A comprehensive description of the new requirements introduced by ISO 14971:2019 Application of risk management to medical devices and ISO/TR 24971 Technical Report for the FDA, MDR and IVDR

1. Risk Management Update
and Gap Analysis for
ISO 14971:2019
ISO/TR 24971:2020
Zafirios Gourgouliatos, Ph.D.
zafirislosangeles@gmail.com
310-422-9253
www.leilux.com

2. Forward
2
‣ This presentation assumes familiarity with previous standard:
• ISO 14971:2007 (Second Edition)
(or harmonized EN ISO 14971:2012)
‣ Before continuing, read (or browse) the current Standards
• ISO 14971:2019 (Third Edition) and
• ISO/TR 24971:2020 (New)
‣ Recommended:
• Access to an existing Risk Management File

3. Update Task
3
‣ There is an Existing Risk Management File/Report
created with
• ISO 14971:2007 (or EN ISO 14971:2012)
‣ That needs to be updated to Risk Management File/Review
according to
• ISO 14971:2019
• ISO/TR 24971:2020

4. Mandates and Deadlines
4
‣ MDR/IVDR: There is a mandate to use “State of the Art”
• This means “Use/accept the Latest Standards”
(actual guidance to Notified Bodies for reviews)
‣ MDR mandatory by May 26, 2021
‣ IVDR mandatory by May 26, 2022
• Updates to Technical Files will need to follow
the current Standards
• Notified bodies are backlogged and will need
extra time to review Technical Files (i.e. 18 months)

5. ISO 14971 Harmonization
5
‣ An ISO standard is approved and then published in
the Official Journal of the European Union
and becomes harmonized
• The ISO 14971:2007 was harmonized by the EU
(with minor changes) as EN ISO 14971:2012
• For all practical purposes and for most products
the 2007 and 2012 standards are identical
‣ The current ISO Risk Management standard
has not been EU harmonized yet (as of early 2021)

6. The Risk Management File
6
‣ Demonstrates that the “Risk” is properly managed
‣ When accepted by the notified body, it is concluded that:
the “Benefit/Risk Ratio” is acceptable
‣ The Risk Management Process has to address
the Clauses of the Standard
as applicable to the product
‣ ISO/TR 24971:2020 is the guidance on how to create
the Risk Management File (TR = Technical Report)

7. Risk Management Update Steps
7
‣ Buy or have proper access to the Standards
• ISO 14971:2019
• ISO/TR 24971:2020
‣ Perform Risk Management gap analysis
‣ Update your documentation:
• QMS - corresponding SOP’s, complete training
• Comply also with MDR/IVDR (update frequency)
• Finalize Risk Management File update
‣ File/Submit your updated Technical Files for review

8. Risk Management Update: Get Ready
8
‣ Read the new Standards (tedious but necessary)
• ISO 14971:2019 - Medical devices
— Application of risk management to medical devices
(35 pages)
• ISO/TR 24971:2020 - Medical devices
— Guidance on the application of ISO 14971:2019
(87 pages)

9. Risk Management Update: The Challenge
9
‣ Some Annexes of ISO 14971:2007 (or EN ISO 14971:2012)
have been moved to:
• ISO 14971:2019
‣ while other Annexes have been moved to
• ISO/TR 24971:2020
‣ ISO 14971:2019 has an (incomplete) key to these changes
‣ No correspondence has been provided for the
parts of ISO 14971:2007 that have been “moved”
to ISO/TR 24971:2020
‣ This presentation will give you the correspondence key!

10. Risk Management Update: Preparation
10
‣ Review the existing Risk Management File/Report
• Most likely it was created by someone else
(before you joined the company, no longer there)
• It may have issues even with the previous standard
• There may have been incomplete (annual) updates
• Check: Observations from audits – fully resolved?

