Risk Management Report

Risk Management Report

For

[Device Name]

Manufacturer Name: [Manufacturer name]

Document Number: RMR-ZZZZ(-XXX)

Revision: Y

Introduction

Implementing a risk management process in accordance with EN ISO 14971:2019 ensures a systematic and structured approach to identifying, estimating, evaluating, and controlling risks associated with a medical device. This process is applied throughout the entire device lifecycle, from design to obsolescence, enabling the continuous identification of potential hazards and hazardous situations, the implementation of risk control measures, and the verification of their effectiveness.

The risk management review, documented in this risk management report, outlines the risk management activities conducted for [Device Name] (hereafter referred to as [Device short name]), which is manufactured by [Manufacturer Name] (hereafter referred to as [Manufacturer short name]).

Reference documents

Adjust the list of standards, procedures and records as necessary.

Table 1: Reference documents

Document No.	Document Title
	Risk Analysis
	Risk Management Plan
	Usability Engineering File
	Device History File
	Device Master Record
	Technical Documentation
	Risk Management Procedure
	Design and Development Procedure
	Post-Market Surveillance Procedure
	Usability Procedure
	Clinical Evaluation Procedure
EN ISO 14971:2019	Medical devices – Application of risk management to medical devices
ISO/TR 24971: 2020	Medical devices – Guidance on the application of ISO 14971
EN 62366:2008 IEC 62366-1:2015	Medical Devices Part 1: Application for Usability Engineering to Medical Devices
EN ISO 10993-1:2020	Biological evaluation of medical devices — Part 1: Evaluation and testing within a risk management process
MDR	Medical Devices Regulation (EU 2017/745)

Process overview

The risk management procedure has been applied as depicted in the figure below:

Figure 1: Representation of the risk management process

Scope of the risk assessment

The section must be consistent with the risk management plan.

Product references

Table 2: Device Models

Manufacturer Name:		[Company short name]
Device Family Name:		[Device short Name]
Model Number	Description	Basic UDI-DI

Device description

Include the description as reported in the IFU or TD File

Device intended use

Include the intended use, indication for use, contra-indications, complications as reported in the IFU.

Responsibilities

The responsibilities for risk management activities are defined in the risk management plan (see Section 1.1). These activities have been conducted by designated individuals in accordance with their assigned roles and responsibilities.

Implementation of risk management plan

The risk management plan has been developed in compliance with EN ISO 14971, outlining the processes and activities necessary for effective risk management. All risk management activities and procedures have been conducted in accordance with the risk management plan (see Section 1.1).

Identification of safety-related characteristic

[Company short name] defined the characteristics of the device that may impact safety using the questions listed in Annex A of ISO/TR 24971, along with literature searches, vigilance and recall data, and applicable standards relevant to [Device short name]. The exact sources for the identification of safety-related characteristics are documented in the risk management plan (see Section 1.1).

Identification of hazard and hazardous situations

The identification of hazards and hazardous situations has been conducted through an analysis of safety-related characteristics described in Section 4.1. Traceability between the source of safety-related characteristics and the corresponding hazards or hazardous situations is documented in the “Source” column of the risk analysis (see Section 1.1).

Known and foreseeable hazards associated with [Device short name] have been identified considering its intended use, reasonably foreseeable misuse, and safety-related characteristics under both normal and fault conditions. For each identified hazard, the reasonably foreseeable sequences or combinations of events that may lead to a hazardous situation have been evaluated across the entire device lifecycle, and the resulting hazardous situations have been documented. The identification of hazards, hazardous situations, lifecycle phases, and normal or fault conditions is recorded in the risk analysis (see Section 1.1).

For each hazardous situation, potential patient or user harms have been identified and defined. A single hazardous situation may lead to multiple types of harm, each of which has been individually assessed according to the risk estimation criteria defined in the risk management plan (see Section 1.1). All potential harms resulting from hazardous situations have been systematically documented in the risk analysis (see Section 1.1).

Criteria of risk acceptability

The risk analysis methodology applied to [Device short name] follows the Failure Modes and Effects Analysis (FMEA) approach, utilizing severity and likelihood criteria to determine the Risk Priority Number (RPN) ranking. The scales for severity and likelihood, as well as the criteria for risk acceptability, have been defined and justified in the risk management plan (see Section 1.1). The risk analysis and this risk management report have been defined considering the risk acceptability criteria of the risk management plan.

