1、Risk management for IVDsPart 3: Reducing and controlling risks to patientsDonald M. PowersThe first two articles in this series discussed the significance of risks from IVD devices, emphasized the importance of risk management planning, and explored ways to apply the risk analysis principles of ISO

2、14971.1,2 This third article covers the risk reduction and control phase of ISO 14971.3 Controlling Risks to PatientsA visit to a modern clinical laboratory provides ample evidence of the risk control practices that IVD manufacturers have employed: electronic monitoring systems, integrated procedura

3、l controls, fail-safe error messages, automated calibration, refrigerated onboard reagent storage, bar coded labels, and explicit warning stickers. Whether such risk control features originated from planned risk management activities or corrections of unexpected failures, many of these features were

4、 commonplace well before risk management came into vogue.4 Regardless of the motivation, their main purpose is to reduce the risks to patients from incorrect IVD test results. As stated in the preamble to the U.S. quality system regulation, FDA expects manufacturers to reduce risks to an acceptable

5、level.5,6 The European Unions IVD Directive goes further by requiring manufacturers to reduce risks as far as possible, and to select risk control measures in the following order: inherent safety by design, protective measures in the device or the manufacturing process, and information for safety.7T

6、he previous articles in this series discussed ways that IVD manufacturers can identify hazards and estimate their risks.2 If risk analysis determines that the risk from a possible failure mode is negligible, further risk reduction is not necessary. For the remaining risks, ISO 14971 outlines a logic

7、al sequence of risk control stages that manufacturers must follow to conform to the standard (see Figure 1). These stages are intended to be checkpoints to promote systematic decision-making and ensure that IVD manufacturers document their risk management decisions for future reference. A justificat

8、ion for each decision must be included if the rationale is not obvious. Figure 1. Risk control stages. Source: ISO 14971:2000.Analyzing Risk Control Options The first stage is a comprehensive analysis of risk control options, which enables IVD manufacturers to select the most appropriate control mea

9、sures for each specific risk. Manufacturers can do little to reduce the severity of harm, since that depends mainly on the medical actions taken in response to the IVD test results. For most IVDs, manufacturers can only reduce the probability that harm will occur.ISO 14971 adopted the three-level hi

10、erarchy of risk control options from the IVD Directive, thereby placing the emphasis on mitigating risks through design whenever practicable. To show that the risk control measures were selected according to the prescribed priority hierarchy, IVD manufacturers must document that the options availabl

11、e to reduce each risk were identified, classified according to the hierarchy, and evaluated for technical and economic feasibility. Several standards from the International Organization for Standardization (ISO; Geneva), the International Electrotechnical Commission (IEC; Geneva), the European Commi

12、ttee for Standardization (CEN), and the Clinical and Laboratory Standards Institute (CLSI; Wayne, PA) address safety aspects of IVDs. A few standards (e.g., IECs new usability standard for medical devices) integrate elements of the risk management process.8 When appropriate, IVD manufacturers should

13、 consider such standards as options to control identified risks, since conforming to a recognized standard generally conveys a presumption of risk acceptability. Inherent safety by design for an IVD assay means its performance characteristics and reliability meet the medical requirements of its inte

14、nded use. The components that affect specificity, precision, stability, and traceability are the keys to improving analytical performance, while sound hardware and software design features can prevent instrument-generated spurious results and enhance the uptime of electromechanical systems. In addit

15、ion, automation can eliminate the potential for human error, bar coding can ensure the proper identification of patients, samples, or reagent lots, and attention to human factors can simplify procedures and eliminate causes of error. Protective measures reduce the probability that incorrect results

16、will be reported to physicians or patients. Examples of protective measures include fail-safe software, which results in error messages instead of incorrect results, and fault-tolerant systems, which continue to operate correctly after a fault occurs. Instrument-based controls are now commonplace in

17、 IVD systems, and quality control testing has been integrated into many assays.9 Other examples of protective measures are in-process tests that detect defects introduced in the manufacturing process and final-release tests that verify conformance to performance specifications. Information for safet

18、y is the labeling, which includes operating instructions and other information to avoid risks. Historically, IVD manufacturers have relied heavily on labeling to help clinical laboratories avoid generating hazardous results. However, adding new instructions or precautions without first attempting to

19、 eliminate the failure causes or to incorporate protective mechanisms is contrary to the philosophy of ISO 14971. The standard reminds manufacturers that “information for safety is the least preferred method of risk control measure, to be used only when other risk control measures have been exhauste

20、d.” Risk management experts allow a risk reduction of no more than one level on the probability scale from labeling or training. Although mandatory training programs designed to reduce risks can sometimes achieve greater risk reduction, training alone is seldom effective in eliminating errors.10IVD

