Application of Risk Management 

Principles for Medical Devices

Tonya A. Wilbon

Branch Chief

Postmarket and Consumer Branch

Division of Industry and Consumer Education

Office of Communication and Education

Center for Devices and Radiological Health

U.S. Food and Drug Administration
Risk 

Management 

Activities

2
Learning Objectives

• Discuss the reasons for conducting risk management 

activities for medical devices

• Identify when to use risk management activities for 

medical devices

• Explain techniques for the application of risk 

management principles

3
Reasons for Conducting

Risk Management Activities

4
Why Conduct 

Risk 

Management 

Activities?

5
Why conduct risk management activities?

6

To ensure safety of the device throughout the product lifecycle

To identify device design problems prior to distribution

Risk analysis is a regulatory requirement

FDA regulatory submissions require risk analysis information
Why conduct risk management activities?

7

To reduce the possibility of failure of the device

To identify hazards with use of the device

To evaluate the risk with use of the device and decide whether to 

use the device or not

It is the right thing to do
When To Use Risk Management 

Activities for Medical Devices

8
When to Use

Risk Management Activities

• When implementing a quality system to:

– Conduct risk analysis, where appropriate, as required

– Make risk-based decisions including:

Identifying design outputs essential for proper functioning of device

Defining type and extent of control to be exercised over product, 

services, suppliers, contractors, and consultants

9

21 Code of Federal Regulations, Part 820 (21 CFR 820)
• When implementing a quality system to:

– Make risk-based decisions including:

Describing necessary process controls

Documenting major equipment used for validated processes, 

where appropriate 

Determining necessary approvals for in-process acceptance 

activities 

10

21 CFR 820

When to Use

Risk Management Activities
• When implementing a quality system to:

– Make risk-based decisions including:

Determining need for investigation of nonconforming product 

Conducting internal audits

Identifying valid statistical techniques required for 

establishing, controlling, and verifying the acceptability of 

process capability and product characteristics

11

21 CFR 820

When to Use

Risk Management Activities
• By FDA to make risk-based decisions related to:

– Device classifications

– Recall classifications

– Inspectional decisions

– Enforcement activities

12

21 CFR 820

When to Use

Risk Management Activities
Application of

Risk Management Principles

13
Risk Management Process

• AAMI/ANSI/ISO* 14971:2019 Medical devices-Application 

of risk management to medical devices (ISO 14971)

- Used to conduct risk analysis activities as required by 

regulation

- Systematic approach to conducting risk management 

activities

14

*AAMI =Association for the Advancement of Medical Instrumentation

ANSI = American National Standards Institute

ISO = International Organization for Standardization
Risk Management Process

• AAMI/ISO TR*24971:2020-Medical devices- guidance 

on the application of ISO 14971

- Provides guidance on the application of ISO 14971

15

*AAMI =Association for the Advancement of Medical Instrumentation

ISO = International Organization for Standardization

TR = Technical Report
Risk Management

Process

AAMI/ANSI/ISO 14971:2019

Medical devices- Application of 

risk management to medical 

devices

16
Risk Management Techniques

• Preliminary Hazard Analysis (PHA)

• Fault Tree Analysis (FTA)

• Failure Mode and Effects Analysis (FMEA)

• FDA Benefit-Risk Analysis 

17
Preliminary Hazard Analysis (PHA)

• Used in risk analysis as a means of identifying hazards 

and hazardous situations

– Few device design details known

– Conducted early in device development

– Useful in prioritizing hazards

18

Risk Management Techniques
Preliminary Hazard Analysis (PHA)

• List possible hazards

– Brainstorm for possible hazards

– Use previously published literature

– Use information in international standards

19

Risk Management Techniques
Preliminary Hazard Analysis

20

# Hazard Hazardous 

situation

Harm Severity Probability Risk 

control

Patient 

gets 

incorrect 

test 

result

Doctor 

believes 

result is 

accurate 

and 

administers 

insulin

Hypoglycemia; 

