PLEASE SHARE

   
 

Choosing the right Risk Assessment Tool

Risk Management

Using FMEA alone is the lazy choice

ISO 14971, Medical devices - Application of risk management to medical devices, and ISO 31010, Risk management -

Risk assessment tools and techniques, offer unique insight into the practical application of Risk Management Tools.

 The variety, complexity and wide range of applicability of these tools can be confusing especially for those new to risk management.

Too often those responsible for overseeing the risk management of an organization limit themselves to using basic FMEA – Failure Modes and effect Analysis – or even a ‘slimmed-down’ version of an FMEA.  This is a mistake.

Overview of Risk Management

In this article we want to focus on the tools available and where they are most often applied. But before doing so a few words about the terms associated with risk, and their use and application. 

The best single source of information here are the Annexes of ISO 14971.  While the focus is on medical devices the issues and examples given have general applicability.  We recommend you study:

  • Annex A: Rationale for requirements
  •  
  • Annex B: Overview of the risk management process for medical devices
  •  
  • Annex D: Risk concepts applied to medical devices
  •  
  • Annex F: Risk management plan
  •  
  • Annex G: Information on risk management techniques

And now to the toolkit.

The Risk Management Toolkit

In ISO 31010 you will find 31 used in risk management and in the table below you can see them mapped against the most common areas of application.  Take a little time to study the table and, in particular, note the many tools for risk identification.

The identification of threats, vulnerabilities, hazards, etc. is often a challenge and you may want to consider using two or more risk identification tools to be confident that all significant threats have been identified.

#

TOOLS &

TECHNIQUES

 

RISK ASSESSMENT PROCESS

 

 

See

Annex

 

Risk

Identification

Risk Analysis

Risk Evaluation

Consequence

Probability

Level of risk

1

Brainstorming

XX

 

 

 

 

B 01

2

Structured   or semi-structured interviews

XX

 

 

 

 

B 02

3

Delphi

XX

 

 

 

 

B 03

4

Check-lists

XX

 

 

 

 

B 04

5

Primary hazard analysis

XX

 

 

 

 

B 05

6

Hazard and operability studies (HAZOP)

XX

XX

X

X

X

B 06

7

Hazard Analysis and Critical Control Points (HACCP)

XX

XX

 

 

 XX

 B 07

8

Environmental risk assessment

XX

XX

XX

XX

XX

B 08

9

Structure « What if? »  (SWIFT)

XX

XX

XX

XX

XX

B 09

10

Scenario analysis

XX

XX

X

X

X

B 10

11

Business impact analysis

X

XX

X

X

X

B 11

12

Root cause analysis

 

XX

XX

XX

XX

B 12

13

Failure mode effect analysis

XX

XX

XX

XX

XX

B 13

14

Fault tree analysis

X

 

XX

X

X

B 14

15

Event tree analysis

X

XX

X

X

 

B 15

16

Cause and consequence   analysis

X

XX

XX

X

X

B 16

17

Cause-and-effect analysis

XX

XX

 

 

 

B 17

18

Layer protection analysis (LOPA)

X

XX

X

X

 

B 18

19

Decision tree

 

XX

XX

X

X

B 19

20

Human reliability analysis

XX

XX

XX

XX

X

B 20

21

Bow tie analysis

 

X

XX

XX

X

B 21

22

Reliability centred maintenance

XX

XX

XX

XX

XX

B 22

23

Sneak circuit analysis

X

 

 

 

 

B 23

24

Markov analysis

X

XX

 

 

 

B 24

25

Monte Carlo simulation

 

 

 

 

XX

B 25

26

Bayesian statistics and Bayes Nets

 

XX

 

 

XX

B 26

27

FN curves

X

XX

XX

X

XX

B 27

28

Risk indices

X

XX

XX

X

XX

B 28

29

Consequence/probability matrix

X

XX

XX

XX

X

B 29

30

Cost/benefit analysis

X

XX

X

X

X

B 30

31

Multi-criteria decision analysis (MCDA)

X

XX

X

XX

X

B 31

 

 Legend:

XX   Strongly applicable.

X       Applicable.

                                                                                                                                                                                                                                                                 Reference: ISO 31010:2009

Highlighted in bold/yellow in the table above are five tools considered in depth in ISO 14971.

 

Popular Tools and where their typically application

It is not immediately obvious to the reader of ISO 14971 as to where in the lifecycle of a product each of the tools should be applied.  The next table maps each of the tools against the lifecycle stage where typically they are used.

#

TOOLS & TECHNIQUES

Lifecycle Stage

Comment

Design & Development

Production

Operation & Use

5

Preliminary Hazard Analysis (PHA)

X

 

 

Most commonly carried out early in the development of a project when there is little information on design details or operating procedures and can often be a precursor to further studies.

It can be useful when analysing existing systems or prioritizing hazards where circumstances prevent a more extensive technique from being used.

6

Hazard and operability studies (HAZOP)

 

X

 

While the use of HAZOP studies in the chemical industry focuses on deviations from design intent, there are alternative applications for a medical device developer.  A HAZOP can be applied to…

-            the operation/function of the medical device (e.g., to the existing methods/processes used for the diagnosis, treatment or alleviation of disease as the “design intent”), or

-           to a process used in the manufacture or maintenance/service of the medical device (e.g., sterilization) that can have significant impact on the function of the medical device.

7

Hazard Analysis and Critical Control Points (HACCP)

 

X

 

This is a systematic approach to the identification, evaluation and control of hazards, and is best applied to established processes, particularly manufacturing processes.

Applied to medical devices, HACCP is used for the control and monitoring of initiating causes of product hazards originating in the processes themselves.

13

Design FMEA

X

 

 

During all stages of product design and development.

13

Process FMEA

X

X

X

During the design and development process and continuing throughout the product life cycle.  Production and postproduction feedback is often used to update FMEAs and/or verify them.

13

Administrative FMEA

 

X

X

While Design and Process FMEAs are based on individual product components, FMEAs can also be applied to processes.

Here the risks associated with the individual activities that go to make up a process are examined, the associated risks are evaluated and then, steps are taken to reduce unacceptable risks to an acceptable level.

13

User (or Patient) FMEA

X

 

X

in this case the effects of product or component failure during use, or un-intended miss-use, are considered. 

While most frequently applied to considerations of patient safety, application to consumer, or end-user, satisfaction is also possible.

14

Fault Tree Analysis

 

X

 

This is a systematic approach to the identification and evaluation of fault conditions, and is best applied to established processes, particularly manufacturing processes.

A significant history of the process is needed, else much time and effort can be wasted. 

 

Reference: deGRANDSON Course 701: Risk Assessment and Risk Management Training

 

Conclusion

While our focus is on risk associated with Medical Device manufacture, you can no doubt find analogous opportunities to apply the tools to your organization. And they are not limited in use to manufacturing; they are just as applicable to all business activities, both public and private sector. 

The management of risk is fundamental to business improvement. So be sure to give these tools a try.

Written by Dr John FitzGerald

Director and founder of deGRANDSON Global. After 15 years in the manufacturing industry, John has spent the past 25 years training, consulting and auditing ISO 9001 and other management systems.

Subscribe to Email Updates

FOLLOW US ON...

Recent Posts

Posts by Topic