21、manufacturers often overestimate the ability of laboratory quality control (QC) procedures to detect incorrect test results. When delegating risk controls to clinical labs, design engineers must make assumptions with caution. While a manufacturers QC recommendations may provide helpful advice, there

22、 is no assurance that labs will follow them. In order to qualify as a protective measure, a QC procedure would have to be an integral part of the assay procedure. The IVD guidelines in annex H of the second edition of ISO 14971, which has recently been advanced to a final draft international standar

23、d, make it clear that an IVD manufacturers recommended QC procedures, as well as recommended confirmatory tests, are only considered information for safety.11 Warnings also have limited effectiveness as a risk reduction measure and should be considered as a last resort. The pressure to avoid calling

24、 attention to an assays shortcomings in a package insert has all too often led to vague, innocuous statements that would not pass an objective test for effectiveness. The revised ISO 14971 will include a new annex titled “Information for Safety and Information about Residual Risk,” which provides gu

25、idance on using information for safety as a risk control measure and promoting true awareness when disclosing residual risks.11 Implementing Risk Control MeasuresThe risk control implementation stage begins once an IVD manufacturer decides which options yield the greatest risk reduction. Often, more

26、 than one risk control approach is needed. Manufacturers have to verify each risk control measure twice, first to document that it was implemented correctly, and then to verify or validate its effectiveness in reducing the risks to the desired level. IVD manufacturers should set up risk management d

27、ocumentation to ensure clear traceability from each identified hazard and hazardous situation to the associated risk control measures. While manufacturers are able to verify some hardware- and software-based risk controls individually through fault injection techniques, a means of testing and evalua

28、ting fault-tolerant systems,12 most will demonstrate the cumulative risk reduction from multiple control measures during design validation. Evaluating and Disclosing Residual Risks Risks are rarely eliminated completely. Risks that remain after a manufacturer has implemented all risk control measure

29、s are called residual risks, which must meet the acceptability criteria in the risk management plan. Confirming that the residual risks from each hazardous situation have been reduced to an acceptable level is a pivotal checkpoint in the risk control process. If the acceptability criteria are met, t

30、hen manufacturers must determine what information to include in the labeling to disclose the residual risks. They must also consider the comprehension level of end-users and the detail that users need in the labeling to make informed decisions. If the acceptability criteria are not met, then risk re

31、duction efforts continue until further reduction is not technically or economically feasible. If the risk acceptability criteria are still not met, an IVD manufacturer must either abandon the project or justify it based on a risk-benefit analysis. ISO 14971 recognizes that end-users need to be aware

32、 of the residual risks in order to manage them. Such disclosure involves providing the information necessary to understand the residual risks and minimize exposure to the hazards.In IVD labeling, the information in the “Limitations of the Method” section is an example of residual risk disclosure. Th

33、is part of the labeling contains information such as drug interferences that the IVD manufacturer could not eliminate. Disclosure of drug interferences is not a risk control, since laboratories do not have any practical means to monitor the presence of drugs in specimens. However, in the spirit of I

34、SO 14971, IVD manufacturers should opt to disclose these residual risks only after their efforts to eliminate the interferences prove unsuccessful. The information in the “Performance Characteristics” section is another example of residual-risk disclosure. With such information, a lab director can m

35、ake informed decisions about whether a particular assay will be useful for its intended medical purpose. The details about how IVD manufacturers control specific risks are becoming more important with the advent of equivalent quality control.13,14 This concept allows a laboratory to build on a manuf

36、acturers risk controls and design a holistic quality control program. This requires knowing not only the circumstances that can lead to incorrect results but also the internal control mechanisms that can detect or suppress them.15,16Although in principle an IVD manufacturer is responsible for decidi

37、ng what information is necessary to include in the product labeling, in practice much of the content has already been decided by labeling regulations and standards.1720 Several examples of prescribed information for safety are intended to help laboratories avoid common use errors (see Table I).Table

38、 I. Information for safety to avoid potentially hazardous use errors. Source: ISO/DIS 14971:2005, annex H.Performing Risk-Benefit AnalysisA risk-benefit analysis is required when efforts to reduce residual risks to acceptable levels have failed, yet the IVD manufacturer believes the product is still

39、 worthwhile. Unfortunately, while methods for estimating risks with reasonable confidence exist, a standardized approach to estimate the benefits has not been developed. ISO 14971 acknowledges that risk-versus-benefit decisions are largely matters of judgment by experienced and knowledgeable individ