11. Risk Management Update: Step 1
11
‣ Read ISO/TR 24971:2020, Annex G (Informative):
“Components and devices designed without using ISO 14971”
‣ This applies to:
‣ Products with Risk Management under ISO 14971:2007
‣ Products with no Risk Management process because:
• It was not needed at the time…
• But is needed now (i.e. Class I Medical Devices or IVD’s)

12. Risk Management Update: Step 2
12
‣ Draft a Risk Management Plan (or update existing Plan)
‣ The instructions for the Plan are detailed in:
• ISO 14971:2019, Section 4.4 Risk management plan
• ISO/TR 24971:2020 Section 4.4
(make sure the plan addresses all Sections: 4.4.1 to 4.4.8)
• If the product in the market already address “remaining life cycle”
‣ Advice:
• Create a draft of the Plan but do not finalize
• Review Plan while Risk Management update is under way
(avoid multiple Plan revisions)
• Synchronize new/updated Plan with updated Risk Management SOP

13. Risk Management Update: Step 3
13
‣ Create the Table of Contents for the updated
“Risk Management Review”
• Hint: You will have to at least read the ToC of ISO 14971:2019!
• Under ISO 14971:2007 it was called “Risk Management Report”
‣ Synchronize the numbering of the sections of your document with the
Clauses of ISO 14971:2019
• i.e. “5 Risk analysis” (same Section Title and Clause No.)
“5.1 Risk analysis process”
“5.2 Intended use and reasonably foreseeable misuse”
• it will help you not to get lost/frustrated and (most important)
• it will help the Notified Body reviewer

14. Risk Management Update: Step 4
14
‣ Review changes from previous to current Standard
‣ Annex B of ISO 14971:2019 “informative” shows:
‣ Changes in Numbering between the Standards
‣ Additions and Deletions
‣ Changes in nomenclature
‣ Annex correspondence between previous and current version
‣ Catch: it is a partial list of correspondence

15. Risk Management Update: Step 5
15
Part New or Changed Heading New Change
2 Normative references 
3.2 Benefit 
3.14 Reasonably foreseeable misuse 
3.28 State of the art 
5.2 Intended use and reasonably foreseeable misuse 
5.3 Identification of characteristics related to safety 
5.4 Identification of hazards and hazardous situations 
5.5 Risk estimation 
7.4 Benefit/risk analysis (Risk/benefit) 
8 Evaluation of overall residual risk 
Annex F Cyber and Data Security 
‣ Clause/Nomenclature additions and changes

16. Risk Management Update: Step 6
16
Section ISO 14971:2007 Section ISO 14971:2019
9
Production and post-
production information
10 Production and post-production
activities
10.1 General
10.2 Information collection
10.3 Information review
10.4 Actions
‣ Chapter/Clause Expansion - Detailing
‣ Note: Identify the effects of the changes to existing documentation
(this is beyond the scope of this presentation)

17. Risk Management Update: Step 7
17
‣ For Annexes A and B (they are for guidance, not requirements)
pay attention to changes and additions in the headings and text
Annex ISO 14971:2007 Annex ISO 14971:2019
A Rationale for
requirements
A Rationale for requirements
Pay attention to changes. i.e.:
A.2.4.3 Competence of personnel (new)
A.2.5.5 Risk estimation (expanded)
B Overview of the risk
management process
for medical devices
B Overview of the Risk management
process for medical devices
-
Figure B.1 (Flowchart)
B.1 Correspondence between second
and third editions (this presentation)
B.2 Figure B.1 (Flowchart - expanded)

18. Risk Management Update: Step 8
18
‣ Annex letter and heading change:
Like in the previous step compare the previous and current
Standard for any changes that may affect the documentation
Annex ISO 14971:2007 Annex ISO 14971:2019
E Examples of hazards,
foreseeable sequence
of events and hazardous
situations
C Fundamental risk concepts
Called by Section 4.4 Called by (renumbered) Section 5.4

19. Risk Management Update: Ooops!
19
The fun begins here:
‣ Annexes C, D, F, G, H, and J have been moved to
ISO/TR 24971:2020 but no further details are given!
Why?
‣ ISO/TR 24971:2020 was issued later on and…
good intentions were sidestepped for expediency
‣ It is… easier to update a TR than a standard

