Risk Basics For Medical Devices

Joseph Tartal

Deputy Director

Division of Industry and Consumer Education

Office of Communication and Education

Center for Devices and Radiological Health

US Food and Drug Administration
2
Learning Objectives

• Define basic terms 

• Review an example of events and their relationships 

to determine risk

• Discuss risk-based decisions and risk analysis

• Describe the concept of risk management as it relates 

to the ISO 14971 Standard

3
Basic Definitions

4
The Importance of Definitions

• Understanding these basic terms helps to ensure that everyone is 

talking about the same thing during risk discussions

• Definitions come mostly from the International Organization for 

Standardization, or ISO, 14971:2019 standard

Disclaimer when looking at definitions of risk terms:

• Understand context and nuance as they relate to the specific guidance 

documents or standards etc. and where they are used

5
Definitions: The Three H’s

• Hazard: potential source of harm

• Hazardous Situation: circumstances in which 

people, property or environment is/are exposed to 

one or more hazards

• Harm: Injury or damage to health of people, or 

damage to property or environment

ISO 14971: 2019 6
Definitions: 

Probability and Severity

• Probability of Occurrence – chance that given 

event will occur, the likelihood something will 

happen 

• Severity – measure of possible consequences of a 

hazard

7

Probability of Occurrence-Merriam/Webster

Severity-ISO 14971: 2019
Definition: Risk

• CDRH has no statutory or regulatory definition for the term “Risk”

• Starting Point:

– Potential harm of a medical device’s use to patients, end users and 

environment, which includes the harm of the device if it were to 

fail in normal and fault conditions, i.e., not operate as intended

• International Organization for Standardization (ISO) 14971:2019 

3.18:

– Combination of the probability of occurrence of harm and severity 

of that harm

8
Definition: Benefit

CDRH has no statutory or regulatory definition for the 

term “Benefit”

ISO 14971:2019 3.2:

• Positive impact or desirable outcome of the use of a 

medical device on the health of an individual, or

• Positive impact on patient management or public health 

9
Risk Analysis in the Quality System 

1996 Preamble, Comment #83

Risk Analysis includes:

(1) Identification of possible hazards, including [user] error

(2) Risk Calculation/estimation, normal and fault conditions

(3) Risk Acceptability Determination 

(4) Risk Reduced to Acceptable Level 

(5) Evaluation of changes for introduction of new hazards

10
Definition: Risk Analysis in 

ISO 14971:2019

3.19 Risk Analysis

Systematic use of available information to identify 

hazards and to estimate the risk

11
An Example:

Relationships, Circumstances and Sequence 

of Events involving Risk

12
HAZARD – Potential Source of Harm

SEQUENCE OF EVENTS

HAZARDOUS SITUATION

ISO 14971:2019 Annex C Figure C.1

13
Example:

Driving

HAZARD – Potential Source of Harm

Driving in Heavy Traffic

SEQUENCE OF EVENTS

Stop and Go Driving

Little Distance Between Vehicles

Driver Fatigue

HAZARDOUS SITUATION

Distracted Driver Hits Car From Behind

ISO 14971:2019 Annex C Figure C.1 14
Example:

Driving

HAZARD – Potential Source of Harm

Driving in Heavy Traffic

SEQUENCE OF EVENTS

Stop and Go Driving

Little Distance Between Vehicles

Driver Fatigue 

HAZARDOUS SITUATION

Distracted Driver Hits Car From Behind

Circumstances

affecting severity

Circumstances

affecting severity

Probability of a

hazardous

situation

occurring (P1)

Probability of a 

hazardous 

situation leading 

to harm (P2)

ISO 14971:2019 Annex C Figure C.1 15
Example:

Driving

HAZARD – Potential Source of Harm

Driving in Heavy Traffic

SEQUENCE OF EVENTS

Stop and Go Driving

Little Distance Between Vehicles

Driver Fatigue 

HAZARDOUS SITUATION

Distracted Driver Hits Car From Behind

HARM – Physical injury or damage 

to the health of people or damage 

to property or the environment

Large Dent In Rear of Car

Probability of 

occurrence of 

harm

(P = P1 * P2)

Severity of 

harm

ISO 14971:2019 Annex C Figure C.1 16
Example:

Driving

HAZARD – Potential Source of Harm

Driving in Heavy Traffic

SEQUENCE OF EVENTS

Stop and Go Driving

Little Distance Between Vehicles

Driver Fatigue

HAZARDOUS SITUATION

Distracted Driver Hits Car From Behind

HARM – Physical injury or damage 

to the health of people or damage 

to property or the environment

Large Dent In Car

Probability of 

occurrence of 

harm

(P = P1 * P2)

Severity of 

harm RISK!

