Risk Acceptability

Post-market risk management Mgmt%Ctrl

for stakeholder satisfaction

The inherent level of ‘risk’ that patients and

users can expect in association with the
use of a medical devices is never ‘zero’.

What level of ‘risk’ is acceptable?

The level of ‘acceptable risk’ is determined ?

through an understanding of the level of

risk that is experienced with the use of
competitively marketed devices.

Risk Acceptability Policy: The ‘state of the art benefit’ of patient safety is established through a
competitive understanding of post-market device ‘quality’ and is achieved when the overall
residual risk provided with a specific device is aligned with the level of risk that is inherent with the
use of competitively marketed devices.
Q: Who establishes the Risk Acceptability Policy?
A: Top management.

ISO 14971:20191 (§ 4.2) defines the responsibility of ‘top management’ to establish a policy for
risk acceptability criteria as follows:
“Top management shall define and document a policy for establishing criteria for risk
acceptability. The policy shall provide a framework that ensures that criteria are based upon
applicable national or regional regulations and relevant International Standards and take into
account available information such as the generally acknowledged state of the art and known
stakeholder concerns.”

ISO TR 24971:20202 (§ 4.2.2) explains the requirement of ‘top management’ to define and
document the policy for establishing the criteria for risk acceptability.

Annex C of the guidance also explains the relationship between the risk acceptability policy, the
criteria for risk acceptability, and how these criteria are to be utilized during risk control and risk
evaluation activity.

Q: How are risk thresholds typically established during design control activity?
A: Risk thresholds are typically derived from generic ‘one size fits all’ risk acceptability
criteria that is additionally supported by observationally oriented, versus data-driven,

1
ISO 14971:2019, Medical devices – Application of risk management to medical devices
2
ISO TR 24971:2020, Medical devices – Guidance on the application of ISO 14971

Info@Mgmt-Ctrl.com iQuality.ai/PMS (844) 349-2272

 Risk Acceptability

clinical information that is specific to the devices currently utilized within the competitive
market space that the new device is intended for.

It is often the case that product development teams struggle with questions of ‘benefit-risk’ that
are difficult to substantiate and reconcile outside of doing so subjectively, typically through
escalation of the issue and not without significant business decisions required of top
management. (In that case, did the risk management process really work?)

Note: The post-market measurement solution for the statistical indication of risk acceptability,
identified herein below, can also be utilized within pre-market risk management activity.

Q: What is different now?

A: The ISO 14971:2019 risk management standard for medical devices provides a
significant emphasis on the production and post-production activities associated with
monitoring and managing overall residual risk over the entirety of the lifecycle of the
device.

Historically, risk management within the medical device industry has primarily been a process
that was only executed by the ‘design control’ organization during product development activity.

This works for new

products that are still
within Design Control,
depicted in ISO 14971:2019
Risk Management Flow as

but…
What about the products
that are currently being
offered for use within the
healthcare market?

CQO

The 3rd Edition of the ISO 14971 standard provides a risk management framework that
emphasizes the entire life cycle of a medical device, from design and development through
production and post-production activities.

Info@Mgmt-Ctrl.com iQuality.ai/PMS (844) 349-2272

 Risk Acceptability

Q: How can ongoing risk acceptability be monitored and addressed retrospectively?

A: The data-driven measurement of the overall residual risk of a device, in comparison
with the level of risk that is inherent with the use of competitively marketed devices,
provides an indication of risk acceptability within a specific device market that is then
utilized to evaluate the ‘state of the art’ benefit of patient safety as an input to post-market
risk management activity.

The data-driven measurement of the overall residual risk of a device, in comparison with the level
of risk that is inherent with the use of competitively marketed devices, provides an indication of
risk acceptability within a specific device market that is then utilized to evaluate the ‘state of the
art’ benefit of patient safety as an input to post-market risk management activity.

This measurement capability can provide Top Management (otherwise known as Management
with Executive Responsibility) with the crucial information that will enable them to react in a timely
manner to any indications of unacceptable risk that might arise, post-market.

Statistical
Information for
Indication Reporting and Review
Reporting Data
Management

Visibility into
‘quality’ issues
that should be
investigated…
Enterprise

Product
‘quality’
Post-Market
Management
Surveillance
?

