Risk Assessment
Summary
The Risk Assessment systematically identifies, analyzes, and evaluates all potential hazards and risks associated with your medical device, establishing the foundation for risk control measures and demonstrating compliance with ISO 14971 requirements throughout the device development process.
Why is a Risk Assessment Important?
A comprehensive Risk Assessment provides the analytical foundation for medical device safety by systematically identifying all foreseeable hazards before they can cause harm. Without thorough risk assessment, development teams miss critical safety issues, leading to inadequate risk controls, post-market safety problems, and regulatory compliance failures that can result in device recalls or market withdrawal.
This assessment transforms potential safety concerns into documented risks with quantified likelihood and severity, enabling informed decision-making about risk acceptability and control measures. It establishes the evidence base for demonstrating that your device is safe for its intended use and that all foreseeable risks have been appropriately addressed.
For medical device development, risk assessment serves as your safety roadmap by identifying where risk controls are needed and providing the rationale for design decisions. It demonstrates to regulatory authorities that your organization has systematically considered device safety and implemented appropriate measures to protect users and patients from harm.
Regulatory Context
Under 21 CFR Part 820.30 (Design Controls), the FDA requires:
- Risk analysis as part of design and development activities
- Documented evaluation of device-related hazards and risks
- Risk control measures implemented based on risk assessment findings
- Design review of risk assessment results and risk control decisions
- Risk management file maintained with complete risk assessment documentation
The FDA recognizes ISO 14971:2019 as the consensus standard for risk assessment, requiring:
- Systematic hazard identification and risk analysis
- Risk evaluation against predefined acceptance criteria
- Risk control implementation and verification
- Residual risk assessment and overall risk evaluation
- Post-market risk monitoring and assessment updates
Special attention required for:
- Software risk assessment must follow IEC 62304 requirements and integrate with overall device risk assessment
- Cybersecurity risks require ongoing assessment per FDA cybersecurity guidance including threat modeling
- Use-related risks must be assessed per FDA Human Factors guidance and IEC 62366-1
- Combination devices require coordinated risk assessment across all device components
Under 21 CFR Part 820.30 (Design Controls), the FDA requires:
- Risk analysis as part of design and development activities
- Documented evaluation of device-related hazards and risks
- Risk control measures implemented based on risk assessment findings
- Design review of risk assessment results and risk control decisions
- Risk management file maintained with complete risk assessment documentation
The FDA recognizes ISO 14971:2019 as the consensus standard for risk assessment, requiring:
- Systematic hazard identification and risk analysis
- Risk evaluation against predefined acceptance criteria
- Risk control implementation and verification
- Residual risk assessment and overall risk evaluation
- Post-market risk monitoring and assessment updates
Special attention required for:
- Software risk assessment must follow IEC 62304 requirements and integrate with overall device risk assessment
- Cybersecurity risks require ongoing assessment per FDA cybersecurity guidance including threat modeling
- Use-related risks must be assessed per FDA Human Factors guidance and IEC 62366-1
- Combination devices require coordinated risk assessment across all device components
Under EU MDR 2017/745, risk assessment must comply with:
- Annex I GSPR 3 requiring comprehensive risk assessment and management
- EN ISO 14971:2019 as harmonized standard for risk assessment processes
- Annex II Section 4 requiring risk assessment documentation in technical file
- Article 61 requiring clinical evaluation to address risks identified in risk assessment
Key MDR requirements include:
- Risk assessment covering entire device lifecycle including post-market phase
- Clinical evaluation must address benefit-risk balance based on risk assessment
- Post-market surveillance must monitor risks identified in risk assessment
- Notified body assessment of risk assessment adequacy and conclusions
- Person Responsible for Regulatory Compliance (PRRC) oversight of risk assessment
Special attention required for:
- Clinical evidence requirements may be driven by specific risks identified in risk assessment
- Post-market clinical follow-up (PMCF) must monitor risks that require ongoing evaluation
- Vigilance reporting must be coordinated with risk assessment findings and updates
- AI/ML devices require specific risk assessment considerations per emerging MDCG guidance
Guide
Your Risk Assessment must comprehensively identify and evaluate all foreseeable risks associated with your medical device while providing clear justification for risk acceptability decisions.