ISO 14971:2019 Annex C Figure C.1 17
Risk-Based Decisions, Risk Analysis 

and Risk Management

of Medical Devices 

18
Where You May Consider “Risk”

During Design During 

Manufacturing 

During 

Postmarket

Use

19

Throughout Total Product Life Cycle
During Design During 

Manufacturing 

During 

Postmarket

Use

Where You May Consider “Risk”

20

Throughout Total Product Life Cycle
During Design During 

Manufacturing 

During 

Postmarket

Use

Where You May Consider “Risk”

21

Throughout Total Product Life Cycle
During Design During 

Manufacturing 

During 

Postmarket

Use

Where You May Consider “Risk”

22

Throughout Total Product Life Cycle
Risk-Based Decisions

• CDRH has no statutory or regulatory definition for “riskbased decision”. 

• However, risk-based decision making is essential to CDRH’s 

approach. 

• It is incorporated into how FDA determines the safety and 

effectiveness of a device. See 21 CFR 860.7 (d)(1) 

• Other regulatory documents, including guidance, provide 

additional discussion and examples of risk-based decisions. 

23
Examples of Risk-Based Decisions 

in the Preamble of the 

Final Rule for 21 CFR 820

• “...gives the manufacturer the flexibility to determine the 

controls that are necessary and commensurate with risk.”

• “The extent of the documentation necessary to meet the 

regulation requirements may vary with ..., and the risk

associated with the failure of the device, among other factors.”

CFR = Code of Federal Regulations

24

www.govinfo.gov/content/pkg/FR-1996-10-07/html/96-25720.htm
• “... the degree of corrective and preventive action 

taken to eliminate or minimize actual or potential 

nonconformities must be appropriate to the 

magnitude of the problem and commensurate with the 

risks encountered.”

Examples of Risk-Based Decisions 

in the Preamble of the 

Final Rule for 21 CFR 820

25

www.govinfo.gov/content/pkg/FR-1996-10-07/html/96-25720.htm
Where Does FDA Use

Risk-Based Decisions?

• Medical Device Classification

• Medical Device Premarket Submissions

• Scheduling of Inspections

• Recalls

• Enforcement Actions

26
Commonly Used

Risk Analysis Techniques

• Preliminary Hazard Analysis (PHA)

• Fault Tree Analysis (FTA)

• Failure Mode and Effects Analysis (FMEA)

 See ISO/TR 24971 for guidance on selected risk analysis techniques, including those 

for in-vitro diagnostic medical devices.

27
Risk Management Standard

• AAMI/ANSI/ISO 14971:2019 Medical devices-Application 

of risk management to medical devices (ISO 14971)

- Systematic approach to conducting risk management 

activities

• AAMI/ISO TR 24971:2020-Medical devices-guidance 

on the application of ISO 14971

- Guidance on the application of ISO 14971

28
Summary

• Risk basics involves some foundational key terms and 

definitions

• Determination of risk involves relationships, circumstances 

and sequences of events

• Risk, risk analysis and risk management spans the full total 

product lifecycle of medical devices

• Concepts of risk are included in FDA regulations and 

international standards

29
Resources

Slide 

Number

Cited Resource URL

5-13, 22 ANSI/AAMI/ISO 14971:2019 

Medical devices – Applications of 

risk management to medical 

devices

www.iso.org/standard/72704.html

(for purchase from standards organization)

17-18 21 CFR 820 Quality System 

Regulation and Preamble

www.govinfo.gov/content/pkg/FR-1996-10-07/pdf/96-25720.pdf

20, 21 ISO/TR 24971:2020

Medical devices — Guidance on 

the application of ISO 14971

www.iso.org/standard/74437.html

(for purchase from standards organization)

30
Industry Education:

Three Resources for You

1. CDRH Learn: Multi-Media Industry Education

 Over 200 modules

 Videos, audio recordings, power point presentations, software-based “how to” modules

 Mobile-friendly: access CDRH Learn on your portable devices

www.fda.gov/CDRHLearn

2. Device Advice: Text-Based Education

 Comprehensive regulatory information on premarket and postmarket topics

www.fda.gov/DeviceAdvice

3. Division of Industry and Consumer Education (DICE)

 Contact DICE if you have a question

 Email: DICE@fda.hhs.gov

 Phone: 1(800) 638-2041 or (301) 796-7100 (Hours: 9 am-12:30 pm; 1 pm-4:30pm EST)

 Web: www.fda.gov/DICE

31
Your Call to Action

1. Become familiar with risk

2. Determine the risk of your medical device

3. Build a culture that values the importance of 

understanding risk

4. Use the resources available to help you comply with 

your responsibilities

32
33