Patient 

suffered a 

seizure

S-4 P-3 Redesign 

test; build 

in internal 

control; 

change 

chemical

Risk Management Techniques
Fault Tree Analysis (FTA)

• Used in risk analysis as a means of analyzing hazards 

identified

– Top-down method

– Estimate fault probability

– Identify single fault that result in hazardous situations

– Identify common faults that result in hazardous situation

21

Risk Management Techniques
Failure Mode and Effect Analysis (FMEA)

• Used in risk analysis as a means of identifying and 

evaluating individual fault modes

– Bottom-up method

– Starts with causes and works toward effects

– Estimates fault probability

– Identifies single fault that result in hazardous situations

22

Risk Management Techniques
Failure Mode and Effect Analysis (FMEA)

– Answers the question, “What happens if...?”

– Requires device detail to be known

23

Risk Management Techniques
FDA Benefit-Risk Analysis

• Used to assess medical device risk once all measures 

to reduce the risk have been applied

– Decision to rework or use “as is” a nonconforming 

product

– CDRH guidance documents available

Framework for medical device decision making

24

Risk Management Techniques
FDA Benefit-Risk Analysis

• Considers several factors when assessing benefits and risk 

for:

– Determinations in Premarket Approval Application (PMA) and De 

Novo classification

– Determining substantial equivalence in Premarket Notifications 

[510(k)]

– Determinations for Investigational Device Exemption (IDE)

– Product availability, compliance, and enforcement decisions

25

Risk Management Techniques
FDA Benefit-Risk Analysis

26

Benefit Factor Considered PMA/De Novo 

Determination

510(k) Substantial 

Equivalence Determination

IDE 

Determination

Availability, compliance, 

and enforcement decisions

Type of benefit X X X

Magnitude of benefit X X X X

Probability or likelihood of 

participant experiencing one or 

more benefit

X (Probability) X (Probability) X (Probability) X (Likelihood)

Duration of effects X X X X

Patient Perspective on Benefit X

Benefit factors for healthcare 

professionals or caregivers

X

Medical Necessity X
27

Risk Factor Considered PMA/De Novo 

Determination

510(k) Substantial 

Equivalence Determination

IDE 

Determination

Availability, compliance, 

and enforcement decisions

Severity of Risk or Harm X X (Harmful events) X X (Harm)

Probability or Likelihood of 

risk(s) or harmful event

X (Probability) X (Probability) X (Probability) X (Likelihood)

Probability of patient 

experiencing harmful event

X

Distribution of 

nonconforming devices

X

Duration of harmful events, 

risk, or exposure to 

population

X (Harmful 

events)

X (Harmful events) X (Risks) X (Exposure to population)

FDA Benefit-Risk Analysis
28

Risk Factor Considered PMA/De Novo 

Determination

510(k) Substantial 

Equivalence Determination

IDE 

Determination

Availability, compliance, 

and enforcement decisions

False-positive or falsenegative resultsX X X

Patient tolerance of risk X

Risk factors for healthcare 

professionals or caregivers 

X

Risk management X

Residual risk X

FDA Benefit-Risk Analysis
• Additional factors to consider (not all inclusive):

29

- Uncertainty

- Mitigations

- Detectability

- Patient perspectives

- Patient Impact

- Firm compliance history

- Postmarket data

- Availability of alternative 

treatments or diagnostics

FDA Benefit-Risk Analysis
Example: Benefit-Risk Analysis

• Product Availability, Compliance, and Enforcement Decision: 

– Human chorionic gonadotropin (hCG) device

 Detection of hCG in urine to aid in early detection of pregnancy

 Indicated for over-the-counter (OTC) use

 Healthcare provider noticed higher rate of positive results, but not confirmed positive in blood sample

 Higher rate of false positives than expected

 Malfunction identified in specific lots

 Lay users unable to detect malfunction

 Many other pregnancy test on the market

30

Factors to Consider Regarding Benefit-Risk in Medical Device Product Availability, Compliance, and Enforcement Decisions - Guidance for 