Risk estimation, risk evaluation and risk control

The risk estimation is conducted for each hazardous situation identified for [Device short name], involving the assessment of risk severity and likelihood based on the definitions provided in Section 4.3 referring to the risk management plan (see Section 1.1). As documented in the risk analysis (see Section 1.1), the severity of each risk has been determined through a review of possible harms that may result from each hazardous situation.

The likelihood of risks is initially determined based on review of the state-of-the-art review of similar or equivalent technologies, as well as the experience accumulated by [Company short name] regarding the design and manufacturing processes used for [Device short name]. This likelihood estimation is subsequently validated through production and post-production data collected after the commercialization of [Device short name]. When a precise risk estimation cannot be determined due to uncertainties in risk severity or occurrence, the most critical estimation is applied based on current state-of-the-art and available data.

Each risk is evaluated as acceptable, undesirable, or intolerable, in accordance with the criteria defined in Section 4.3 referring to the risk management plan (see Section 1.1). Regardless of the assigned risk level, risk mitigation measures have been identified and implemented as far as possible (AFAP). The implementation of risk mitigation measures is documented in the risk analysis (see Section 1.1), with supporting evidence such as drawing numbers, quality agreements, inspection sheets, and other relevant design output documents.

The effectiveness verification confirmed that all risk mitigation measures were effective and appropriate. This verification was conducted using the following methods:

• Testing to confirm compliance with applicable harmonized or technical standards,
• Testing to ensure conformity with safety criteria,
• Design verification and validation,
• Process validation,
• Clinical data analysis.

The verification of effectiveness has been documented in the risk analysis (see Section 1.1), with supporting evidence, such as test document numbers, confirming that verification activities have been conducted.

Following the implementation and verification of risk mitigation measures, the residual risk was re-estimated according to the methodology described in Section 4.3.

Individual residual risk & balance « Benefit / Risk »

Based on the re-estimation of risks, each individual residual risk has been re-evaluated in accordance with the criteria defined in Section 4.3. None of the residual risks have been classified as “intolerable”, while X risks are deemed “acceptable” and Y risks are considered “undesirable”.

Table 3: Evaluation of residual risks

Risk evaluation	Type	Before risk reduction measures	After risk reduction measures
1-4	Acceptable
5-7	Undesirable
≥8	Intolerable

RPN to be aligned with the risk analysis

By definition, the benefits of using [Device short name] outweigh each individual “acceptable” residual risk. However, the risk analysis (see Section 1.1) provides a detailed explanation of how the benefits outweigh the individual risks that have been deemed acceptable.

The “undesirable” residual risks require further analysis to confirm a positive benefit-risk (B/R) profile, as detailed below.

Justification of the Benefit-Risk (B/R) Profile for Undesirable Residual Risks

The “undesirable” residual risks have been categorized into X groups, where the risks within each group may interact, but the groups themselves do not interact with one another. For each group, a benefit-risk justification has been provided:

• RR1: Residual risks associated with XXXX describe the topic of this RR (e.g., biocompatibility) (items XX and XX) indicate the items referenced in the risk analysis for traceability.

Justification for the acceptability of B/R profile to be included here.

• RR2: Residual risks associated with XXXX describe the topic of this RR (e.g., biocompatibility) (items XX and XX) indicate the items referenced in the risk analysis for traceability.

Justification for the acceptability of B/R profile to be included here.

• RR3: Residual risks associated with XXXX describe the topic of this RR (e.g., biocompatibility) (items XX and XX) indicate the items referenced in the risk analysis for traceability.

Justification for the acceptability of B/R profile to be included here.

• RR4: Residual risks associated with XXXX describe the topic of this RR (e.g., biocompatibility) (items XX and XX) indicate the items referenced in the risk analysis for traceability.

Justification for the acceptability of B/R profile to be included here.

Risks arising from risk control measures

The implemented risk mitigation measures did not introduce any new risks or affect the risk estimation of existing risks.

OR/

The implementation of risk mitigation measures introduced new hazardous situation(s) as documented in the risk analysis (see Section 1.1). X new risk has(ve) been identified:

• Item #X: description of new risks

The new hazardous situation(s) identified has(ve) been controlled independently as a new risk(s).