20. Risk Management Update: Step 9
20
ISO 14971:2007 ISO/TR 24971:2020
Annex C Annex A
Annex E Clauses 5.4 and 5.5 ofTR
(and Annex C of ISO 14971:2019)
Annex G Annex B
Annex J Clause 8 and Annex D
Annex I
(not deleted as shown)
Now in ISO 10993-1
(and Annex C of ISO 14971:2019
Part C.2,Table C.1)
The Annex correspondence between ISO 14971:2007
and ISO/TR 24971:2020 is given below – THE KEY

21. Risk Management Update: Step 10
21
‣ Address each question as applicable for your product
‣ Distinguish Requirements from Guidance
‣ ISO/TR 24971:2020 - Guidance, not a Requirement
‣ A few questions have been moved around, modified, or eliminated!
‣ For the most part, the “questions” (and sequence) in the new Annexes
are unchanged
‣ ISO 14971:2020 Annexes A, B, C - Guidance, not Requirements

22. Risk Management Update: Step 11
22
‣ Do your own due diligence for what is applicable to your
product and the details that need to be included in the
updated: Risk Management “Review”
‣ Every product and product family is different and certain
questions in the Annexes will not apply
‣ There are some new questions in the Annexes that
should be addressed in the update
‣ A great deal of attention is needed in:
production and post-production activities

23. Risk Management Update: Step 12
23
‣ With the key to the correspondence between the Annexes
now you can sort out the update tasks!
‣ Remember: Rename the new Table of Contents to follow
the names of the Chapters/Clauses of ISO 14971:2019
‣ Note: The “benefit/risk” analysis may require considerable
updates from the previous “risk/benefit” analysis
‣ Read carefully Section 7.4 Benefit/risk analysis of ISO 14971:2019
to identify what is needed
‣ Many subclauses may have the same or similar headings
but there have been changes in the rationale and content!
‣ (new definitions in 3.2, 3.3, 3.15, 3.28, 4, 4.1, 4.5, 5.4, 7.4, etc.)

24. Risk Management Update: Summary
24
‣ Once you have understood what the update will involve,
finalize the Risk Management Plan
‣ Go back to your updated Risk Management SOP and check
to make sure that it is synchronized with the Plan and the
applicable parts of the Standards
‣ Cross check with MDR/IVDR
‣ Approve/release the SOP and complete training before
releasing/approving the updated Plan

25. Conclusion
‣ This presentation has provided a key of the changes from
the previous ISO 14971:2007 (or EN ISO 14971:2012)
to the current ISO 14971:2019 and ISO/TR 24971:2020
‣ Use the key to
‣ Understand the changes
‣ Plan the update
‣ Complete the work
25

26. Leilux, Inc.
The Presenter
Zafirios Gourgouliatos, Ph.D.,
Biomedical Engineer and Regulatory Affairs Consultant
• Regulatory strategy, FDA preparedness for device companies
• 25 years of experience with Class II. Class III, and Active
Implantable Medical Devices (AIMD)
• MDD to MDR and IVDD to IVDR transition - QMS updates
• Leader of R&D and RA teams in medical device companies
26
‣ Please excuse the telegraphic presentation of the information
‣ Will appreciate your feedback for continuous improvement

27. 27
• This presentation has been put together to help colleagues with the often
daunting task of updating hundreds of pages and adding a lot of new material
in order to comply with current Risk Management requirements.
• The present regulatory situation may seem to be an overkill but there have been
industry failures that have resulted in unnecessary patient suffering and deaths.
• On the less emotional side, these failures have resulted to big liabilities and
financial losses for medical device companies.
• Compliance will lead to safer products and give better financial returns.
• A lot of material has been condensed in a few slides. Please excuse the short
hand mode. You are welcome to send me your questions.
Personal Note

28. Final Advice
‣ Read and understand the Standards
‣ Consider the reviewer on the other side,
make things easy for her/him
‣ Seek expert help - it will save time and money
28

29. www.leilux.com
QUESTIONS?
Zafirios Gourgouliatos, Ph.D.
zafirislosangeles@gmail.com
310-422-9253
Risk Management Update
and Gap Analysis for
ISO 14971:2019
ISO/TR 24971:2020