BYLINED ARTICLE ON: A REVIEW OF MARKET ENTRY REQUIREMENTS FOR RISK MANAGEMENT, WITH SPECIAL EMPHASIS ON FDA AND ISO 14971 COMPLIANCE By Mark Leimbeck PE Underwriters Laboratories and Larry Kessler Sc.D. Chair University of Washington School of Public Health BY NATURE, MANY MEDICAL DEVICES CAN CARRY A SIGNIFICANT AMOUNT OF RISK, ESPECIALLY THOSE USED ON PARTICULARLY ILL PATIENTS OR THOSE DEVICES THAT ARE INTENDED TO BE LIFE SUSTAIN- ING OR LIFE SUPPORTING. THEREFORE, AN UNDERSTANDING OF THE RISKS INHERENT IN THE APPLICATION OF MEDICAL DEVICES, AND RISK MANAGEMENT HAS ALWAYS BEEN A PART OF THE DESIGN, MANUFAC- TURE, AND POST PRODUCTION PROCESSES ASSOCIATED WITH PLACING MEDICAL DEVICES ON THE MARKET. HOWEVER THE FORMAL REQUIRE- MENTS FOR RISK MANAGEMENT AND ENFORCEMENT OF RISK MANAGE- MENT VARY DEPENDING ON WHERE THE DEVICE WILL BE SOLD AND USED. IN THIS ARTICLE, WE REVIEW THE MARKET ENTRY REQUIREMENTS FOR RISK MANAGEMENT WITH A SPECIAL EMPHASIS ON FDA AND ISO 14971 COMPLIANCE. FDA Requirements for Market Entry The FDA has had a considerable level of involvement in international standards committees for many years including representation at the working committee level, taking the lead drafting documents on occasion, and sitting as members of governing councils for parent standards organizations. However, it was not until the passage of the 1997 Food and Drug Administration Modernization Act (FDAMA) that Congress sought to explicitly encourage the widespread use of standards in a regulatory context. The FDAMA states, in part: (c)(1)(a) In addition to establishing a performance standard under this section, the Secretary shall, by publication in the Federal Register, recognize all or part of an appropriate standard established by a nationally or internationally recognized standard development organization for which a person may submit a declaration of conformity in order to meet a premarket submission requirement or other requirement under this Act to which such standard is applicable. We note that though the intention of congress was to encourage the use of standards, the program remained a voluntary one on both FDA s side (having the option to recognize certain standards) and the side of the manufacturer (whether to choose to declare conformity to the standard or not). Thus, there are options for manufacturers that allow declaration to conformity to national (U.S.) and to internationally recognized standards in order to provide a smooth path to regulatory approval. For example, a manufacturer may declare conformity to applicable standards as part of an abbreviated 510(k) submission. This allows a substantially shorter submission rather than providing the FDA directly with data supporting the manufacturer s claims of safety and effectiveness for the product when used as intended. The requirements for market entry whether through the 510(k) or PMA regulatory pathway [http://www.fda.gov/medicaldevices/ DeviceRegulationandGuidance/HowtoMarketYourDevice/default. htm#link_4] derive directly from law and are embodied in regulations found in the Code of Federal Regulations (CFR). The Quality System Requirements (QSR) only uses a single statement to define the FDA s requirements regarding risk management: 01 For more information E:: ULUniversity@us.ul.com T:: (888) 503-5536
Design validation shall include software validation and risk analysis Comment 83 to the 1996 QSR document defines the risk analysis process much more broadly than the term has come to be used in the decade or so since publication of the QSR. The FDA intent in 1996 included identification of possible hazards, determination of the risk acceptability by the manufacturer, and risk mitigation strategies. In addition, in the comments to the 1996 QSR, the FDA notes it transitioned from using the term hazard analysis to the more general term risk analysis to indicate that manufacturers are expected to identify possible hazards associated with the device in both normal and fault conditions. Risks should be calculated in both normal and fault conditions including cases of use error (previously referred to as user error but changed more recently in the field to remove the blame aspect of errors) and actions must be taken to reduce unacceptable errors by acceptable means. According to FDA, an important part of risk analysis is ensuring that changes made to eliminate or minimize hazards do not introduce new hazards. These comments directly mirror Clause 6.6 of ISO 14971 (risk control) and for all practical purposes are roughly equivalent. The risk control measures in ISO 14971 include risk reduction, residual risk evaluation, and the intention to not introduce new risks into the process. These are similar (though not identical) to the intent of the comments of FDA regarding quality systems. What this means in practical terms is that while the FDA does not by regulation (or law) require the manufacturer s use of all of ISO 14971 throughout the design, production, and post production life cycle of the product, the comments of the 1996 QSR and statements by FDA officials in public regarding handling risk management show little distinction between FDA de facto requirements and ISO 14971. Perhaps the