Premarket vs. Postmarket: Applying Risk Management to Your Device's Entire Lifecycle

Actively harvesting user complaints is a basic defense against unintended harm and product recalls.

G.M. Samaras

A manufacturer's obligation for product safety extends across the whole lifecycle--from concept to salvage and disposal. This concept holds true regardless of the industry.

How can timely recognition of product safety issues be achieved and successfully managed? The process is called risk management and is applied across the complete product lifecycle. The principle is enshrined in many well-recognized industry standards (such as, for medical devices, ISO 9001, ISO 13485, and ISO 14971) and is an engineering best practice. Correct application of lifecycle risk management is your primary tool for minimizing unintended harm, reducing product recalls, limiting product liability, and protecting shareholders.                  

Product Risk Management ? Financial Risk Management

The general approach to risk management is outlined in Figure 1. Risk is future uncertainty of the deviation from an expected outcome. In product risk management, we are only concerned with undesirable (unsafe) deviations. Risk is generally quantified as some combination of the severity of harm of the identified hazard and the frequency of occurrence of that identified hazard.¹

Nearly every senior executive understands financial risk management: "The identification, analysis, assessment, control, and avoidance, minimization, or elimination of unacceptable risks. An organization may use risk assumption, risk avoidance, risk retention, risk transfer, or any other strategy (or combination of strategies) in proper management of future events."²

But the strategies for financial risk management do not map well to product risk management; risk avoidance and risk transfer (from manufacturer to customer)³ ultimately result in unintended risk assumption and risk retention by the product manufacturer.

Furthermore, from a sales and marketing perspective (the background of many senior corporate leaders), if there is no consumables "tail" once the product is sold and delivered, there is strong motivation to shift focus to the sale of the next product, rather than focusing on managing risk for product already sold. This makes eminently good sense, but only from a myopic financial perspective. Sales and marketing move product; they are also the firm's principal interface for customer satisfaction and product safety information. They are essential for generating revenue, but also foundational for protecting that revenue by identifying complaints and supporting timely product lifecycle risk management. Motivate them to sell product and to acquire satisfaction and safety data. This will reduce delays managing product risks and the rapid response will reduce unintended harm, product recalls, and product liability.

Modern Western expectations and industry standards demand that manufacturers eliminate essentially all product safety hazards. But eliminating all is, by definition, an impossible task. What is possible is eliminating risks from hazards that can be identified during premarket development and manufacturing. But, this must be followed by rigorously and systematically searching for previously unrecognized hazards in the postmarket phase, until the product is replaced or disposed. This is the well-established "cradle-to-grave" risk management engineering best practice identified in international consensus standards and required by many federal agencies.            

Setting Boundaries

Identifying hazards requires an understanding of context. Engineers set boundaries followed by conducting worst case analyses to inform their design validation testing. Well-known examples of boundaries include operating ceiling and descent rate for aircraft, operating voltages and currents for electronic devices, and encapsulation for software components. Unbounded problems are eschewed by engineers because they are not generally amenable to closed solutions and product realization. It is this reason that operationalization(Operationalization means (a) defining what to measure, (b) defining how, and with what, to measure it, and (c) what measurement results in a pass or fail) of product requirements (design inputs) is crucial to engineering design. Carefully established boundaries reduce the complexity of product design and risk management, thus decreasing time to market. Not establishing clear boundaries results is arbitrary, and potentially undesirable, assumptions about the required boundaries.         

For medical devices, one important set of boundaries is defined by the intended use, the intended users, and the intended use environments. This constrains the context, but does not fully eliminate risk complexity. There are two types of product use errors: system use errors and individual user

A well-known example of an individual user error is driving while intoxicated. A well-known example of a system use error is the set of mistakes operators make as a result of a poorly designed interface. Hazards arise not only from how the device is designed, manufactured, and deployed, but also from how the device is used after it is sold. The manufacturer can reasonably expect intended use, novel use, misuse, and abuse of their device, as well as latent and drift errors from product development, manufacturing, and deployment processes.⁶ One cannot reasonably assume their product will be used exactly as they envision it. Ignoring the full spectrum of potential use errors in product risk management is not adequate, reasonable, or technically correct. It only delays effective internal risk management and invites external risk management in the form of product recalls and expensive lawsuits.

Elements of Risk Management

Managing product risk involves both administrative and engineering activities. There are administrative standard operating procedures that must be managed and reports that must document the required activities. However, the documentation only serves as evidence of the occurrence of engineering activities.⁷ You can envision five discrete engineering activities for risk management:

Risk management is well-described in standard texts and various consensus standards; what is not well described is the correspondence between premarket and postmarket risk management activities (see Table 1). Understanding the correspondence and nomenclature differences is an important element in promoting complete and correct product lifecycle risk management. Product risk management does not stop with the end of development and the beginning of sales; it stops when the product is no longer sold or used.