Risk Estimation

Indications of unacceptable risk, provided by statistical indication reporting, can then be provided
as input into a post-market risk management process that essentially mirrors the pre-market risk
management process used during design control activity.

Info@Mgmt-Ctrl.com iQuality.ai/PMS (844) 349-2272

 Risk Acceptability

Q: How does post-market risk management differ from pre-market risk management?
A: The difference is essentially involving the timing of the evaluation of overall residual
risk, as can be seen in the following graphic:

Pre-Market Risk Post-Market Risk

Risk Policy
Management Management

Risk Management
Planning
Evaluation of overall SOTA benefit of
Risk Analysis patient safety
residual risk
Risk Assessment
for residual risk of
Risk Evaluation Risk Analysis
all individual harms targeted / focused
Risk Assessment
for residual risk of
Risk Control Risk Evaluation individual harm

SOTA benefit of Evaluation of overall CAPA (‘unacceptable’

Risk Control risk confirmed)
patient safety residual risk Digital Twin

Risk – Benefit Risk Management Risk Management Risk – Benefit

Analysis (RBA) Review Post-Market Review Analysis (RBA)
Surveillance
Production and Production and
Predictive Modeling Post-Production Post-Market Post-Production Predictive Modeling
Activities Clinical Review Activities

CAPA for
Management Review
Improvement

A significant advantage of having a separate post-market risk management process resides in the
capability of the statistical indication reporting to isolate and identify the specific ‘risk’ (constraint)
that is driving the unacceptable overall residual risk of a device, accommodating a focused
approach to post-market risk management activity.

Q: What is a digital twin?

A: A digital twin utilizes predictive modeling to compare the ‘quality’ of production
environment risk control measures with the statistical indications of unacceptable risk, as
seen in post-market patient safety data.
Risk Control Measures Product Portfolio
Capability and Variation Management of Patient Safety

Correlation

Predictive
Modeling

Info@Mgmt-Ctrl.com iQuality.ai/PMS (844) 349-2272

 Risk Acceptability

Proactive product ‘quality’ management can be accomplished with the use of a digital twin that
utilizes post-market data in conjunction with production data:

v A digital twin is a virtual model of a process,

product or service. Integrate structured and
v A digital twin consists of three distinct parts: unstructured production
1) the physical product; data sources
2) the digital/virtual ’product’, and;
3) correlation between the two products. Advanced
Process Control

Post-Market Surveillance (data-driven) Post-Market - Risk Management Digital Twin | Predictive Product ‘quality’

ProCode Descriptive Risk Risk. Data Predictive Quality

Alignment Analytics Assessment Control Capture Modeling Management

Post-Market Measurement Monitor

of This pairing of these virtual and physical ‘entities’ allows Report
Overall Residual Risk
the monitoring and analysis of data to predictively identify Review
in conjunction with SOTA
and address issues within the production environment,
Predictive QM
and before they occur in the market.
Correlation Correlation

Q: Why a digital twin?

A: Obviously, a digital twin is not a requirement of ISO 14971:2019. However, if the
objective is to ensure patient safety through risk management… why wait for patient harm
to occur because of unacceptable risk before it can be addressed retrospectively.
Wouldn’t it be better to monitor the production data within digital twin and proactively
manage patient safety instead?

Additional Considerations

The medical device industry is currently undergoing a significant ‘modernization’ of the approach
utilized to improve the understanding and management of the benefit-risk of currently marketed
medical devices.

A recent report3, developed by the Science of Patient Input Communication Working Group of the
Medical Device Innovation Consortium (MDIC), seeks to familiarize all medical device
stakeholders with evidence-based practices for communicating the benefits, risks, and
uncertainty of medical technology to patients and providers.

This report makes it clear that medical device manufacturers have an obligation to understand
and transparently share the benefit-risk of the products they provide for use within the healthcare
market, in partnership with regulators:

3
MDIC, “Best Practices for Communicating Benefit, Risk, and Uncertainty for Medical Devices” Medical Device Innovation
Consortium, 11 Sep. 2020, https://mdic.org/wp-content/uploads/2020/09/MDIC-2020-SPI-Whitepaper-Report_FINAL.pdf.

