Risk Management Report (RMR) under IVDR

Risk management is crucial to ensure safety and proper operation of in vitro diagnostic (IVD) medical devices. The In Vitro Diagnostic Regulation (IVDR) 2017/746 stipulates the mandatory obligation of manufacturers to implement the systematic identification, evaluation and control of risks in the lifecycle of their medical devices. For this purpose, the international standard EN ISO 14971:2019 provides the recognized methodology for the effective risk management starting from the design and development up to the post market surveillance. Supporting the standard, the guidance document EN ISO/TR 24971:2020 gives detailed explanations and practical advice on the implementation of EN ISO 14971 in practice. When combined, IVDR, EN ISO 14971 and EN ISO/TR 24971 provide a unified approach that allows not only minimizing but also balancing the risk of harm against the expected clinical benefits.

Regulatory Basis For Risk Management

Article 10  General Obligations of Manufacturers

• According to Article 10(2), the manufacturer is required to “establish, document, implement and maintain a system for risk management as described in Section 3 of Annex I”.

• Additionally, Article 10 requires the quality management system (QMS) of the manufacturer to include risk management along with other aspects.

• The full text of Article 10 says that the manufacturers should also maintain the technical documentation up to date, manage modifications, conduct post market surveillance, vigilance, etc.

Therefore, Article 10 states that it is obligatory for manufacturers placing IVDs onto the EU market to have and maintain the risk management system and integrate it into the QMS.

Annex I - Core Requirements for Safety and Performance

Annex I of the IVDR contains General Safety and Performance Requirements (GSPRs)  , the comprehensive set of substantive requirements that the risk management should comply with.

The relevant parts of Annex I are mostly in Chapter I, Sections 1 to 8 covering general requirements and risk management.

Key Requirements for Risk Management in Annex I, Chapter I (GSPR Sections 1 to 8)

Some of the key obligations in Annex I related to the risk management are:

Risk Management Plan / Documentation

• The manufacturer is obliged to establish and document the risk management plan for each device.

• The risk management plan should describe the way how the risks are identified, analyzed, mitigated and reviewed in the lifecycle.

Identification and Analysis of Hazards

• All known and foreseeable hazards are to be identified (both arising during intended use and reasonably foreseeable misuse).

• For each of the hazards, the manufacturer should estimate and analyze the risks (i.e. the product of probability and severity).

Risk Control (Elimination / Mitigation / Residual Risk)

The risks should be eliminated or controlled in accordance with Section 4 of Annex I (risk control) using state of the art design, protective measures and information for safety (warnings, instructions).
The hierarchy of measures is as follows:

• Safe design / manufacture to remove or reduce risks where possible

•  Protective measures (alarms, guarding),

•  Information for safety (labelling, user instructions).

The residual risk (after taking measures) should be acceptable and the overall residual risk should be weighed against the benefits of the device. Even for the non unacceptable risks, the benefit risk analysis is to be performed.

Use related Risks and Human Factors

• The manufacturer is to consider the risks of use error including ergonomic factors, user knowledge/training, environment of use, etc.

• The design should take into account the characteristics of users (professional vs. lay users, education/training) and environment where the device is going to be used.

Lifespan / Durability / Stress / Storage / Transport

• The device should keep its safety and performance during its whole lifetime with respect to normal use, maintenance, environmental influences, storage and transport.

• The manufacturer should make sure that neither the transportation nor storage negatively affect the safety and performance of the device.

Post market Feedback and Updates

• The information obtained in the production and post market surveillance systems is to be assessed to identify the new hazards, new frequency, new risks, and changes in the benefit risk balance.

• Based on this assessment, the measures for the risk control are to be updated or amended where necessary.

Therefore, Annex I (especially its Section 3 and adjacent parts) defines the way how the risk management system is to operate (planning, identification, evaluation, mitigation, monitoring) in order to meet the GSPRs.

Key Requirements Under IVDR Article 10 And ANNEX I

• Article 10(9): requires the manufacturers to have the ongoing risk management process integrated into the QMS.

• Annex I, Section 3: obliges the manufacturers to eliminate or reduce the risks where it is possible using decisions taken during the design and manufacture.

• Annex I, Section 4: requires the remaining (residual) risks to be communicated to the users, e.g. in form of instructions, warnings or training materials.

• Annex I, Section 8: requires the device to be protected against mechanical and environmental hazards (impacts, temperature, humidity).

Interaction With Harmonized Standards (E.G. EN ISO 14971:2019)

While IVDR does not require any particular standard, EN ISO 14971 (risk management for medical devices) is widely accepted as a state of the art methodology that may comply with the regulatory requirements, including IVD domain.

• Many manufacturers use EN ISO 14971 (or its deviations/interpretations) as the risk management methodology in the company and make sure that the implementation complies with the IVDR specific requirements (e.g. the benefit risk evaluation of all risks, not only the unacceptable ones).

• EN ISO/TR 24971:2020 provides the guidance on the implementation of EN ISO 14971 in medical devices; Annex H of EN ISO/TR 24971 gives the guidance for IVDs.

