A Strong Post-Market Surveillance Enables a Strong Risk Management System

Risk Management

The Key to Strong Risk Management

The concept of risk-management is not new to Medical Device companies. The challenge, however is to consistently apply risk-management principles throughout the entire product lifecycle. A strong post-market surveillance process is key to building the organizational capability of a strong and holistic risk-management system.

In general, there is a strong focus on risk-assessment and risk-control activities during the Design and Development phase. Once the product is transferred to manufacturing and subsequently launched in the market, the focus shifts to the next new product in the development pipeline. In some cases, there may be a requirement of ongoing risk-assessment and reporting post-production, but this is not always the case and typically done only on an annual basis.

Risk-management is recognized as a complex subject since everyone has a different perception of risk and it changes over time.

Risks for a medical device are based on the likelihood and severity of the harm caused by a failure.

Only a limited amount of information about the likelihood and severity of harms is available during the Design and Development phase. No product can be completely risk-free and the design is finalized when the patient benefits outweigh any remaining risks after all appropriate risk control measures are implemented. Since this is based on limited information only, it is critical to continue monitoring, assessing and controlling these remaining risks after launch.

This is the primary intent of ISO 14971, the international standard recognized by the FDA for application of risk-management to medical devices.

ISO 14971 requires application of risk-management to all stages of the product lifecycle, from initial conception to the final decommissioning and disposal  


In the absence of a strong risk-management process for post-production devices, it is challenging to make good decisions when there are quality or safety issues in the market.

In this regard, FDA has recently issued a guidance document about the benefit-risk factors the agency may consider in prioritizing resources for compliance and enforcement efforts to maximize medical device quality and safety. This is a strong signal to medical device companies to be able to provide a sound risk-based rationale for market actions or decisions relating to non-conformances and other compliance issues.

Another benefit of a holistic risk-management throughout product lifecycle is that risk-based compliance policies can be established to prioritize resources and gain operational efficiencies.

The application of the goals of the least burdensome approach has resulted in new efforts to implement risk-based compliance policies by the FDA.

The benefit-risk approach is an example of the application of the least burdensome approach by the FDA. A similar risk-based approach to your internal Compliance policy can help you refocus your resources on the most value-added activities. However, this must be done in a holistic way throughout the product lifecycle.

A post-market surveillance process within the ISO 14971 framework is an effective way to accomplish such a holistic risk-management system. Recent advancements in automation of data collection and analytics can be leveraged to provide timely updates to severity and likelihood of harms for a more accurate risk assessment. A cross-functional team of subject matter experts can utilize a standardized risk assessment tool to evaluate this data and recommend appropriate actions. These actions may include design or process improvements to further reduce risks and improve the benefit-risk balance. In some cases, new data may lead to relaxing some of the process and procedural controls when previously anticipated risks are found to be mitigated. In this way, a process of continuous improvement can be implemented to deliver ongoing gains in both efficiency and effectiveness of the Quality System.

The missing link in the risk-management system at most device companies is their post-market surveillance process. Although there is routine monitoring and trending of complaints data, the next step is to develop a process which can help close the loop with risk management currently in place during Design and Development.