Info@Mgmt-Ctrl.com iQuality.ai/PMS (844) 349-2272

 Risk Acceptability

“During review, approval, and subsequent use of a device, manufacturers and regulators have an
obligation to ensure that benefits, risks, and uncertainty associated with the device are
communicated in an understandable way.”

Clearly, communicating an understanding of the benefits, risks, and uncertainty associated with
currently a marketed medical device is important since medical device regulators are keenly
focused on this as well. These critical stakeholders are driven by harmonized regulatory
requirements such as the new European Medical Device Requirements (EU MDR) and the
updated ISO 14971:2019 medical device risk management standards. What happens if they
identify a safety signal or find cause to be concerned?

Article 95 within EU MDR mentions the requirements for the procedure to be used when devices
are suspected of presenting an unacceptable risk or other non-compliance aspect:

“if the output of the evaluation pursuant to article 94 concludes that a device presents an
unacceptable risk to the health or safety of the patients or users, the competent authorities of a
Member State have the right and shall, without delay, require the economic operators (EOs) to
take all appropriate and duly justified corrective actions (CAs) to bring the device into compliance
with the requirements of the MDR/IVDR.”

Ensuring patients are provided with access to safe medical devices is also a top priority for the
Food and Drug Administration (FDA). The FDA Medical Device Safety Action Plan: Protecting
Patients, Promoting Public Health4 describes key actions the Agency is taking to proactively
promote innovative solutions for improving patient safety and detecting safety risks earlier and
earlier within the Total Product Life Cycle (TPLC) of a medical device.

The US Food and Drug Administration, CDRH, also has applicable ‘Benefit-Risk Enforcement’
guidance5 that discusses the retrospective consideration of the understanding and management
of unanticipated harm and identified device nonconformities in association with compliance
enforcement decisions. This guidance provides an expectation that a manufacturer should have a
plan to understand and address unacceptable risk in conjunction with addressing identified and
cited Quality System process compliance issues:

“When FDA is working with a manufacturer to address a failure to comply with applicable statutes
or regulations, observed unanticipated harm to patients or users, or identified device
nonconformities… FDA may also consider the manufacturer’s approach to minimize harm or to
mitigate the increased risks that result from regulatory non-compliance or device nonconformity,
the manufacturer’s compliance history, and the scope of the issue.”

FDA 483 citations of ‘compliance’ issues associated with the Quality System, designated as
official action indicated (OAI), typically require a response by the organization to prevent

4
Medical Device Safety Action Plan: Protecting Patients, Promoting Public Health;
https://www.fda.gov/media/112497/download
5
Factors to Consider Regarding Benefit-Risk in Medical Device Product Availability, Compliance, and Enforcement Decisions,
https://www.fda.gov/regulatory-information/search-fda-guidance-documents/factors-consider-regarding-benefit-risk-medical-
device-product-availability-compliance-and-enforcement-decisions

Info@Mgmt-Ctrl.com iQuality.ai/PMS (844) 349-2272

 Risk Acceptability

escalation to the heightened FDA enforcement mechanism of a Warning Letter. Addressing

patient safety as a priority should alleviate FDA concerns in consideration of the organization’s
response to address the cited Quality System compliance violations. Why?

It has typically been the practice that the FDA, in consideration of the mission6 of the FDA, that
they will allow non-compliant medical device manufacturers to address their violations without
additional escalation of the Form 483 issues… “if the response provided by the manufacturer is
determined to be adequate, assuring the FDA that the manufacturer understands the issues and
can resolve the issues without additional enforcement. 7”

Presenting a sound post-market surveillance and risk management solution should ensure the
satisfaction and confidence of regulatory stakeholders that patient safety is not a concern.

‘Post-Market Surveillance8’ means all activities carried out by manufacturers… to proactively

collect and review experience gained from devices they place on the market, make available on
the market or put into service for the purpose of identifying any need to immediately apply any
necessary corrective or preventive actions.

Post-market surveillance cannot be readily accomplished simply through monitoring and

managing the complaints reported in conjunction with your medical device. There also exists the
requirement to actively monitor any patient harm associated with competitively marketed devices
to fully understand the ‘state of the art benefit’ of patient safety that is associated with the
healthcare market in which the medical devices are competitively offered.

