ISO-14971February 11, 2015 – by Brian Manookian

ISO 14971 is the name of the international standard for applying risk management to medical devices, which is a fundamental step in ensuring the safety of both healthcare professionals and patients. The version of the standard recognized by the U.S. Food and Drug Administration (FDA) was adopted in 2007 and is known as ISO 14971:2007.

Summary and Scope of ISO 14971

This international standard is applicable to all manufacturers of medical devices, and it helps mitigate risk throughout a product’s lifespan from conception to disposal. The application of the standard is mandatory, and manufacturers must be able to demonstrate they are in compliance. Although certification is not usually required, it is available through independent registrars and can help demonstrate good faith in applying the standard to medical products.

Part 3: Establishing a Framework

The technical aspects of ISO 14971 begin with Part 3 and end at Part 9. Part 3 serves as an introduction and overview of Part 4 through Part 9 and asks manufacturers to clearly define a risk-management policy and assign responsibility to competent personnel. It also asks that the criteria for risk acceptability be clearly defined, a risk management plan be established and a file be started for each medical product.

Part 4: Risk Analysis

Part 4 of ISO 14971 asks manufacturers to begin each product file with documentation on how the device is to be used and to record the possible safety hazards. Each hazard must then be put through a risk analysis to estimate the likelihood of an occurrence and the possible damages.

Part 5: Evaluate Risk

In Part 5, manufacturers must apply the risk acceptability criteria established in Part 3. If a risk is not acceptable according to the criteria, it must be reduced.

Part 6: Develop Risk-Control Measures

If the risk associated with a particular medical device must be reduced, then control measures have to be identified that can bring it within acceptable levels. After the control measures have been implemented, verification of such must be established and added to the file. In addition, it then becomes necessary for manufacturers to evaluate whether any residual risk meets the criteria for risk acceptability.

Part 7: Evaluate Overall Risk

If the residual risk is not acceptable and cannot be further controlled, another analysis must be applied to determine whether the benefits of the device outweigh the risks. Hard evidence must be used to weigh the benefits and risks. If the risks outweigh the benefits and no further controls can be implemented, then the device cannot be produced for sale and must go through another round of research and development or be scrapped altogether.

Part 8: Review and Report

Once any residual risks have been reduced to acceptable levels or the benefits have been found to outweigh the risks, a full review of the risks must be made and put into a detailed report. As part of the report, the entire risk-management plan must also be reviewed, and information on production and post-production must be included.

Part 9: Monitor Production and Post-Production

The final part of ISO 14971 asks manufacturers to establish a system whereby the medical device is monitored during production and post-production. Finally, the monitoring system must be implemented to assure total risk management has been applied.