1 

Application of Risk Management Principles

Slide 1

Hello everyone, thank you for joining this presentation. My name is Tonya Wilbon, and I am the Branch 

Chief for the Postmarket and Consumer Branch within the Division of Industry and Consumer Education.

This presentation will focus on the application of risk management principles for medical devices.

Slide 2

Some of you may think that risk management activities may look similar to the image on this slide: 

sketchy; crowded; uncertain; and even perhaps overwhelming. Hopefully this presentation today, will 

provide you with knowledge, tools, and techniques to understand and successfully reduce, control, 

monitor, and/or accept risk when the benefits outweigh those risks associated with the use of a medical 

device.

Slide 3

For this presentation, the learning objectives are to: discuss the reasons for conducting risk 

management activities for medical devices; identify when to use risk management activities for medical 

devices; and the final learning objective is to explain a few techniques used to apply risk management 

principles for medical devices.

If you understand the reasons why you should conduct risk management activities, you would perhaps 

be more willing to do so and feel less overwhelmed.

Slide 4

Let’s begin by reviewing some of the reasons for conducting risk management activities.

Slide 5

At some point during the total product life cycle specifically during design, manufacturing, and or 

production of a medical device, you will have to conduct risk management activities and make riskbased decisions. This is critical to manufacturing a safe and effective medical device.

The next two slides will provide a few specific examples of reasons for conducting risk management 

activities for medical devices.

Slide 6

One of the first and most obvious reasons why you conduct risk management activities, is to ensure 

safety of the device throughout the product lifecycle. Risk management activities ensure the safety of 

the device by reducing, controlling, and monitoring risk associated with the use of medical devices.

You conduct risk management activities to identify device design problems prior to distribution. This will 

assist in eliminating costs associated with recalls due to faulty device designs That could result in device 

failures.

The fact that risk analysis is a regulatory requirement is another reason to conduct risk management 

activities. Risk analysis (one element of the risk management process) is specifically required in the 

Quality System regulation under the design validation requirements of, Title 21 Code of Federal 

Regulations, or CFR, Part 820.30(g).
2 

You conduct risk management activities also because certain regulatory submissions, such as a Special 

510(k), required by the FDA call for inclusion of risk analysis information.

Slide 7

Additional reasons why you should conduct risk management activities include to reduce the possibility 

of your device failing by also identifying hazards that could result in harm from use of your device; to 

evaluate the risk and make an informed decision as to whether you want to accept the risk of using that 

device or not; and to put it plain and simple, it is the right thing to do, to identify, evaluate, control, and 

monitor the risk associated with use of your device. Remember, the use of every medical device has 

some risk.

Slide 8

I am sure we all would agree that it is important to understand why you should use risk management 

activities. Well, it is equally important to identify when to use risk management activities within a 

Quality System or Quality Management System or in general. Risk management activities occur 

throughout the total product lifecycle of a medical device.

Slide 9

Risk Management activities within a Quality System control the safety and performance of the device 

throughout its total product lifecycle; they demonstrate control over all risk associated with use of the 

device.

You should use Risk Management activities when implementing a Quality System to conduct risk 

analysis, as required. FDA’s response to comment #83 in the preamble to the QS regulation further 

clarifies that manufacturers must identify possible hazards and the risk associated with those hazards to 

reduce the risk to acceptable levels.

You should also use risk management activities or the results of risk management activities when 

implementing a quality system to make risk-based decisions including identifying design outputs that are 

essential for the proper functioning of the device as required by 21 CFR 820.30(d). This ensures controls 

are in place for those outputs that can cause the device to fail if they do not meet specification.

Additional risk-based decisions include defining the type and extent of control to be exercised over the 

product, services, suppliers, contractors, and consultants according to 21 CFR 820.50(a). For example, to 

ensure the supplier will provide critical products that meet required specifications.

Slide 10

You should also use risk management activities when implementing a Quality System to make risk-based 

decisions. The next two slides list a number of examples of decisions that you may make. For example, 

describe the necessary process controls needed to ensure the device meets specifications and performs 

as intended per 21 CFR 820.70(a). Document major equipment used for validated processes, where 

appropriate, to ensure you qualify that the equipment will operate as intended according to 21 CFR 

820.75(b). Determine necessary approvals for in-process acceptance activities as required by 21 CFR 

820.80(c). Note: this critical decision is needed to ensure unacceptable product is not used that could 

negatively impact the finished device.
3 

Slide 11

Determine the need for an investigation of nonconforming product to make decisions about the 

disposition of those products per 21 CFR 820.90(a).

Decide when to conduct internal audits (or how often) and decide how detailed of an audit is needed to 

ensure product consistently meets specifications or processes consistently perform as intended.

And identify valid statistical techniques required to establish, control, and verify the acceptability of 

process capability and product characteristics per 21 CFR 820.250.

Slide 12

In accordance with the relevant laws and regulations in the United States Federal Food, Drug, and 

Cosmetic Act, or the FD&C Act, and its implementing regulations as described in its guidance, FDA 

regularly uses risk management principles to make risk-based decisions. These are risk-based decisions 

related to device classifications, recall classifications, inspectional decisions, such as when to conduct an 

inspection and the type of inspection to conduct, and enforcement activities.