The primary and ongoing responsibility of a medical device manufacturer is to ensure the ‘state of
the art benefit’ of patient safety, in accordance with a specific Post-Market Risk Management
Plan9 for each device, and to support the FDA’s CDRH mission10, ensuring that each device does
not pose “an unreasonable risk of substantial harm to the public health.11” This is also in
alignment with the FDA’s CDRH vision12, “FDA envisions a future state where the medical device
ecosystem is inherently focused on device features and manufacturing practices that have the
greatest impact on product quality and patient safety.”

The responsible management of patient safety begins with the capability to predictively manage
post-market product ‘quality’ through the associated ‘critical to quality’ risk control measures.

6
FDA CDRH Mission | Vision | Shared Values, to protect and promote the public health; https://www.fda.gov/about-fda/about-
center-devices-and-radiological-health/cdrh-mission-vision-and-shared-values.
7
Public comments made by FDA Detroit District Director, Art Czabaniuk at IMDMC on April 15, 2015 while delivering the
presentation entitled Deep Dive into Inspection Preparedness.
8
Medical Device Regulation (EU) 2017/745; Art 2 (60) §2
9
EN ISO 14971:2019, (3rd Edition) Medical devices – Application of risk management to medical devices
10
FDA CDRH Mission | Vision | Shared Values, https://www.fda.gov/about-fda/about-center-devices-and-radiological-
health/cdrh-mission-vision-and-shared-values
11
H.R. Rep. No. 853, 94th Cong. 2d Sess. at 21 (1990), Congress in discussing the meaning of this standard stated: In
determining whether a device presents “an unreasonable risk of substantial harm to the public health” the Committee intends
that the [FDA] consider such factors as the severity of the harm presented by the risk, the cause of the risk presented by the
device, and the number of devices in commerce which present the risk. “Substantial harm to the public health” may include
widespread non-serious harm to a large number of persons as well as serious harm to a few individuals.
12
The FDA Medical Device Safety Action Plan: Protecting Patients, Promoting Public Health, page eight (8).

Info@Mgmt-Ctrl.com iQuality.ai/PMS (844) 349-2272

 Risk Acceptability

About Us

The solutions we offer provide a structured approach for the strategic management of product
‘quality’, powered by the AI enabled iQuality technology.

Mgmt%Ctrl Powered by
Methodology iQuality Technology

The iQuality PMS solution was developed to measure product ‘quality’, for the establishment of
an understanding of the ‘state of the art’ benefit of patient safety.

This solution is designed to retrospectively focus on post-market product ‘quality’ constraint to

enable the effective and efficient management the ‘quality’ of currently marketed products.

The innovative iQuality PMS solution provides the cutting-edge and data-driven technology and
post-market surveillance capability to facilitate the active measurement, interactive management,
and continual improvement of post-market product ‘quality’.

The iQuality PMS technology, available through both Site and Enterprise SaaS subscription
plans, additionally provides the required capability to scale across a multi-site Enterprise
landscape, providing a consistent approach for the responsible management of product ‘quality’.

“Quality is never an accident; it is always the result of high intention, sincere effort, intelligent
direction and skillful execution; it represents the wise choice of many alternatives.”
- origin unknown

It is our mission to support patient safety by improving product and process quality within the
medical device industry through the provision of our innovative quality management solutions.

Measure - Monitor - Analyze - Report - Review - Manage - Improve - Sustain

We are honored to participate as a ‘trusted 3rd party’ solution provider within the FDA | MDIC
Case for Quality13 initiative, Accelerate Sustainable Capability (ASC) Pilot Study14, striving for the
development of innovative quality management solutions for the medical device industry.

13
Case for Quality; https://www.fda.gov/medical-devices/quality-and-compliance-medical-devices/case-quality
14
MDIC; Accelerate Sustainable Capability Pilot Study; https://www.fda.gov/medical-devices/quality-and-compliance-medical-
devices/accelerate-sustainable-capability-asc-pilot-study

Info@Mgmt-Ctrl.com iQuality.ai/PMS (844) 349-2272