A long-awaited technical information report (TIR) that provides state-of-the-art guidance on applying a fundamental risk management standard has just been published.
Already, AAMI/ISO TIR24971:2020, Medical devices—Guidance on the application of ISO 14971, has been a hot seller as a draft document. The TIR offers guidance on management responsibilities, components of a risk management plan, and the risk analysis and evaluation process. It is a companion piece intended to be used and applied together with the standard, ANSI/AAMI/ISO 14971:2019, Medical devices—Application of risk management to medical devices, which establishes a process for medical device manufacturers to identify, evaluate, and manage risk.
The standard and TIR were developed by ISO TC210—Quality management and corresponding general aspects for medical devices, JWG1—Application of risk management to medical devices.
“Risk management as a topic is only becoming more important to the medical device industry as devices are becoming more technically complex and manufactures push innovation,” says Wil Vargas, senior director of standards at AAMI. “The revised guidance helps to ensure all are understanding and applying the principles of risk management in a harmonized, repeatable way, which will ultimately improve the safety and efficacy of medical devices.”
What’s New in TIR24971?
TIR24971 is the result of three years of intensive effort by the joint working group to align the guidance with the revised ISO 14971 standard, according to Edwin Bills, a consultant and a member of the group.
“The resulting document has 38 new pages of informative annexes over the previous versions of these two documents, for a total of 89 pages of guidance,” Bills adds. “The informative annexes were nearly completely rewritten. Users of the risk management standard now have a more complete and updated view of how to implement it in their organization so that our device users, patients, and stakeholders have safer medical devices.”
“This guidance has gone beyond the previous version of the TIR and the standard to answer all the questions that organizations had about how to implement life-cycle risk management within their organization,” adds Tina Krenc, principal consultant for KTA Compliance Consulting, lead instructor for AAMI’s industry training course on Integrating Risk Management into the Product Life Cycle, and a member of the joint working group. “These two documents are considered state-of-the-art in medical device risk management.”
Krenc cites specific areas that address questions or misunderstandings:
- The difference between the policy for determining risk accessibility criteria and actually defining criteria for risk acceptability
- Using criteria for risk acceptability in evaluating individual risks and overall residual risk
- Using the standard for products that were not initially developed using a risk management process
- Risk management and medical device security
“A large revision in the standard covers the production and post-production portion of the life cycle of the devices,” says Bills. “It requires a more active process to understand device performance in the field. This edition reflects regulatory changes in Europe and the U.S. and will require manufacturers to work more closely with the device users to get data on product performance. Hopefully, manufacturers will form a closer relationship with the users to get data on the performance of the current devices to create new devices and correct more quickly any issues that appear in the field.”
In addition, healthcare delivery organizations could benefit from the revised TIR, adds Vargas. “The risk management process can be part of a quality management system—for example, one that is based on ISO 13485:2016, Medical devices – Quality management systems – Requirements for regulatory purposes. But this is not required by ISO 14971:2019. Some requirements in ISO 13485:2016 (Clause 7 on product realization and 8.2.1 on feedback during monitoring and measurement) are related to risk management and can be fulfilled by applying ISO 14971:2019.” The handbook on ISO 13485:2016, Medical devices — A practical guide, is also useful for this purpose.
Three Key Changes in TIR24971
Jos van Vroonhoven, senior manager of standardization for global regulation and standards at Philips and convener of ISO/TC 210—EC/SC 62A JWG1, summarizes key changes in the 2020 revision TIR24971:
- The clause on production and post-production activities is fully revised and divided in four subclauses. More detail is provided on the required activities for collecting information and reviewing this information. Also, the required actions if the collected information is determined to be relevant for safety are described in more detail.
- The clause on the evaluation of overall residual risk is also fully revised. The TIR emphasizes that the overall residual risk comprises the contributions of all individual risks and must always be evaluated in relation to the benefits of the intended use of the medical device. This is in line with regulatory requirements, such as the European MDR, and the TIR provides additional guidance.
- Annex C of TIR24971 provides guidance on the risk management policy of the manufacturer, since this forms the basis for establishing the criteria for risk acceptability. These criteria need to be based on national/regional regulations, international consensus standards, the generally acknowledged state of the art, and stakeholder concerns. This was already required in ISO 14971:2007, but not always considered correctly by manufacturers, which was a reason for the content deviations in EN ISO 14971:2012. The update and clarifications in the revised standard and TIR resolve this problem. The TIR clarifies that the criteria for risk acceptability can include the concept of reducing risk as far as possible, as low as reasonably achievable, and as far as practicable, depending on regulatory requirements in the markets where the medical device is intended to be marketed.
