Rising Risk: Why Many Medical Device Companies Are In Danger of Risk Analysis Missteps

Risk analysis is crucial for ensuring safety and efficacy, but a recent survey of 100 medical device development and quality leaders revealed that many lack confidence in their current risk analysis processes.

Medical device development companies often rely on disconnected spreadsheets and outdated methodologies for managing risk analysis data. However, as standards and regulations evolve and the complexity of risk analysis increases, device development companies must ensure their approach to data management keeps pace. Those that continue to rely on traditional practices face an increased risk of product safety and quality problems, and are more likely to experience complications with regulatory submissions and FDA audits.

Why is a spreadsheet-based approach so risky when it comes to managing risk analysis data? I’ve worked in the medical device industry for more than 10 years, and one of my top priorities has been aligning medical device innovation with the constantly evolving standards and regulatory requirements, especially those related to risk analysis and risk management. As a result, I’ve had a front-row seat for observing just how limiting—and problematic—a spreadsheet-based approach can be. Three of the biggest problems relying on spreadsheets include:

1. Disconnected Data: Spreadsheets are built for static data, but the medical device design process requires constant shifting and adjusting for new inputs and variables. As a result, with a spreadsheet-based approach, it is difficult to maintain data consistency and integrity as designs evolve. Copying and pasting data within and across different spreadsheets can lead to disconnected and inconsistent information, which can—and often does—result in errors that jeopardize the quality of risk analysis.

2. Limited Context: Medical device risk analysis involves complex contextual relationships, such as hazards that cause multiple harms or hazardous situations originating from various sequences. Spreadsheets cannot capture and maintain these complex associations automatically. This, of course, can lead to less comprehensive and less accurate risk analysis.

3. Insufficient Collaboration: Although spreadsheets can enable multiple users to collaborate simultaneously (which is critical in device development), spreadsheets lack built-in version control and audit trails. This increases the likelihood that collaborators will make edits and changes simultaneously, leading to errors and preventing adequate historic data mapping over the design process. With spreadsheets, the very thing that can make medical device development successful—strong collaboration across teams—can also be the source of risk analysis errors. 

A Widespread Problem: Device Development Company Leaders Report Low Confidence in Current Risk-Management Processes

While a spreadsheet-based approach results in significant limitations, a recent national survey of 100 medical device development company quality leaders revealed just how prevalent the approach is when it comes to overall risk management (of which risk analysis is a crucial component).

The survey, conducted in November and December 2023, found that 70% of medical device companies still use manual documentation and spreadsheets for risk management during the design process.

The survey, commissioned by Cognition Corporation and conducted independently by healthcare consultancy Sage Growth Partners, also found that less than one-quarter of respondents (23%) are very satisfied with their current risk management practices.

The survey findings indicate that the general dissatisfaction with risk management processes overall is also translating to low confidence related to the integrity of risk analysis data. Only one-third of survey respondents (33%) said they feel very confident about the integrity of that data.

A Better Way: Improving Risk Analysis with a Modernized Approach

I recently worked with Natalie McRoberts, a risk analysis expert with more than 25 years of experience in the medical device and in-vitro diagnostic industries, to further explore the limitations of a spreadsheet-based approach, as well as the opportunities posed by a more “modernized approach” to risk analysis.

Our recommendations are further explored in our report: “Modernizing the Approach to Risk Analysis in Medical Device Development.” In the report, we describe how and why medical device companies should transition to a device design control software platform designed to support the medical device risk management requirements defined in ISO 14971, and that can be integrated with design and test data.

The most effective platforms provide numerous benefits when it comes to risk analysis, including:

1. The ability to adjust and accommodate dynamic data rather than being built for static data. As a result, data remains connected and consistent—regardless of where and when changes occur. This is highly desirable by quality and regulatory teams.

2. Built-in version control, audit trails, and more. For example, platforms should include workflow features that support data review and approval, preventing accidental modifications.

3. Seamless integration of design and test data. This enables robust traces between tasks, controls, requirements, and tests, ensuring complete traceability.

Tips for Finding the Right Partner

If your organization is ready to explore alternatives to a spreadsheet-based approach, it’s critical to conduct your due diligence, as not all partners are equally effective. In fact, as standards and regulations have evolved over the past few years, we’ve experienced an uptick in demand from medical device development companies that are seeking to transition to Compass because their current device development platform partners can no longer support their needs. The best platforms are purpose-built to align with regulatory standards for medical devices.

How can your organization ensure it is selecting an optimal platform partner? First, it’s critical to find a platform that provides the three capabilities noted above. You should also seek out a partner that:

• Has been designed specifically to leverage regulations such as 21 CFR 820.30 and standards ISO 13485, and IEC 62366.

• Provides built-in workflows that enhance cross-functional collaboration via defined roles, review processes, and approvals.

• Offers a configurable risk management process built specifically for medical device development.

• Offers a templated approach to risk management, guiding the user with simple questions and using the answers to auto-populate risk analysis tables.

• Enables comprehensive linkages between requirements, risks, and tests, which will help your organization easily consider risk early in the design process, provide an audit trail, and be very helpful with audits overall.

• Has the ability to embed global and/or regional regulations and standards to guide users through the risk analysis process.

• Guides users through the process of creating a risk management plan, preliminary hazard analysis, use error analysis, design FMEA, and a product risk analysis.

• Tightly integrates risk management, requirements management, and test management to enable real-time assessment of the impact of every change across every function.

As medical device companies seek to bring new products to market more safely and efficiently, ensuring an optimal approach to risk analysis must be a top priority. Over the next few years, the companies that emerge as leaders will have incorporated a modernized approach with the above capabilities.