Risk Management’s “True Believers”

Demographics and product success drive increased risk, emphasis on risk management.

Marc Miller
Crimson Life Sciences

This is a true paradox: Success generally brings recognition, influence and prosperity. However, it also can mean unwanted exposure, scrutiny, and risk. In order to meet regulatory requirements and manage market exposure, orthopedic manufacturers must understand and implement effective risk management strategies in all areas that affect the quality system. —Marc Miller

Knowledge is to be acquired only by a corresponding experience.

Like many others in the United States and around the world, I am a true believer in the value of medical device technology and risk management. Why? Because I’ve experienced, first-hand, the benefits of both.

In October 2006, after 10 years of coping with decreasing mobility and increasing pain, I had a total left hip replacement. Risk management played an important part in the run-up to the procedure. Because of my relatively young age at diagnosis (32), my doctor advised me to defer surgery as long as possible—to enjoy technological advances and possibly avoid a future hip revision. With a move to Boston planned, I also considered the Northeast’s outstanding doctors and hospitals a further hedge.

Happily, my personal risk management strategy paid off. The implanted device was an advanced titanium/ceramic replacement—in use in Europe for a number of years but only recently available in the United States. Afterward, the attending physician, head of orthopedic surgery at Harvard, declared the procedure a complete success. I felt the truth of his statement almost immediately and now am able to enjoy chasing and wrestling my two young sons, which was impossible before the replacement surgery.

Personal example carries more weight than preaching.

If my story was unique, then it might be nothing more than a footnote in an orthopedic journal. However, given US demographic trends, it most certainly is not. In fact, nearly constant media coverage and numerous business projections all illustrate rapidly aging US and European populations. An aging population brings with it certain inevitable realities.

According to the US Department of Health & Human Services (Administration on Aging), the percentage of the US population 65 and older is due to increase from 12.4% (34.9 million) in 2000 to 20% (71.5 million) by 2030. An unpublished study by Harvard University (Trends in Medical Spending by Age: 1963-1999) illustrates that these older Americans will consume devices and other healthcare products at an accelerated rate. According to the Harvard study, individuals ages 65 to 74 have a per capita healthcare spending that is 300% higher than people 35 to 44 years old. For people older than 75, per capita healthcare spending jumps to more than 500% higher than the baseline 35-to-44 age group. The conclusion is simple: the older we get, the more we spend on healthcare—including medical devices. Total hip implants, one of the most common medical devices, is one area in which we can directly observe the accuracy of this statement.

The hip implant is among the most successful medical devices ever introduced and, in many ways, is emblematic of the industry in general. Specifically, an aging population in the United States, Europe and Japan means a growing market for replacement hips. The Academy of Physical Medicine and Rehabilitation projects the annual number of total hip replacements will increase by more than 60% in the next 30 years (from approximately 234,000 procedures in 2004). Gratefully, each of these procedures represents an opportunity for improved quality of life. However, each also represents potential patient harm and raises the industry’s “liability visibility” with the consuming public. Recent issues involving drug-eluting stents provide a striking example of liability visibility for medical devices.

In response to increased visibility and perception of risk, regulators in the United States and Europe often adopt more conservative approaches and interpretations in their work. Evidence of this can be found in the recent up-classification of hip implants to Class III. Clearly, the growing population of device consumers and the industry’s overall liability visibility are critical factors driving an increased emphasis on safety and risk management. This emphasis shows up in both regulation and practice.

Law is nothing other than a certain ordinance of reason for the common good…

Quality systems standards and regulations offer clear evidence of the growing importance of risk management. Here, governing standards such as ISO 13485:2003 and ISO 14971:2000 have codified a risk-based approach for every facet of a device company’s operations that touch the quality system.

ISO 13485:2003, the standard that governs quality system requirements in the medical device industry, requires manufacturers to practice considered risk management principles in all product realization activities. In fact, Section 7.1 of the standard (Planning of Product Realization) states:

“The organization shall establish documented requirements for risk management throughout product realization.

Records arising from risk management shall be maintained (see 4.2.4). NOTE 3—See ISO 14971 for guidance related to risk management.”

Other regulatory bodies, such as the Global Harmonization Task Force (GHTF), support this broad-based application of risk management. According to published GHTF guidance, Implementation of Risk Management Principles and Activities Within a Quality Management System (SG3/N15R8), top management has a responsibility to incorporate risk management into the entire organization—including policies for effective practices.

Guidance for effective risk management practices is provided by ISO 14971:2000 (Application of Risk Management to Medical Devices). The emphasis on risk management in general, and ISO 14971 in particular, was highlighted by the recent introduction of the industry’s first ISO 14971 registration service by Underwriter’s Laboratories. Dr. Harvey Rudolph, an original co-author of the standard, led the development of this first-ever certification.