Slide 13

Risk management is not just one activity. It entails using perhaps several techniques to obtain risk 

information and thus complete the risk management process. The next few slides will provide examples 

of risk management techniques that can be used in the application of risk management principles.

Slide 14

The Association for the Advancement of Medical Instrumentation, or AAMI, the American National 

Standards Institute, or ANSI, and the International Organization for Standardization, or ISO, standard 

14971: 2019, here after referred to as ISO 14971, titled Medical devices- Application of Risk 

Management to Medical Devices, is the international standard for medical devices, accepted around the 

world and recognized by the FDA, that is used to establish a risk management process. It is used to 

conduct risk analysis activities as required by the Quality System regulation. 

It is a systematic approach to conducting risk management activities and specifies risk terminology, risk 

principles, and a process for risk management of medical devices, including software as a medical device 

and In Vitro Diagnostic devices.

Slide 15

The AAMI/ISO Technical Report, or TR, 24971:2020, titled, Medical devices- guidance on the application 

of ISO 14971 is another helpful international document for applying risk management principles. It 

provides guidance on the application of ISO 14971 to assist manufacturers in the development, 

implementation, and maintenance of a risk management process for medical devices that aims to meet 

the requirements of ISO 14971.

Slide 16

As previously indicated, ISO 14971 is an international standard that is widely used and has proven to be 

very informative when it comes to the application of risk management principles. Here is a diagram of 

the overall risk management process that is included as Figure 1 of this standard. As you can see, risk 

analysis is a subset or element of the entire Risk Management Process. The steps in the risk 

management process can be performed iteratively or in multiple steps.
4 

Slide 17

Now, here is a list of a few examples of different techniques or tools you can use to support risk 

management process and apply risk management principles. They include Preliminary Hazard Analysis, 

or PHA; Fault Tree Analysis, or FTA; Failure Mode and Effects Analysis, or FMEA. These and additional 

techniques can be found in Annex B of TR 24971:2020.

In addition, FDA conducts a Benefit-Risk Analysis to apply risk management principles and make riskbased decisions. FDA has issued several guidance documents regarding these risk management 

principles and techniques. 

Due to time restraints, I am unable to provide examples for each one of these, but I will highlight the 

characteristics of each.

Slide 18

Preliminary Hazard Analysis or PHA is used in risk analysis as a means of and with an objective of 

identifying hazards, hazardous situations, and events that can cause harm. Usually, little is known about 

the device design and this technique is typically conducted early in device development. A PHA is very 

useful in prioritizing hazards.

Performing a Preliminary Hazard Analysis results in the identification of the probabilities or the 

likelihood that a hazardous situation will occur and the probabilities that a hazardous situation will lead 

to harm. It results in qualitative evaluation of the extent of possible harm or how severe is the harm 

and the identification of possible risk control measures.

Slide 19

When conducting a PHA, you begin with listing possible hazards. You can accomplish this by:

brainstorming for possible hazards; using previously published literature and/or using information in 

international standards.

You can list hazards when conducting a PHA by considering characteristics such as materials used, 

equipment used, use environment, and layout interfaces among system components.

This PHA technique can be useful in identifying essential design outputs.

Slide 20

Here is an example of using the principles of a Preliminary Hazard Analysis.

You can use questions to identify characteristics or hazards that could impact safety as well as the other 

characteristics previously listed. Annex A of ISO 24971:2020 has questions, factors or characteristics to 

consider that you can use as a starting point.

This information obtained after analyzing each hazard can be captured in a chart or table as shown on 

this slide. For each hazard identified, you identify and document the hazardous situation, the possible 

harm, the severity of the harm and the probability of the hazard and hazardous situation leading to 

harm, using the already defined risk severity chart and risk probability chart; and the identification of 

possible risk control measures. There are numerous examples of probability and severity charts already 

created that you can use if it is applicable to the possible harms that could result from use of your 

device.
5 

Slide 21

Another technique is the Fault Tree Analysis or FTA. It is used in risk analysis as a means of analyzing 

identified hazards. It uses a top-down method to estimate fault probability and identifies single faults 

that result in hazardous situations as well as common faults that result in hazardous situations. The 

results are represented pictorially in a tree form or a fault mode using connectors such as “AND” or 

“OR”.

Slide 22

Failure Mode and Effect Analysis, or FMEA, is also used in risk analysis to identify and evaluate individual 

fault or failure modes. It is a bottom-up method that starts with the causes and works towards how this 

will affect or impact device use. You have to be somewhat familiar with the device to use this technique 

to understand how the device could fail.

Slide 23

FMEA is not restricted to failure of device design and can include failures in manufacturing and 

assembling of components or PFMEA. It can be useful in dealing with use error and answers the 

question, “ What happens if...?” we get an incorrect result such as a false positive. FMEA does require 

some understanding of the device.