Completeness of risk control

To the best of our knowledge, all known hazards have been identified and risk control measures have been deemed appropriate, implemented AFAP, and effective.

Overall residual risk & balance « Benefit / Risk »

As described in Table 3, none of the risks are intolerable, X risks have directly been evaluated “acceptable” regarding the benefits of [Device short name] and all “undesirable” risks have been gathered in X independent categories for which the risks have been mitigated AFAP and evaluated acceptable when weighed against the benefits of [Device short name] (see Section 4.5).

In addition, using the criteria defined in the risk management plan (see Section 1.1), [Device short name] is classified as a breakthrough technology / a device with a strong clinical impact / a device with a moderate clinical impact, or a device with an unchanged clinical impact.

Include a rationale supporting this classification based on clinical evidence, technological advancements, and comparison with existing alternatives.

Additionally, the highest level of residual risk identified is 2 “undesirable” / 1 “acceptable”.

As a result, the following methodology has been applied to evaluate the overall benefit-risk profile according to the criteria defined in the risk management plan (see Section 1.1):

• Expert review and labeling review,
• Expert review,
• Labeling review.

Evaluation of overall B/R profile via expert review to be removed if not applicable

As part of the clinical evaluation report (see Section 1.1), the overall residual risk has been assessed as acceptable in relation to the benefits of [Device short name] to be removed if not applicable. A summary of the benefit-risk analysis discussed in the clinical evaluation report, has been prepared in Appendix 1 – B/R evaluation by clinical expert, highlighting the weighing of benefits against residual risks identified throughout the lifecycle of [Device short name]. This summary has been reviewed and approved by a clinical expert with experience in the medical field relevant to [Device short name]. The expert concluded that the benefits of [Device short name] outweigh the risks, taking into account the current state of the art.

Evaluation of overall B/R profile via labeling review to be removed if not applicable

As part of the risk management review, the risk management team assessed the user safety information provided in the Instructions for Use (IFU) and product labeling to ensure clarity, accuracy, and regulatory compliance. The team confirmed that:

• the level of priority assigned to safety information (e.g., harm, warning, precaution, comments) is appropriate,
• the information is sufficiently detailed and clearly presented,
• the placement of safety information within the documentation is adequate for user awareness,
• the wording and visual elements (e.g., symbols, pictograms) are clear and easily understandable, and
• the regulatory requirements related to labeling and IFU content are met.

Conclusion on the overall B/R profile

The risk management team has determined that the overall residual risk of [Device short name] is acceptable when weighed against its clinical benefits.

Production and Post-Production Methods

During the risk management review, the risk management team confirmed that appropriate methods for collecting and analyzing production and post-production data are in place.

The [Manufacturer short name]’s Quality Management System, through established procedures, ensures the detection of inputs to the risk management file when:

• new risks are identified,
• existing risks are affected, either due to changes in likelihood or severity,
• the continuous benefit-risk ratio is impacted.

Inputs to [Device short name]’s risk management file are derived from production and post-production data, collected through:

• production-related activities
  • nonconforming product management (procedure: XXX)
  • supplier evaluation (procedure: XXX)
  • supplier audits (procedure: XXX)
  • corrective and preventive actions (procedure: XXX)
• post-production activities
  • post-market surveillance (procedure: XXX)
  • post-market clinical follow-up (procedure: XXX)
  • customer complaints management (procedure: XXX)
  • vigilance activities (procedure: XXX)
  • servicing and maintenance (procedure: XXX)
  • field safety corrective actions (procedure: XXX)
  • customer feedback (procedure: XXX)
  • regulatory surveillance and compliance monitoring (procedure: XXX)
  • clinical evaluation report updates (procedure: XXX)

Conclusion

The risk management report is an integral part of the Design History File (DHF). Following the risk management review, the risk management team concluded that:

• the risk management plan (see Section 1.1) has been appropriately implemented,
• risks have been mitigated AFAP, and the overall residual risk is acceptable in relation to the benefits of [Device short name],
• the necessary methods for collecting and analyzing relevant production and post-production data are in place and effective.

Appendix 1 – B/R evaluation by clinical expert (remove if not applicable)