Industry and Food and Drug Administration Staff (fda.gov)
• Benefits

– Helps patient determine whether patient is pregnant

– Benefit reduced due to potential lack of test accuracy

• Risks

– Unnecessary prenatal care

– Delayed medically necessary treatments

31

Factors to Consider Regarding Benefit-Risk in Medical Device Product Availability, Compliance, and Enforcement Decisions - Guidance for 

Industry and Food and Drug Administration Staff (fda.gov)

Example: FDA Benefit-Risk Analysis
Worksheet Assessment: Factors considered

• Patient tolerance for risk and perspective on benefit

– Patient like having OTC test for pregnancy

– FDA does not have data on patient tolerance

• Mitigation

– Firm did not identify a mitigation to address this risk

• Patient impact

– Impact on patient if device was not available in the marketplace

– Similar devices available without additional risks

32

Factors to Consider Regarding Benefit-Risk in Medical Device Product Availability, Compliance, and Enforcement Decisions - Guidance for 

Industry and Food and Drug Administration Staff (fda.gov)

Example: FDA Benefit-Risk Analysis
• Product availability, compliance, and enforcement decision

– No need to support continued availability of affected lots 

Benefit to patients is low

Risk moderate due to delay in medically necessary treatment

Firm notified retailers and distributors to remove affected lots

Firm submitted report to FDA per 21 CFR 806

FDA classified action as a Class II recall

33

Factors to Consider Regarding Benefit-Risk in Medical Device Product Availability, Compliance, and Enforcement Decisions - Guidance for 

Industry and Food and Drug Administration Staff (fda.gov)

Example: FDA Benefit-Risk Analysis
Other Risk Management Techniques

• Risk Acceptability Chart

– For evaluating risk (initial and residual risk)

• Risk Control Option Analysis

– For controlling risk

• Risk Management Report

– To capture relevant review of production and 

postproduction risk information

34
Summary

• Risk management activities are essential throughout 

the product life cycle

• PHA, FTA, FMEA, and FDA Benefit-Risk analysis are 

different types of risk management techniques

• Manufacturers should use more than one risk 

management technique in their risk management 

process

35
Resources

Slide 

Number

Cited Resource URL

6, 7 ANSI/AAMI/ISO 14971:2019 Medical 

devices – Applications of risk 

management to medical devices

www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfStandards/detail.cfm?standard__ident

ification_no=40369

(for purchase from standards organization)

15, 16, 17 21 CFR 820 Quality System Regulation www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?CFRPart=820

19 ANSI/AAMI/ISO 14971:2019 

Medical devices- Guidance on the 

application of ISO 14971

https://www.iso.org/standard/74437.html

(for purchase from standards organization)

20 Factors to Consider Regarding BenefitRisk in Medical Device Product 

Availability, Compliance, and 

Enforcement Decisions

https://www.fda.gov/regulatory-information/search-fda-guidancedocuments/factors-consider-regarding-benefit-risk-medical-device-productavailability-compliance-and

20 4 CDRH Benefit-Risk Guidance 

documents:

https://www.fda.gov/regulatory-information/search-fda-guidance-documents

36
Industry Education:

Three Resources for You

1. CDRH Learn: Multi-Media Industry Education

 Over 200 modules

 Videos, audio recordings, power point presentations, software-based “how to” modules

 Mobile-friendly: access CDRH Learn on your portable devices

www.fda.gov/CDRHLearn

2. Device Advice: Text-Based Education

 Comprehensive regulatory information on premarket and postmarket topics

www.fda.gov/DeviceAdvice

3. Division of Industry and Consumer Education (DICE)

 Contact DICE if you have a question

 Email: DICE@fda.hhs.gov

 Phone: 1(800) 638-2041 or (301) 796-7100 (Hours: 9 am-12:30 pm; 1 pm-4:30pm EST)

 Web: www.fda.gov/DICE

37
Your Call To Action

• Identify when to evaluate risk and conduct risk 

management activities early 

• Identify and utilize resources available for conducting 

risk management activities

• Make sure you use the appropriate risk management 

technique/tool for managing risk

38
39