Preliminary Hazard Analysis
Begin with systematic hazard identification using structured methods appropriate to your device type. Conduct preliminary hazard analysis (PHA) to identify system-level hazards, failure mode and effects analysis (FMEA) for component-level failures, and use-related risk analysis for human factors issues.
Consider multiple hazard categories including software malfunctions, hardware failures, user interface issues, environmental factors, cybersecurity threats, and biological risks. Review similar devices, incident databases, and published literature to ensure comprehensive hazard identification. Engage multidisciplinary teams to capture different perspectives on potential hazards.
Hazard-to-Harm Analysis
Establish clear linkages between identified hazards, hazardous situations, and potential harms. For each hazard, identify the sequence of events that could lead to a hazardous situation and the potential harms that could result. Document the causal relationships and consider multiple pathways from hazard to harm.
Define harm categories that reflect the severity of potential consequences including temporary discomfort, reversible injury, irreversible injury, and life-threatening situations. Consider both immediate and delayed effects, direct and indirect harms, and impacts on different user populations.
Risk Analysis and Estimation
Conduct probability estimation for each identified risk using available data, expert judgment, and appropriate analysis methods. Estimate both the probability of hazardous situation occurrence (P1) and the probability of harm given the hazardous situation (P2). Calculate overall probability as P1 multiplied by P2.
Perform severity assessment for each potential harm using your established severity categories. Consider worst-case scenarios while maintaining realistic assessments based on available evidence. Document assumptions and uncertainty in probability and severity estimates.
Risk Evaluation and Acceptability
Apply risk acceptance criteria from your Risk Management Plan to determine if each risk is acceptable, requires reduction as far as possible (AFAP), or is unacceptable. Use your risk acceptance matrix to make consistent decisions across all identified risks.
Document risk acceptability decisions with clear rationale including consideration of intended use, user population, and available alternatives. For risks requiring reduction, identify potential risk control measures and their expected effectiveness.
Software Safety Classification
For devices containing software, determine IEC 62304 safety classification (Class A, B, or C) based on the potential for software failure to contribute to hazardous situations. Consider both direct software failures and software contributions to system-level hazards.
Document software risk analysis that addresses software-specific hazards including coding errors, integration failures, cybersecurity vulnerabilities, and software-hardware interface issues. Ensure software safety classification drives appropriate development rigor and verification activities.
Risk Control Planning
Identify potential risk control measures for unacceptable risks and those requiring reduction AFAP. Prioritize controls following the ISO 14971 hierarchy: inherent safety by design, protective measures, and information for safety.
Evaluate risk control effectiveness and potential for introducing new risks. Document how risk controls will be implemented as design requirements, protective features, or user information. Plan verification activities to confirm risk control effectiveness.
Residual Risk Assessment
Assess residual risks remaining after implementation of risk control measures. Re-evaluate probability and severity considering the effectiveness of implemented controls. Determine if residual risks are acceptable according to your risk acceptance criteria.
Conduct overall residual risk evaluation considering the cumulative effect of all residual risks. Document benefit-risk analysis for any unacceptable residual risks, demonstrating that clinical benefits outweigh remaining risks.
Documentation and Traceability
Maintain comprehensive risk assessment documentation including hazard identification records, risk analysis tables, risk evaluation decisions, and risk control specifications. Ensure traceability between hazards, risks, controls, and verification activities.
Establish review and update procedures for risk assessment documentation including triggers for updates, review frequencies, and approval processes. Plan for incorporating post-market information and design changes into risk assessment updates.
Example
Scenario: You’re conducting risk assessment for a wearable stress monitoring device that collects physiological data and provides stress management recommendations. The assessment must address hardware, software, cybersecurity, and clinical use risks across the complete system.