biggest single difference may lie in the extensive documentation an EU notified body might need to assess conformity to ISO 14971 versus what might be absolutely necessary on an FDA QSR inspection. OSHA Requirements The OSHA Instructions per Directive Number CPL 1-03, NRTL Program Policies, Procedures, and Guidelines Appendix C, Sections XII, the requirements state in part: XII. Follow-up Inspection Program. A Nationally Recognized Testing Laboratory (NRTL) must provide inspections of manufacturing facilities, as required under 29 CFR 1910.7(b)(2). As part of meeting this requirement, an NRTL must meet the criteria in paragraph III of this Appendix, and must: A. Perform initial assessment of the manufacturing facility, manufacturer s quality control system, records and documents, and evaluations and tests required by the Standard, following written procedures. B. Have and adhere to written contracts, agreements or procedures for the client-laboratory relationship that should include: 8. Controls to ensure that all quality management system and production records will be open and readily available for inspection by the laboratory. Placing these requirements in the context of an ISO 14971 based declaration of conformity, and recognizing the requirements in Clause 9 of ISO 14971 for Production and Post Production Information, there is a clear linkage between these requirements and the establishment of a mechanism to demonstrate ongoing conformity with these requirements for staff performing inspections under the NRTL program. Such information would be quite compatible with FDA requirements for design controls and manufacturing under the QSR (production information), complaint handling and postmarket surveillance (post-production information). European Union Requirements In the EU, the requirements for risk management are somewhat different. Manufacturers must demonstrate conformance with the essential principles of performance for a device to be placed on the market. This contrasts with the FDA s reliance on demonstration of safety and effectiveness (which is either done directly with a PMA product or by a statement of substantial equivalence via the 510(k) process where the predicate device is assumed to have an acceptable level of safety and effectiveness). It may be worth noting that the FDA recently has faced the challenge of what to do with predicate devices and current market applications when the 02 For more information E:: ULUniversity@us.ul.com T:: (888) 503-5536
state of the science has changed over recent years. If a system of essential principles were in place, then as the science changes, these essential principles move with the science. Currently the 510(k) system relies on predicates to provide a baseline level of safety and effectiveness, and handles technology evolution issues by providing narrow indications for market clearance to maintain an adequate safety profile. In contrast, the EU essential principles embody basic elements of device performance and specifically note the management of risks as emphasized by the very first Essential Requirement which states: Essential Requirement 1 The devices must be designed and manufactured in such a way that, when used under the conditions and for the purposes intended, they will not compromise the clinical condition or safety of patients, or the safety and health of users, or, where applicable, other persons, provided that any risks which may be associated with their use constitute acceptable risks when weighed against the benefits of the patient and are compatible with a high level of protection of health and safety. The requirement describes the basic process for conducting a risk benefit analysis (also part of Essential Requirement 6) for devices, noting that a high level of public safety is required. The Essential Requirements continue: Essential Requirement 2 The solutions chosen by the manufacturer for the design and construction of the devices must conform to safety principles, taking into account the generally acknowledged state of the art. In selecting the most appropriate solutions, the manufacturer must apply the following principles in the order indicated: Eliminate or reduce risks as far as possible (inherent safe design) Where appropriate take adequate protective measures Inform users of residual risks (information for safety) This requirement outlines option analysis and risk control, a familiar hierarchy which has its roots in IEC standards. We then turn to the Annexes for implementation approaches: Annexes II (full quality assurance) and III (EC type examination) of the Medical Device Directive both require that a risk analysis be done (similarly for the In Vitro Device Directive). The directives also require procedures to review post-production experience and apply corrective action. Together with the previously noted essential requirements the EU regulatory system has, in principle, defined a risk management process. Thus, for routes to a declaration of conformity that require a notified body, you must demonstrate to the Notified Body that you have implemented risk management. Specifically: Annex VII (EC declaration of conformity) states: The technical documentation