ISO 14971: Risk Management for Medical Device Companies Q&A
Total Page:16
File Type:pdf, Size:1020Kb
Q&A ISO 14971: Risk Management for Medical Device Companies Q&A *The following questions and answers were prepared by MasterControl Inc., a leading provider of quality management software solutions for FDA-regulated industries and ISO-certified companies. What is ISO? ISO (derived from the Greek word isos, meaning equal) refers to the International Organization for Standardization, established in 1 1947 by delegates from 25 countries to facilitate the international coordination and unification of industrial standards. Although ISO, a non-governmental organization, has no legal authority to enforce implementation of standards, governments that adopt ISO standards as part of a regulatory framework do so. ISO standards are developed in response to market demand, which also ensures widespread applicability. What are the benefits of ISO standards promote safety and reliability in products and services. ISO certification? They make trade between countries easier because they provide a 2 “level playing field” and a common ground for putting trade agreements into practice. For governments, ISO standards provide a basis for health, safety, and environmental legislation. For businesses, manufacturing products that adhere to ISO standards means greater acceptance in the international market. For consumers, the use of common quality standards worldwide means a wider choice of products. How does a company get The process of ISO evaluation and approval is called “conformity assessment.” ISO itself does not carry out the assessment. A supplier ISO certification? 3 may conduct a “first-party assessment” and make a self-declaration of conformity. It may choose to invite a potential customer to conduct a “second-party assessment” and let the customer verify that its products conform to specific ISO standards. Or the supplier may invite an independent certification/registration organization to conduct a “third-party assessment.” Third-party assessment may be required by government regulations or specified by customers. What is ISO 14971? ISO 14971:2000 (“Medical Devices - Application of Risk Management to Medical Devices) is an internationally recognized standard used by 4 manufacturers as a tool for conducting risk assessment. The U.S. Food and Drug Administration (FDA) recognizes it as an acceptable risk management model and the European Union has made it mandatory. Even if manufacturers choose not to implement ISO 14971, they are still expected to conduct and document a risk management process. ISO 14971: Risk Management for Medical Device Companies 1 Q&A What does “risk Risk management in the context of ISO 14971 refers to a process for “identifying hazards associated with a medical device, estimating and management” mean? 5 evaluating associated risks, controlling these risks, and assessing the effectiveness of the control.” Hazard means any potential source of harm to the patient or consumer. Risk refers to a combination of the severity of the harm and the probability of its occurrence. Risk control is the process of implementing protective measures for reducing risks or keeping them to a minimum. Is there a connection Yes. ISO 13485 is an international standard that specifies requirements for regulatory purposes for medical device manufacturers. It provides between ISO 14971 and 6 a framework for companies to meet their customer and regulatory ISO 13485? requirements, and outlines the things that they need (i.e., quality management system, resources, management requirements, remedial requirements, etc.) in order to be compliant. ISO 13485: 1996 requires risk analysis and records pertaining to risk analysis throughout the design process. ISO 13485:2003 requires the establishment of documented requirements for risk management throughout the product realization process and to maintain risk management records. A note in ISO 13485:2003 refers to ISO 14971 for guidance related to risk management. The latter deals more with principles of risk management — a way of thinking — for manufacturers to fulfill the risk management requirement of ISO 13485. Why is MasterControl MasterControl Inc. is a pioneer in developing software solutions designed to help companies adhere to ISO standards and comply interested in ISO 14971? 7 with FDA regulations. Hundreds of companies worldwide rely on MasterControl™ to help them automate, document, track, and manage their quality processes. The company is committed to keeping abreast with ISO standards and FDA regulations and to continually enhance its products and services accordingly. ISO 14971: Risk Management for Medical Device Companies 2 Q&A How can MasterControl Following are some of the elements of ISO 14971 and the relevant MasterControl capabilities. 8 help medical device manufacturers comply with ISO 14971 requirements? ISO 14971 MasterControl™ Quality Suite Risk management process: A process for Automates creation, revision, distribution of documents and effectively identifying hazards associated with a medical device, manages any documents-based process. Will make your organization’s as well as estimating, evaluating, and controlling transition from manual/hybrid system to an electronic document such risks. The process should be documented. control system easier because it can handle all types of documents regardless of the software used to create them. Management responsibilities: The manufacturer Automates and manages creation, revision, and routing of policy- should define the policy for determining acceptable related documents. Allows collaboration (input, approval, sign-off) in risk… review the results of risk management defining risk policies. Facilitates review of documents pertaining to activities at defined intervals to ensure continuing risk management activities through automatic e-mail notification and suitability of the risk management process. escalation of tasks. Tracks documents by history or status. Risk management file: Should include Provides secure and centralized repository for all documents in risk documentation of policy for determining acceptable management file, making search and retrieval easy. Through the risks, risk management plan, results of risk analysis, Organizer tool, documents can be easily arranged and rearranged list of known/foreseeable hazards, risk control in different categories (i.e., risk control, risk analysis, etc.) without measures, and results of residual risk evaluation. changing the documents themselves. Qualification of personnel: Those performing risk Deploys training courses requiring users to learn their duties and management tasks should include persons with demonstrate proficiency. Training can be linked to documents for knowledge and experience of the medical device and automatic notification of trainees when SOPs and other critical documents its use and risk management techniques. Records of change and retraining becomes necessary. Performs gap analysis for all appropriate qualifications should be maintained. training tasks, all the time. Tracks any kind of training requirements. Risk management plan: Should include description Provides record of every change made to the risk management plan or of medical device, lifecycle phases that the any other document, including who created, modified, or deleted a record, plan is applicable, verification plan, allocation of when the action occurred, and the changes made. System tracks changes responsibilities, and requirements for review of risk made to every field in a document’s InfoCard and makes them available management activities. If the plan changes during the through system reports. A user is also required to enter a reason for every lifecycle of the device, a record of the changes should change made. MasterControl provides revision control through “Check- be maintained. in” and “Check-out” feature, so only most current version of document is available. The software also maintains time-stamped audit trail. Risk management report: Results of the risk Automates and manages reporting of risk management process. A variety management process shall be recorded in a risk of standard and custom report writing capabilities are available like audit management report. The report should provide trail, master list, cycle time, revision history, etc. Graph and charting traceability for each hazard to the risk analysis, the capabilities help system administrators proactively measure and manage risk evaluation, the implementation and verification of the system. the risk control measures, and the assessment that the residual risks are acceptable. ISO 14971: Risk Management for Medical Device Companies 3 Q&A About MasterControl MasterControl Inc. creates software solutions that enable life science and other regulated companies to deliver life-improving products to more people sooner. MasterControl’s integrated solutions accelerate ROI and increase efficiencies by automating and securely managing critical business processes throughout the entire product lifecycle. More than 1,000 companies worldwide, ranging in size from five employees to tens of thousands, rely on MasterControl cloud solutions to automate processes for new product development, clinical, regulatory, quality management, supplier management, manufacturing and postmarket surveillance. MasterControl solutions are well-known for being scalable, easy to implement, easy to validate and easy to use. For more information, visit www.mastercontrol.com. Contact information and addresses for other regional MasterControl offices and MasterControl partner offices are listed on the MasterControl website at www.mastercontrol.com. © 2019 MasterControl Inc. All rights reserved. QAXX2017.2USENA4-04/19.