14971:2012 Annex Z, sequence of mitigation

Hi all

Our company is producing and selling plastic moulded parts in very high quantities for IVD-Devices, I'm involved in risk management.

Now I am still a bit confused about the interpretaion of the new annexes in practice.
It is stated that "‘...all risks, regardless of their dimension, need to be reduced as much as possible".
Is it really meant that even if a risk is already acceptable I do have to mitigate it even further AFAP? And if this is the case, do I have to follow the sequence design/protective/descriptive in a strict manner?

So when I have an already acceptable risk do I really have to go back and change the design of my product, especially for products already on the market?

The effect of such design changes would be small but measurable although just moving the risk to a slightly greener area. As I cannot argue with economics any longer, how do you handle such issues?
By now most of the mitigations are descriptive especially risk concerning transport or storage. Would you describe the risks as not be able to be reduced any further and remove all mitigations?

Greetings, Karl

 

I don't know if there is a good answer. I've been monitoring for information on this since the standard was released. The requirement has certainly caused angst in the device community and I've heard an apocryphal story of an auditor being, um, aggressive. I think most auditors tend to look the other way if you have done a good job of identifying and controlling risks and make the assertion that all risks have been reduced to the greatest extent possible. Clearly, there has to be room for economic considerations or they'd require gold-plated tongue depressors! I've heard some say that economic consideration just can't be the only consideration but I don't see how that changes things much. The most logical approach I've heard is that the target market is factored in and controls that would push the device out of the target market aren't considered since that would be a different device (class).

 

Hi,

I generally agree with Don.

You mentioned that you make parts for other devices. From a regulatory perspective you won't normally be subject to the requirement to conduct a formal EN ISO 14971 risk management (or comply with the associated essential requirements). What exactly is the requirement that is driving your risk management process and where does it come from? Is it a customer?

Cheers,
Ronen.

 

Hi

At first i would like to thank you both for your answers.

@Ronen: maybe i was not completely clear in my initial statement.
We are producing and selling IVD-Accessories that are used in IVD-Systems (e.g blood diagnostics).
As we are legal manufacturer for this Accessories we are fully affected by risk management according EN ISO 14971.

Its still not quite clear for me if its enough to have design and/or protective measures considered and found them "impossible"?
Is it valid to still take descriptive measures in place although there are no reasonable design and/or protective measures which is clearly against the wording in the annex?

Do any of you have any experience with risk management audits since the release of the Annex? Are such topics subject of the audit and maybe leads to discussions?

Thanks in advance, Karl

 

Karl,

Please note that "the 7 deviations" introduced by the 2012 edition of EN ISO 14971 also include one that essentially says that pure labelling change is not an acceptable risk reduction path. Generally I would say that ever since that edition there's a stronger requirement to further reduce / eliminate risks with a stronger emphasis on "real" changes (as opposed to what was sometimes perceived as lip-service or work-arounds to keep mitigation costs at bay), eg design changes. As Don has stated, it is often in the hands of the specific auditor / NB. Some were always stricter than others.

Now that the Elsmar Cove is resurrected I strongly recommend you visit and review the discussions related to the 2012 EN ISO 14971 deviations and how to come to terms with them. We had quite a few when that edition was introduced (and later), and I think you might find some useful insights / approaches in those discussions.

Cheers,
Ronen.

 

You need at least to check and justify why your solutions reduced the risks as much as possible. This is one of the weird deviations that I think is in fact quite reasonable. The one that mentions not using information for safety as a risk control measure does not make sense, though.