must include the results of the risk analysis. The manufacturer shall institute a systematic procedure to review experience gained in the post production phase Manufacturers must attest that they have done this. These requirements together with the essential requirements also define a risk management process. Whatever route to conformity with the essential requirements, a Declaration of Conformity must be signed by the manufacturer, attesting to this fact. So, whether or not a notified body is involved, risk management is necessary. Canada and Australia In contrast to the US FDA discussion, the existence of ISO 14971 as a normative reference to commonly used standards, such as 60601-1, means that ISO 14971 is a mandatory requirement, as opposed to informative. Where conformity assessment bodies are used, this will be the requirement with which manufacturers will need to comply. For example, in 2008, the Australian Therapeutic Goods Administration declared that ISO 14971 is to be used as an approach to identify risks associated with the device; with the following exception: this standard is not to be used as a specific means to implement the reduction of risks (http://www.tga.gov. au/legis/mdsorm2008.htm) However the balance of the requirements given by the TGA very much aligns with the requirements of ISO 14971. Canada has more guidance and encouragement about risk 03 For more information E:: ULUniversity@us.ul.com T:: (888) 503-5536
management: Does the Manufacturer have a quality plan (which is also submitted to Health Canada with Class IV medical device applications) that specifies the processes and resources for specific medical devices? Have risk assessment and control measures been performed throughout the product realization process for all classes of medical devices? Note 1: See ISO 14971:2000 for guidance related to risk management. Note 2: See GHTF SG3 guidance document Risk Management as an Integral Part of the Quality Management System for additional guidance (www.ghtf.org) How To Prepare a Declaration of Conformity for FDA Using a Recognized Standard In preparing a declaration of conformity to recognized standards, manufacturers should refer to the guidance document, Recognition and Use of Consensus Standards. (see http://www.fda.gov/ MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/ucm077274.htm) Declarations of conformity to recognized standards should include the following: An identification of the applicable recognized consensus standards that were met; A specification, for each consensus standard, that all requirements were met, except for inapplicable requirements or deviations noted below; An identification, for each consensus standard, of any way(s) in which the standard may have been adapted for submission to the device under review, e.g., an identification of an alternative series of tests that were performed; An identification, for each consensus standard, of any requirements that were not applicable to the device; A specification of any deviations from each applicable standard that were applied (e.g., deviations from international standards which are necessary to meet U.S. infrastructure conventions such as the National Electrical Code (ANSI/NFPA 70); A specification of the differences that may exist, if any, between the tested device and the device to be marketed and a justification of the test results in these areas of difference; and, The name and address of any test laboratory or certification body involved in determining the conformance of the device with the applicable consensus standards and a reference to any accreditations of those organizations. FDA and Compliance Issues Although this would surprise many in the lay audience, FDA does not give a stamp of approval. Rather, the responsibility for product safety and effectiveness rests squarely with the manufacturer with no explicit or implied warranty by the FDA. FDA inspectors are there to check to determine whether the law has been upheld. This includes adequate documentation of the entire life cycle process for each product on the market, and the corresponding assessment via documentation that the manufacturer has complied with FDA regulations, including the quality management system which is most often the central focus of inspections. Thus, an adequate risk management system would be expected by the FDA. As such, the FDA investigators are there on behalf of the consumers of the product. By its vigilance in this role, the FDA believes it heightens patient safety related to devices on the U.S. market. Given this, it is desirable to understand how compliance with ISO 14971 would be viewed in the context of an inspection. Along with a functioning and adequately documented quality system, compliance with ISO 14971 would almost certainly be more than acceptable for FDA. We note, however, that the standard is currently (and for the foreseeable future) voluntary. If a manufacturer wishes to use an alternative risk management approach, the language of the response to comments of the 1996 QSR makes clear the steps to undertake represent a series of steps that would virtually mirror ISO 14971. FDA investigators would likely not accept assertion of compliance with a modern risk management system, such as ISO 14971, without very clear documentation that could later be verified through audit or through some alternative means suggested by the manufacturer with adequate documentation of that alternative approach. 04 For more information E:: ULUniversity@us.ul.com T:: (888) 503-5536
