define requirements for each of these activities. This is usually done by defining methods, for example, the PHA for the hazard analysis.

If a higher-level process or standard operating procedure already specifies this, the risk management plan can overwrite it or specify it in another project-specific way.

Further specifications

The risk management plan can provide answers to the following questions:

• How is the analysis broken down into modular sub-analyses (design, manufacturing, software, cybersecurity, suppliers, AI/ML, components, lifecycle phases, etc.)?
• In what form are the activities documented?
• Who benefits from which output documents and when?
• Which tools are to be used for the activities?

d) Risk acceptance

Further specifications of the risk management plan concern the risk acceptance criteria, for example,

• the definition of the probability and severity axis,
• the derivation (or acceptance) of the quantitative or qualitative benefits,
• the procedure for assessing the residual risk, e.g., based on the individual risks or at the level of the overall risk.

e) Further specifications

The risk management plan regularly contains references to documents that also apply and must be observed.

4. Typical audit deviations

The Johner Institute's risk management team has compiled frequently occurring complaints from authorities and notified bodies regarding the risk management plan:

• The team is not complete. For example, an expert for ISO 14971 or a doctor is missing.
• Some auditors and reviewers claim that an acceptance matrix should no longer have three colors. Others state that colors are no longer permitted at all. Neither is true. But generally acceptable risks, which are often described as green, are not permitted by ISO 14971, MDR, or IVDR.
• The risk management plan is completely missing. A standard operating procedure (SOP) alone is not sufficient if it lacks product- and project-specific specifications.
• It is not described how the review is carried out or who participates in it.
• There is no statement on the final overall residual risk or benefit-risk assessment and, in particular, how and with which method this is carried out.
• It is not clear which system or product components the plan covers. Or the plan does not cover the variants of the device and its accessories, consumables, and options.
• Certain aspects are missing from the risk analysis (e.g., manufacturing, software, packaging, storage/transport, accompanying documents, biological safety, etc.) because they were already missing from the plan.

5. Tips for creating the risk management plan

a) Rule out typical errors

Make sure that you can rule out the deviations mentioned above in Chapter 4 that are identified during audits.

b) Controlling of the risk management plan

A risk management plan is not a static document. It is revised and must be updated continuously as new information becomes available. These revisions should be attached to the risk management file.

c) Review of the risk management plan

A manufacturer should check whether the risk management plan specifies all the risk management activities described in ISO 14971:2019 in Chapters 5 to 10. For each of these activities, the risk management plan should specify:

• the persons responsible for implementation and inspection
• documents in which the activities are documented
• the phase of the life cycle or specifically of the development process in which this activity is carried out
• the aids and tools that will be used in the process

A representative of top management should approve the RM plan to ensure consistency with the established risk policy.

d) Use of the plan

Design reviews can be used to check whether risk management is being carried out in accordance with the plan. The plan also provides the input for the final risk management assessment.

In both cases, it must be checked whether

• the intended persons carried out
• the planned activities
• at the planned time
• with the planned methods and tools and
• have documented them as intended.

This means that the structured and systematic approach to the analysis should not only be planned but also documented accordingly. This has a positive effect on the efficiency of the implementation, prevents gaps and deviations, and also serves later as proof that a systematic approach was actually taken.

6. Summary and conclusion

A manufacturer must draw up a risk management plan for each device. Standards and laws define the contents of these plans.

Like all plans, the risk management plan must also specify who does what, when and how, and which inputs are converted into which outputs. Like all plans, the risk management plan is not a static document but can be developed further. This is because risk management does not end with development.

It is important to fulfill the minimum requirements of the plan and stick to it later. In this way, manufacturers can not only avoid problems in audits and approvals. A risk management plan is an important building block for the efficient development and production of safe medical devices.