40、uals. Some guidance for conducting risk-benefit analyses is included in annex D.6 of the draft second edition of ISO 14971. Risk-benefit analyses of individual residual risks are difficult and provide at best only enough information to decide whether to proceed with a design project. Having reduced

41、each individual risk in an iterative manner until it is either acceptable or irreducible, any residual risks that remain outside the acceptability criteria require a decision whether to proceed with the project. If it is obvious that an individual risk is irreducible and will jeopardize an IVD manuf

42、acturers ability to meet the overall acceptability criteria or to provide a product with medical benefits that outweigh its overall residual risks, the development project may be stopped. Outside clinical consultation often helps in making this judgment. If the answers are not obvious, the project w

43、ill usually continue. Addressing Risks Resulting from Risk Control MeasuresOccasionally, implementing risk control measures creates new hazardous situations. For example, a proliferation of warning labels can confuse laboratory operators and desensitize them to hazard warnings. Similarly, an overly

44、complicated set of instructions may be difficult to follow without errors. There are also abundant examples in the recall literature in which actions intended to reduce risks inadvertently created new hazards. IVD manufacturers must review the results of the risk control phase to avoid increasing ri

45、sks. In some cases, IVD manufacturers may introduce a new hazardous situation intentionally as the lesser of two risks. For example, an instrument programmed to give an error message when a fault occurs is trading off the risk from a delayed result against the risk from a possible incorrect result.

46、The actual degree of risk depends on how the test results are used. For self-testing glucose monitors, if a diabetic were not able to perform blood glucose tests in a timely manner because the meter malfunctioned, there is a chance of accidental overmedication with insulin, leading to hypoglycemic s

47、hock. While an error message may seem clearly preferable to an incorrect glucose result, manufacturers must estimate the risks created by a delay in availability of the results and evaluate them against the risk acceptability criteria. On the other hand, a delay in the availability of routine hospit

48、al laboratory test results while an automated instrument undergoes repairs is less likely to cause serious harm. Labs anticipate the need for service calls and are expected to have backup plans for lab tests that are urgent. Acceptability of the risks from delayed results is determined in each case

49、by a risk assessment. Verifying Completeness of Risk ControlA verification checkpoint in the risk control process was added as a safeguard against possible overlooking of any necessary risk control measures in the rush to launch a new product. IVD manufacturers are required to verify that they have

50、adequately addressed all hazardous situations identified in the risk analysis phase and any new ones created by the risk control measures.ISO 14971 also requires manufacturers to record the results of all risk control activities in the risk management file, including each decision to take or not tak

51、e action, every review and verification check discussed above, and the results of the risk reduction activities. This requirement reinforces the need for IVD manufacturers to establish a logical documentation system at the outset, with the necessary traceability to show that they have addressed all

52、hazardous situations and reduced all risks to acceptable levels. Evaluating Residual-Risk AcceptabilityEven after all the individual risks have been mitigated, there is still the question of whether the overall risk of using the IVD device will be acceptable. After documenting the reduction of each

53、individual residual risk, an IVD manufacturer compiles the information in a way that reveals the overall residual risk. The overall residual risk is the risk that remains after a manufacturer has implemented all risk control measures. The risk of using the device may not be acceptable because of the

54、 cumulative probability of serious harm from many low-probability failure modes. In that case, an IVD manufacturer must apply further risk control measures to make the overall residual risk acceptable. Estimating overall residual risk is more challenging than estimating risks from specific device fa

55、ilures, and up to now, little guidance has been available to help IVD manufacturers in evaluating it. A discussion of several possible approaches has been added to the second edition of ISO 14971 as annex D. Two tools described in this annex are particularly applicable to IVDs. In event tree analysi

56、s, multiple individual risks from a specific sequence of events can be considered together to determine if the overall residual risk is acceptable. In fault tree analysis, the combined probability of harm from several hazardous situations can be estimated from their individual probabilities. The out

57、put of a cause-consequence analysis, a blend of fault tree and event tree analysis, is a diagram for documenting and communicating relationships between risks and their initiating causes.21 For well-understood IVD assays, confirming that the overall residual risk is acceptable by performing a detail

58、ed risk-by-risk comparison to a comparable assay on the market may suffice. If manufacturers use this approach, they must ensure that information about risks of the comparable assay is up-to-date. Current product labeling and performance data can often be obtained from manufacturers Web sites or fro

59、m clinical laboratories. Peer-reviewed data from product evaluations and clinical experience are found in laboratory journals. In addition, a wealth of adverse-event experience, recalls, and summaries of product safety and effectiveness is available on the FDA Web site.22Another approach especially useful for evaluating the overall residual risk of new IVD systems is to engage application specialists (i.e., laboratory technologists) who are familiar with using similar devices. An i