FDA would look to the application of any standard, and in this case, IEC 60601 and ISO 14971, and make sure manufacturers are making good decisions, or decisions that are rational, can be explained as part of a consistent decision-making approach, and adequately documented. It is not sufficient (and perhaps not even necessary) to declare conformance to these standards. However, the manufacturer must connect the product lifecycle and its system to ensure that risk control, mitigation, and management decisions are being made in a defensible manner. This would include a system that demonstrated ongoing continuous improvement; this is imbedded in both ISO 9001 and ISO 13485 quality system. Because of the dynamic nature of most devices, and with the generally rapid turnover in device generations, it is imperative that the manufacturer have in its files in preparation for audit more than a snapshot in time. As stated earlier, while compliance with ISO 14971 is not a FDA requirement, any company would be prudent to document any significant deviations or omissions from ISO 14971 or an equivalent risk management process. More than that, the manufacturer must have in place an adequate postmarket surveillance system, and the data from this system connected to evaluation of risks of the product on the market and whether the risks and associated adverse events (AEs) are within the parameters set in the original risk management plan. In addition, this risk management system must also continue to document any foreseeable misuse of the product leading to adverse consequences. Since such off label use is common, but sometimes not well monitored, this can provide a particular challenge for the manufacturer. This entire process sounds straightforward yet it is not for several reasons. Certain types of risk may require the manufacturer to conduct a population estimate of device use and the events associated with that use. Obtaining true estimates of the rates related to device risk is extremely time and resource consuming and challenging. One such study of risks and adverse experience required the hiring of a nurse in a hospital setting merely to observe device use and record AEs (Samore et al.,2004). That approach would not be expected by any regulatory agency. Rather, the expectation of a system for tracking AEs and connection to the risk management plan would include a thorough complaint system and its evaluation. In cases of high risk, specific post market surveillance systems where dedicated data collection is undertaken to measure use and experience with the manufacturer s device would be a means for assuring product safety throughout the lifecycle. Increasingly, the FDA will require specific post market surveillance for high risk products early in the marketing period. To prepare for this, manufacturers may consider designing such studies, and perhaps integrating such data collection plans with the development of product registries that have begun, for example, the implantable cardioverter defibrillator ICD registry of the America Heart Rhythm Society, which as of June 2009, had data from more than 380,000 implants and appears to be growing at a rate of 10,000 implants registered on the registry per month. Feedback loops from postmarket surveillance as part of risk management are the place where companies have historically had problems. Siloing occurs in any bureaucracy and the lack of systematic feedback from those responsible for collecting and evaluating complaints and turning them into Medical Device Reports (MDRs) to the FDA to the product design team or to the compliance team is too common. This can be addressed at the time of product design where the total product life cycle is anticipated and all components of the manufacturer s operation become involved. Summary ISO 14971 and Risk management continue to evolve. Regulators around the world have requirements for risk management in place, and if not specifically referencing ISO 14971, certainly mirroring the major elements of this Standard. Given the variety of approaches, a major benefit offered by ISO 14971 is the establishment of a consistent set of requirements that formalize a continuous lifecycle approach to risk management. Preparing a declaration of conformity for regulators in different parts of the world may offer challenges on one level, but having a consistent management system in place that is almost universally acknowledged as a benchmark can make the task that much easier. References Samore MH, Evans RS, Lassen A, Gould P, Lloyd J, Gardner RM, Abouzelof R, Taylor C, Woodbury DA, Willy M, Bright RA. Surveillance of medical device-related hazards and adverse events in hospitalized patients. JAMA. 2004 Jan 21;291(3):325-34 05 For more information E:: ULUniversity@us.ul.com T:: (888) 503-5536 Copyright 2010 Underwriters Laboratories Inc. All right reserved 8/10 BDI 100408