From Alzheimer’s to Zebrafish: Eclectic Science and Regulatory Stories 78
“When conducting a risk analysis manufacturers are expected to identify possible hazards associ-
ated with the design in both normal and fault conditions. The risks associated with the hazards,
including those resulting from user error, should be calculated in both normal and fault conditions.
If any risk is judged unacceptable, it should be reduced to acceptable levels by appropriate means.”
The above statement from the US Food and Drug Administration (FDA) appears in the
comments section (the preamble) that precedes the Quality System Regulation (QSR)
published as a final rule for current Good Manufacturing Practices for medical devices.1
This statement is more broadly worded than 21 CFR Section 820.30(g), where risk analysis
is included in the design validation section. The regulation itself merely states that design
validation shall include software and risk analysis, where appropriate. Moreover, there is
no mention of risk analysis, risk assessment, risk management or risk control in the defini-
tions section or anywhere else in the QSR. Thus, device manufacturers may conclude
that they have performed a risk analysis without considering all that is required by the
preamble or included in the guidance document issued on 11 March 1997.2
Fortunately, most manufacturers in the US understand that they can rely on ISO
14971:2007, an international standard written to specifically address all processes for man-
aging risks and to develop and maintain a risk management system.3 In addition, there is
a Global Harmonization Task Force (GHTF) document that describes general principles of
a risk management system.4 FDA actively participated in the development of ISO 14971
and endorsed its use. FDA also led the effort to provide the GHTF guidance document on
risk management.5 The latter refers to the standard when defining risk management as the
systematic application of management policies, procedures and practices to the tasks of
analyzing, evaluating and controlling risk.
In essence, risk management is an approach or process designed to minimize risks.
FDA uses risk-based approaches to prioritize and focus on various activities concern-
ing the oversight of Good Manufacturing Practice (GMP) requirements for human drug,
biological and veterinary drug product quality. The agency also provided a broad frame-
work for incorporating human factors engineering approaches into a risk management
process in a guidance document issued in 2000.6 It is evident that risk management has
become the underlying theme or bedrock of FDA regulation in the 21st century.
Much of the work related to managing the risks of FDA-approved products was
begun by former FDA Commissioner Jane Tenney, MD. She established a task force to
assess risk management practices within the overall healthcare system. The task force
reviewed the agency’s premarketing risk assessment and approval processes to determine
whether serious adverse effects were occurring at a higher rate than in the past. Then the
task force evaluated postmarket surveillance and risk assessment programs to ascertain
their effectiveness. Finally, it analyzed all of FDA’s risk management activities to evaluate
their role in the overall system for managing medical product risks. The agency recog-
nized that medical products are developed and used within a complex system involving
the following key participants: manufacturers who develop and test products and submit
applications for their approval to FDA the agency, which has an extensive premarketing
review and approval process and uses a series of postmarketing surveillance programs to
gather data and assess risks other participants in the healthcare delivery system, includ-
ing practitioners and patients, who rely on the ability of this complex system to provide
them with needed interventions while protecting them from injury. The final report of the
task force was issued in 1999.7 While the agency’s pre- and postmarketing review pro-
grams were deemed to be efficient, the task force recommended increased emphasis on
the quality assurance of the premarketing review programs and expansion of the postmar-
keting programs.
Considering the above responsibilities faced by manufacturers, it is extremely impor-
tant for regulatory professionals to become conversant with all facets of risk management
and understand its provenance. This article reviews the early history of risk calculation
“When conducting a risk analysis manufacturers are expected to identify possible hazards associ-
ated with the design in both normal and fault conditions. The risks associated with the hazards,
including those resulting from user error, should be calculated in both normal and fault conditions.
If any risk is judged unacceptable, it should be reduced to acceptable levels by appropriate means.”
The above statement from the US Food and Drug Administration (FDA) appears in the
comments section (the preamble) that precedes the Quality System Regulation (QSR)
published as a final rule for current Good Manufacturing Practices for medical devices.1
This statement is more broadly worded than 21 CFR Section 820.30(g), where risk analysis
is included in the design validation section. The regulation itself merely states that design
validation shall include software and risk analysis, where appropriate. Moreover, there is
no mention of risk analysis, risk assessment, risk management or risk control in the defini-
tions section or anywhere else in the QSR. Thus, device manufacturers may conclude
that they have performed a risk analysis without considering all that is required by the
preamble or included in the guidance document issued on 11 March 1997.2
Fortunately, most manufacturers in the US understand that they can rely on ISO
14971:2007, an international standard written to specifically address all processes for man-
aging risks and to develop and maintain a risk management system.3 In addition, there is
a Global Harmonization Task Force (GHTF) document that describes general principles of
a risk management system.4 FDA actively participated in the development of ISO 14971
and endorsed its use. FDA also led the effort to provide the GHTF guidance document on
risk management.5 The latter refers to the standard when defining risk management as the
systematic application of management policies, procedures and practices to the tasks of
analyzing, evaluating and controlling risk.
In essence, risk management is an approach or process designed to minimize risks.
FDA uses risk-based approaches to prioritize and focus on various activities concern-
ing the oversight of Good Manufacturing Practice (GMP) requirements for human drug,
biological and veterinary drug product quality. The agency also provided a broad frame-
work for incorporating human factors engineering approaches into a risk management
process in a guidance document issued in 2000.6 It is evident that risk management has
become the underlying theme or bedrock of FDA regulation in the 21st century.
Much of the work related to managing the risks of FDA-approved products was
begun by former FDA Commissioner Jane Tenney, MD. She established a task force to
assess risk management practices within the overall healthcare system. The task force
reviewed the agency’s premarketing risk assessment and approval processes to determine
whether serious adverse effects were occurring at a higher rate than in the past. Then the
task force evaluated postmarket surveillance and risk assessment programs to ascertain
their effectiveness. Finally, it analyzed all of FDA’s risk management activities to evaluate
their role in the overall system for managing medical product risks. The agency recog-
nized that medical products are developed and used within a complex system involving
the following key participants: manufacturers who develop and test products and submit
applications for their approval to FDA the agency, which has an extensive premarketing
review and approval process and uses a series of postmarketing surveillance programs to
gather data and assess risks other participants in the healthcare delivery system, includ-
ing practitioners and patients, who rely on the ability of this complex system to provide
them with needed interventions while protecting them from injury. The final report of the
task force was issued in 1999.7 While the agency’s pre- and postmarketing review pro-
grams were deemed to be efficient, the task force recommended increased emphasis on
the quality assurance of the premarketing review programs and expansion of the postmar-
keting programs.
Considering the above responsibilities faced by manufacturers, it is extremely impor-
tant for regulatory professionals to become conversant with all facets of risk management
and understand its provenance. This article reviews the early history of risk calculation