Risk Management for Medical Devices

Risk management for medical devices is a structured way of finding out what could go wrong, deciding how much it matters and showing that something reasonable was done about it. Its value lies less in the paperwork than in the discipline of asking those questions before an incident asks them for you.

What Risk Management Is For

Every medical device carries some risk, and the aim is never to eliminate it entirely. The aim is to identify the hazards, understand how likely and how serious harm would be, reduce it as far as is reasonably practicable and record the reasoning.

That record is the real product. It allows the same judgement to be reviewed later, by a different person, and it distinguishes a considered decision to accept a residual risk from an unexamined one.

Grouping hazards by the part of the lifecycle they affect is a useful organising device. Hazards arising at commissioning, during routine use and at decommissioning are quite different, and treating them together can hide patterns that would otherwise be obvious.

Finding the Hazards

Hazard identification begins with how the device is used, by whom, in what environment and alongside what other equipment. Fault modes revealed by analysis sit alongside use-related hazards discovered by watching people work.

It is worth deliberately looking beyond the device itself. Accessories, consumables, software, maintenance and the instructions supplied with it all contribute to the overall picture and each can introduce a hazard of its own.

It helps to involve the people who use the device in identifying hazards. Their account of the awkward moments, the workarounds and the near misses describes risks that no document-based analysis reliably anticipates.

Questions a Sound Assessment Answers

• What could go wrong, and how would a patient be harmed?
• Who uses the device, and in what conditions does that happen?
• Which hazards were designed out, and which are merely warned about?
• What risk remains after the controls, and why is it acceptable?
• How will field experience feed back into this assessment?

Estimating and Judging

Once hazards are listed, each is assessed for the severity of the harm it could cause and the likelihood of that harm occurring. The combination is what makes a hazard a priority rather than an entry on a list.

Judgements here are inherently uncertain, and that is acceptable provided the assumptions are stated. Writing down why a likelihood was judged low is what makes the assessment reviewable rather than merely assertive.

The judgement about likelihood should be revisited when circumstances change. A hazard that was unlikely in a well-staffed unit may become considerably more likely in a busier one, and the assessment ought to follow the reality rather than stay fixed.

Controlling the Risk

Controls are usually applied in order of preference. The strongest is designing the hazard out altogether, followed by protective measures within the device, then information such as warnings and training for the user.

The ordering matters because the weaker controls depend on somebody behaving correctly under pressure. Wherever design can remove the hazard entirely, that is preferable to a warning that the user is expected to remember in a difficult moment.

Where a control depends on user behaviour, it is worth being explicit about how much it depends on that. A double check that staff genuinely perform is a stronger control than one that exists in a procedure but is quietly skipped during a busy shift.

Preferred Order of Controls

Residual Risk and Acceptability

After controls are applied, some risk remains. Deciding whether that residual risk is acceptable involves comparing it with the expected benefit of using the device at all, which is a judgement rather than a calculation.

Documenting that decision, and the criteria used to reach it, is what makes it defensible. An accepted risk with a stated rationale is a managed risk; the same risk without one is simply an unexamined exposure.

Comparisons with similar devices can be informative. If a comparable product has experienced a particular problem in the field, that experience is a legitimate input into your own assessment, even though the device in front of you has not yet failed.

Keeping the Assessment Alive

A risk assessment written once and filed away stops reflecting reality almost immediately. Devices change, uses change and new hazards emerge from experience in the field, and the assessment has to absorb all of that.

Field information is the most valuable input. Incidents, near misses and user feedback describe hazards that no analysis anticipated, and feeding them back into the assessment is what keeps it honest over the life of the device.

The assessment should name who owns it and when it will next be reviewed. Without both, even a thorough piece of work tends to become a historical record rather than a live part of how the device is managed.

Risk management is a habit of asking, before anything goes wrong, what could happen and what has been done about it. Identify broadly, judge with stated assumptions, prefer design over warnings and keep updating the assessment as you learn how the device behaves in real use.