Risk Assessment
ID: RA-StressWear-2024-001
Device: StressWear Stress Monitoring System
Software Safety Classification: Class B - Non-serious injury possible from software failure (incorrect stress level readings could lead to inappropriate user actions)
Risk Analysis Process:
- P1: Probability of hazardous situation occurring from hazard
- P2: Probability of harm occurring from hazardous situation
- Overall Probability: P1 multiplied by P2
- Risk Level: Determined using risk acceptance matrix from Risk Management Plan
Risk Analysis Table:
| Risk ID | Risk Type | Hazard | P1 | Hazardous Situation | P2 | Harm | Severity | Overall Prob | Risk Level |
|---|---|---|---|---|---|---|---|---|---|
| R001 | Hardware | Sensor malfunction | P3 | Inaccurate physiological readings | P3 | Incorrect stress level information leading to inappropriate actions | S2 | P3 | Reduce AFAP |
| R002 | Software | Algorithm error | P2 | Stress level calculation error | P3 | User misinterprets stress state, ignoring symptoms | S2 | P2 | Acceptable |
| R003 | Usability | Confusing user interface | P4 | User misunderstands stress display | P2 | Inappropriate action based on misunderstanding | S2 | P3 | Reduce AFAP |
| R004 | Cybersecurity | Data breach | P2 | Unauthorized access to health data | P4 | Privacy violation and potential discrimination | S3 | P3 | Reduce AFAP |
| R005 | Hardware | Battery overheating | P1 | Device becomes hot during charging | P2 | Skin burn from prolonged contact | S3 | P1 | Acceptable |
| R006 | Biological | Allergic reaction | P2 | Skin contact with device materials | P3 | Contact dermatitis or allergic reaction | S2 | P2 | Acceptable |
| R007 | Software | App crash during critical reading | P3 | Loss of stress monitoring during high-stress period | P2 | User unaware of stress level when intervention needed | S2 | P2 | Acceptable |
| R008 | Environmental | Water damage | P2 | Device exposed to water beyond IP rating | P4 | Device malfunction leading to no stress monitoring | S1 | P3 | Acceptable |
| R009 | Use Error | Incorrect device placement | P4 | Device worn incorrectly affecting readings | P3 | Inaccurate stress measurements, poor management | S2 | P4 | Reduce AFAP |
| R010 | Cybersecurity | Malware infection | P1 | Malicious software affects device operation | P2 | Device provides false readings or stops functioning | S3 | P1 | Acceptable |
Risk Control Measures:
| Risk ID | Risk Control Type | Control Description | Implementation | Verification Method |
|---|---|---|---|---|
| R001 | Inherent Safety | Implement sensor redundancy and cross-validation algorithms | Software Requirements Document | System testing with sensor failure simulation |
| R001 | Information for Safety | User training on recognizing device malfunction indicators | Instructions for Use | Usability testing validation |
| R003 | Inherent Safety | Redesign user interface with clear stress level indicators and explanatory text | Software Requirements Document | Usability testing with target users |
| R003 | Information for Safety | Provide user guide with interpretation examples | Instructions for Use | Usability testing validation |
| R004 | Protective Measures | Implement end-to-end encryption and secure authentication | Software Requirements Document | Cybersecurity penetration testing |
| R004 | Protective Measures | Regular security updates and vulnerability monitoring | Software Maintenance Plan | Post-market security monitoring |
| R009 | Information for Safety | Clear placement instructions with visual guides | Instructions for Use | Usability testing validation |
| R009 | Protective Measures | Device placement detection algorithm with user feedback | Software Requirements Document | System testing with placement variations |
Residual Risk Assessment:
After implementation of risk control measures:
- R001: Reduced to P2/S2 = Acceptable (sensor redundancy significantly reduces probability)
- R003: Reduced to P2/S2 = Acceptable (improved UI design reduces misunderstanding)
- R004: Reduced to P1/S3 = Acceptable (encryption and security measures reduce breach probability)
- R009: Reduced to P2/S2 = Acceptable (placement detection and training reduce incorrect use)
Overall Residual Risk: Acceptable - All individual risks are acceptable after control measures, and overall benefit-risk ratio is positive based on stress management benefits.
Conclusion: The risk assessment has identified and evaluated all foreseeable risks associated with the StressWear system. Risk control measures have been implemented to reduce unacceptable risks to acceptable levels. The overall residual risk is acceptable considering the clinical benefits of objective stress monitoring and personalized stress management recommendations.