Therefore, the IVDR regulatory basis is usually implemented by making the internal risk management methodology (commonly EN ISO 14971) to comply with the IVDR legal and specific requirements.

En ISO 14971:2019 Fundamental For Risk Management

EN ISO 14971:2019 is a recognized international standard for managing risks relating to medical devices and in vitro diagnostic (IVD) devices. It is a structured, lifecycle oriented process that aligns with the risk management obligations in the EU IVDR.

Process elements specified in Clauses 4 to 10 include:

• Risk Analysis (Clause 5)
  Identify known and foreseeable hazards, define the potential cause and evaluate the risk (probability and severity).

• Risk Evaluation (Clause 6)
  Evaluate whether a risk is acceptable, considering pre defined criteria.

• Risk Control (Clause 7)
  Implement the control measures for reducing risks to acceptable levels and verify them.

• Evaluation of Overall Residual Risk (Clause 8)
  Analyze the overall residual risk of the device after application of all controls and check if the overall benefit risk ratio is satisfactory.

• Production and Post Market Monitoring (Clause 10)
  Implement a mechanism to gather data about production and post market performance (feedback, complaints, vigilance) and incorporate it in the risk management process.

Definition And Scope Of Risk Management Under IVDR

Under the IVDR framework, risk management is not limited to purely technical hazards, but also encompasses clinical, biological, usability (human factors), and software related risks. In other words, manufacturers must consider a broad range of risk types when implementing risk management.

It is an obligation valid through all stages of the device lifecycle:

• Design & Development: Anticipate and identify the potential hazards both from intended use and misuse.

• Manufacturing & Production: Make sure that the device will be manufactured in a consistent manner with preventive controls in place so as to avoid deviations/defects posing any risk.

• Post Market Stage: Monitor the actual use (through post market surveillance and vigilance), identify the new safety/performance issues and evaluate their impact on risk profile.

For this reason, risk management according to IVDR must be lifecycle oriented. The manufacturer should keep and update the risk management file (or system) depending on new data (e.g. adverse event reports, field complaints, performance issues). The changing environment of usage, or environmental conditions, or user interaction means that some of the initial risk assumptions or controls might require revisions.

The lifecycle oriented risk management is consistent with EN ISO 14971:2019 that clearly states that the risk management process is valid for all stages of the medical device lifecycle (Clause 4).

Structure Of The Risk Management Report (RMR)

A well prepared Risk Management Report (RMR) required by Clause 9 of EN ISO 14971:2019 incorporates the results of the risk management process and constitutes a core element of the technical documentation for the internal review as well as external audits performed by notified bodies or regulatory authorities.

Typical structure of a compliant RMR includes:

Device Overview and Intended Purpose

• Short description of the medical or IVD device, including its intended medical use, target population, users and environment of use.

Reference to the Risk Management Plan

• Link or citation to the risk management plan (according to Clause 4.4 of EN ISO 14971) with description of its scope, responsible persons, criteria for risk acceptability and used method.

Summary of Risk Analysis and Hazard Identification

• Important results of the risk analysis stage, i.e. hazards identified, their causes, sequences of events that can lead to harm and the evaluated risk level.

Risk Control Measures and Effectiveness Verification

• Description of measures taken to mitigate the identified risks and evidence (e.g. test results, design validation) of their effectiveness.

Evaluation of Residual Risks and Benefit Risk Justification

• A comprehensive evaluation of the residual risks after applying risk controls and proof of the favorable overall benefit risk ratio (Clause 8 of EN ISO 14971).

Links to the Other Documents in the Technical File

• Connection to the supporting documents in the technical file, such as the clinical evaluation report (CER), post market surveillance (PMS) plan, usability engineering documents.

Conclusion on Risk Acceptability

• Declaration whether the device fulfills the manufacturer's criteria for risk acceptability and it is safe for its intended use.

Integration With Other Technical Documentation

Conclusion

The risk management process under IVDR 2017/746 and EN ISO 14971:2019 is much more than just regulatory requirements. It is a consistent and evidence based process intended to protect the patients and provide reliable performance of the device. Application of the additional guidance of EN ISO/TR 24971, keeping the risk documentation clear and updated and making links between the results of risk management and clinical evidence, performance evaluation, post market surveillance and user information creates the whole compliance picture. This not only ensures the legal compliance but increases confidence of regulators, notified bodies, healthcare professionals and the wider market.

How We Can Help

At Morulaa, we help global medical device and IVD manufacturers to manage the regulatory complexity of IVDR (EU 2017/746) and EN ISO 14971:2019 risk management through developing and maintaining the compliant risk management framework, creating the technical documentation prepared for the audit and aligning the risk files with the clinical evidence, performance evaluation, PMS plans and labeling. Our experts conduct the gap assessment, implement corrective measures in order to comply with Annex I and XIII, set up the post market surveillance and vigilance systems in order to keep the risk management up to date. We also assist our clients outside Europe in registration and distribution setup in India, the USA and other key markets. By working with Morulaa, manufacturers will not only comply with the regulatory requirements but will build their trust with regulators, notified bodies, healthcare professionals and the wider market.