Table 1: Pre- vs. Post-Market Risk Management Activities
              

Premarket risk management generally uses terminology familiar to engineers. First, you have to identify a potential hazard. Then, you have to determine whether the hazard is affecting your specific product. Once you have accepted that a hazard is relevant, you have to evaluate the risk by determining (or estimating) the probability of the hazard occurring and the severity of the harm that can result. If you deem that risk is acceptable, then you accept the risk or you can attempt to transfer the risk to your customer; if you decide the risk is not acceptable, then you are obligated to implement an effective risk control measure. There are four types of premarket risk control measures:     

Once a candidate risk control has been agreed and implemented, you are obligated to verify or validate that the risk control (a) actually reduced the targeted risk and (b) did not create any new hazards; risk control verification or validation is always required, even if you chose to employ labeling or training.

Postmarket risk management is no different, except in the terms used. Complaint management (acquiring and analyzing complaints and other postmarket information) is foundational; it is your primary mechanism for getting information on potential previously unidentified hazards. A deficient complaint management system undermines all remaining postmarket risk management activities. Sentinel events are the occurrence (or the possibility of occurrence, such as from a "near miss") of unexpected events involving death or serious injury not related to the natural course of an injury or illness.8 Sentinel event recognition corresponds to premarket hazard recognition and is, by definition, an accepted hazard. Postmarket evaluation of the risk associated with this hazard is often called a "health hazard evaluation" and is used to determine whether risk control (corrective and preventive action; CAPA) is warranted. If you decide CAPA is not warranted, you are deciding to accept the risk. But, if you decide that a CAPA risk control is warranted, then the options include (a) redesign, (b) guarding, (c) transfer of risk control to the end-user using labeling or training, or (d) removal of the device from the market. As in the premarket situation, you have to verify or validate that the risk control (a) actually reduced the targeted risk and (b) did not create any new hazards.                  

The "PA" in CAPA includes public reporting, which is itself a validated risk control. It is a regulatory obligation in the United States and it is the means of informing the public of death or serious injury associated with the use of your product. It is a critical element in postmarket risk management that expands the risk management process beyond the manufacturer to external agencies. This crucial risk control is defeated by manufacturer reporting noncompliance.

Conclusion

Product lifecycle risk management is an engineering approach for increasing product safety and reducing unintentional harm, product recalls, and product liability. Unlike financial risk management, product risk avoidance and risk transfer ultimately result in manufacturer risk assumption and risk retention. The terminology used for premarket risk management and postmarket risk management differ, but the underlying engineering activities are the same. Not doing complete and correct premarket risk management undermines the viability of your product in the marketplace; not doing complete and correct postmarket risk management negates your premarket efforts and increases your firm's financial risk. Fundamental to successful postmarket risk management is an effective and efficient complaint management system. Motivate your primary connection to your customers--your sales personnel--both to sell your product and to quickly share with you user complaints and field observations. The commissions you pay will reduce unintended harms, reduce product recalls, protect your shareholders, and allow you to innovate new, improved products for everyone's benefit.

References                

1. Samaras, GM. Use, Misuse, and Abuse of the Device Failure Modes Effects Analysis. MD+DI Online (and later print Magazine August 2013).

2. http://www.businessdictionary.com/definition/risk-management.html Accessed 5/10/15.

3. Minimizing Type II errors (Producer Risk) at the expense of Type I errors (Consumer Risk).

4. Operationalization means (a) defining what to measure, (b) defining how, and with what, to measure it, and (c) what measurement results in a pass or fail.

5. Samaras, GM. Medical Device Mechatronics Maturity. Medical Electronics Design Online (and later print Magazine, January 2013).

6. Samaras, GM. Reducing latent errors, drift errors, and stakeholder dissonance. WORK: A Journal of Assessment, Prevention, and Rehabilitation, 41(s1):1948-1955 (2012).

7. Samaras, GM. The Use, Misuse, and Abuse of Design Controls. IEEE Eng Med Biol Magazine 29(3):12-18, 2010.

8. http://www.jointcommission.org/Sentinel_Event_Policy_and_Procedures/default.aspx Accessed 5/10/15. Samaras Manuscript "Medical Device Lifecycle Risk Management."

G.M. Samaras is a biomedical scientist and engineer in private practice (Pueblo, CO) since 1996. Trained as an electrical engineer, he has doctorates in physiology and industrial engineering. He has worked at the FDA as a reviewer and manager.