If you’re in the business of developing medical devices, then risk and risk management become synonymous with daily operations. Your overall task is to bring a medical device to market that not only provides a needed function to a patient but is also proven to be safe and effective to use. A product that may be used by someone who is near and dear to you, too.
Risk management is a process that is very much here to stay in the medical device industry. On the product side of risk, ISO 14971 continues to be the cornerstone of identifying, assessing, evaluating, and controlling risks as a means to ensure medical devices are as safe and effective as possible.
FDA also works to ensure stronger risk management by requiring manufacturers of medical devices to have clearly documented procedures for corrective action and preventive action (CAPA). So how does CAPA play a role in product risk management?
Many CAPAs will impact medical device products in some way, shape, or form. Whether addressing a design issue, how the device is used, dealing with specifications, or manufacturing processes, CAPA actions need to consider and address risk management.
And it’s not enough to just check a box on a CAPA form. Addressing risk requires reviewing documented product risk management to determine if the issues within the CAPA are defined accurately. If not, then update your risk management accordingly.
From a product side of risk management, this interaction with CAPA is so important. ISO 14971 establishes risk management as a total product life cycle process. However, many do not truly keep their risk management files up to date and current.
Another risk concept that was formally introduced to the medical device industry with the publication of ISO 13485:2016 is “risk-based QMS.” What does this mean and how does this relate to CAPA?
Yes, it’s true that ISO 13485:2016 does make reference to ISO 14971. And from the product side of things, that makes complete sense. The references also infer that a risk management process and framework is well-defined and well-established by ISO 14971 and that this framework is also applicable to your QMS.
CAPA is largely regarded as one of the most important quality system elements. From my perspective, the concept of a risk-based CAPA process becomes foundational to the health and success of your medical device company. There are a lot of factors to consider with respect to applying risk concepts to CAPA.
Risk-based decision making is almost approaching cliche status these days. However, your CAPA process should incorporate the concept of risk-based decision making from the moment you learn of a quality event (such as a complaint or nonconformance).
Does the quality event require a formal CAPA investigation? This is an example of risk-based decision making. Once a CAPA request is submitted, then the decision whether or not to proceed with a CAPA should also be a risk-based decision.
After a request is accepted as a formal CAPA, then identifying the priority and urgency are also important and also should be risk-based decisions.
Ensuring all products, processes, and sources are identified within a CAPA are key risk elements. In other words, when you issue a CAPA, don’t be too myopic; consider if the issue to be addressed is also prevalent with other products and processes. Be holistic. Taking this approach could actually reduce the volume of CAPAs and be a way for you to shift to being proactive, rather than reactive.
Drilling down and identifying root cause is also a risk-based approach. If you do a poor job with root cause, then the issue has a likelihood of happening again.
Once root cause is determined, then the actions you take are key to controlling, reducing, and mitigating risks. The actions you take, however, are directly related to the identified root cause.
Upon completion of actions, you will need to verify the effectiveness of those actions. This verification step is very crucial because this should be when you determine and confirm, with objective evidence, that the CAPA has been addressed successfully.
To say it another way, your entire CAPA process should be entirely risk based, from the moment a request is made until you have verified the effectiveness of the actions taken. Updating your process like this will undoubtedly boost the success of your medical device, and consequently the future of your business.