Slide 24

FDA uses a Benefits-Risk Analysis technique to assess the medical device risk once all measures to 

reduce the risk have been applied and only acceptable residual risk remain. The benefit-risk analysis 

helps to decide to rework or use the device “as is” with the risk you are unable to reduce further. There 

are several CDRH guidance documents available that provide the framework for medical device benefitsrisk decision making.

Slide 25

When conducting a benefit-risk analysis, FDA considers several factors to assess the benefit and risk of a 

device for determinations in Premarket Approval Application, or PMA, De Novo classification, 

substantial equivalence in Premarket Notifications, or 510(k), with different technological 

characteristics, investigational device exemption, or IDE, as well as determinations for product 

availability, compliance and enforcement decisions.

Slide 26

This slide includes a list of factors FDA may consider when assessing the extent of benefit of a device 

when making benefit-risk determinations during premarket review process and when determining 

product availability, compliance and enforcement decisions. As noted in the table not all of the same 

factors are considered when making certain risk-based decisions. For example, the benefit factor of 

patient perspective on benefit and medical necessity are only considered when determining product 

availability, compliance and enforcement decisions.

Slide 27

The next two slides include a list of factors FDA considers when assessing the extent of risk of a device 

when making benefit-risk determinations during premarket review process and when determining 

product availability, compliance, and enforcement decisions. Again, as noted in the table, not all of the 

same factors are considered when making risk-based decisions during this premarket review process 

and when determining product availability, compliance, and enforcement decisions. For example, 
6 

severity of risk or harm is considered during premarket review process and when making product 

availability, compliance and enforcement decisions. However, distribution of nonconforming devices risk 

factor is only considered when making product availability, compliance and enforcement decisions.

Slide 28

This slide lists the additional risk factors FDA considers when conducting Benefit-Risk Analysis.

Slide 29

In addition to the specific benefit and risk factors FDA considers when conducting a benefit-risk analysis, 

there are several additional factors that are also considered to assess the risk of the device in general.

This is not an all-inclusive list of the additional factors to consider. The list is included in each of the 

guidance documents pertaining to making benefit-risk determinations.

Slide 30

Let’s review an example of a benefit-risk analysis completed to make a risk-based product availability, 

compliance, and enforcement decision, specifically a product availability decision.

This example involves a human chorionic gonadotropin (or hCG) device. The hCG device is intended to 

detect hCG in urine to aid in early detection of pregnancy and is indicated for over-the-counter (OTC) 

use.

The healthcare provider noticed a higher rate of positive results, but the positive results were not 

confirmed in blood samples, thus the device yielded a higher rate of false positives than expected by the 

manufacturer. The manufacturer identified a malfunction in specific lots and noted that the lay user is 

not able to detect this malfunction.

It is noted that there are other devices on the market for detecting pregnancy.

Slide 31

FDA conducted a Benefit-Risk Analysis as outlined in the guidance document, “Factors to consider 

regarding benefit-risk in medical device product availability, compliance and enforcement decisions.” 

The benefits and risks were identified as listed on this slide. It is noted that the benefit was reduced due 

to the potential lack of test accuracy.

Slide 32

The assessment was completed using the worksheet included in the guidance document for 

documenting responses to the questions listed for each factor considered. The factors for benefits and 

risks considered included, among other factors considered, patient tolerance for risk and perspective on 

benefit, mitigation, and patient impact and the results were documented. It was documented that for 

patient impact, there are similar devices available without additional risks.

Slide 33

After all of the risk information was gathered and documented on the Assessment worksheet, it was 

determined that there was no need to continue to support product availability. FDA and the 

manufacturer agreed the risk outweighed the benefit of this device remaining available on the market 

and decided to recall the device. The firm submitted a correction and removal package to the FDA in 

accordance with 21 CFR 806 and FDA classified the recall as a Class II recall.
7 

Slide 34 

So, as I indicated earlier, you may need to use more than 1 risk management technique throughout your

quality system or in general when implementing risk management activities.

Here are a few more examples of risk management techniques that can be used as well: Risk 

Acceptability Chart—for evaluating risk, both initial and residual risk; Risk Control Option Analysis- for 

controlling risk; and Risk Management Report, to capture relevant review of production and postproduction risk information.

Slide 35

In summary, risk management activities are essential throughout the product life cycle and not just 

required during design validation.

Preliminary Hazard Analysis, Fault Tree Analysis, Failure Mode and Effects Analysis, and FDA Benefit-Risk 

Analysis are different types of risk management techniques and tools that can be used in the risk 

management process. 

And finally, manufacturers should use more than one risk management technique in their risk 

management process.

Slide 36

Here is a list of resources that were applicable to this presentation.

Slide 37

This slide lists three additional resources for industry education: CDRH Learn where this presentation 

will be posted; Device Advice; and our Division of Industry and Consumer Education.

Slide 38

Let’s conclude this presentation with Your Call to Action.

Your Call to Action is to: identify when to evaluate risk and conduct risk management activities early, 

identify and utilize resources available for conducting risk management activities; and ensure you use 

the appropriate risk management technique and/or tool for managing risk with your device.

This will ensure your devices are safe and effective.

Thank you for viewing this presentation.

**********