Belief is measured by action…

While regulation certainly is the most visible indication, widespread industry practices also provide empirical evidence for the value of risk management. For instance, the growing importance of “quality system parity”—equivalent levels of certification between manufacturer and supplier—provides an instructive example.  

In recent years, medical device suppliers have benefited from the industry’s predilection for outsourcing, since this practice in the medical device industry has shown double-digit growth and has spawned trade publications entirely devoted entirely to its concerns. However, while powerful economic forces drive the growth of outsourcing, companies still are required to retain full responsibility for their risk management activities. Specifically, ISO 13485:2003 addresses this responsibility when it states:

“The processes required by this International Standard, which are applicable to the medical device(s) [and IVDs], but which are not performed by the organization, are the responsibility of the organization and are accounted for in the organizations quality management system [includes risk management system].”

In other words, outsourced processes are governed by the same risk management standards that govern the quality system of the manufacturer. ISO 14971 puts a fine point on this observation when, in section 2.6, it defines the manufacturer as:

“…Natural or legal person with responsibility for the design, manufacture, packaging or labelling of a medical device, assembling a system, or adapting a medical device before it is placed on the market and/or put into service, regardless of whether these operations are carried out by that person himself or on his behalf by a third party.”

In other words, the manufacturer and supplier are considered one-in-the-same. Because manufacturers cannot outsource the risks associated with their supplier processes, now they are beginning to favor suppliers that demonstrate effective risk management through quality system parity—ie, certification to ISO 13485.

New research from Crimson Life Sciences provides evidence of this significant industry trend (the white paper can be obtained at http://www.crimsonlanguage.com). According to the research, certification to ISO 13485:2003 among the entire medical device supplier base has grown to 36%. Moreover, nearly 20% of suppliers currently certified to ISO 9001 have plans for ISO 13485 certification within the next 12 to 24 months.

Tracy Ohmdal, director of quality for device manufacturer Genicon, reported that 75% of his company’s suppliers are certified to ISO 13485. “For us, it’s an important prerequisite…13485 certification helps to establish a common language for discussion of quality requirements,” he said.

In fact, manufacturers aren’t the only ones interested in quality system parity—Notified Bodies also are promoting the concept. Linda Wertz, senior manager of quality assurance at Celera Corporation (an Applera Business), said, “Registrars such as TÜV Rhineland are encouraging manufacturers to source from suppliers that are 13485 certified. Their belief is that if a supplier is certified to 13485, that should be sufficient for qualification without auditing.”

Suppliers are responding with plans and preparations for certification. Adam Trenz, quality manager at Excel Medical Products, is guiding his company’s efforts. “Certification to ISO 13485 means that very soon we will be positioned to support our clients’ dock-to-stock initiatives,” he said. “We also know that incoming inspection is less burdensome with certification to 13485.”

All animals are equal, but some animals are more equal than others.

Beyond generic quality systems standards (such as ISO 9001), certification to ISO 13485 requires suppliers to develop risk management processes as well as evidence of process and software validation. Experts also caution manufacturers to consider who has audited and registered their suppliers. In other words, certification from a top-tier service that generally provides additional risk management is preferable. The two most important criteria cited are:

1. Does the supplier’s registrar appear on the FDA list of accredited third parties? (visit http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfthirdparty/accredit.cfm)

2. Is the supplier’s registrar associated with a Notified Body?

Registrars who meet these prerequisites provide the best assurance of audit quality and true quality system parity.

The compelling reasons for quality system parity are clear, including increased supplier control, supply chain efficiency and audit support. However, the most important reason is enhanced risk management—and this is why regulatory authorities support the concept.

The proof of the pudding is the eating.

For all the reasons discussed previously, risk management occupies a place of growing importance for orthopedic device manufacturers. Beyond this specific industry segment, who else is a “true believer” in the value of risk management? Who else demonstrates a belief in risk management through choices or practice?



Patients are true believers in effective risk management from which better, safer devices mean improved disease treatment and quality of life for an aging population.

Practitioners are true believers in risk management. As far back as Hippocrates, physicians have been instructed to “first, do no harm.”

Device manufacturers are true believers in risk management. Aging populations in the United States, Europe and Japan drive sales growth but also raise companies’ liability visibility—with both consumers and regulators.

Device suppliers are true believers in the value of risk management. Suppliers that can demonstrate good risk management practices through ISO 13485 certification are gaining favor with both manufacturers and regulators. The continued growth of outsourcing in the medical device industry increases the value of risk management for manufacturers and suppliers alike.

Regulators are true believers in the value of risk management. Through the enforcement of risk management standards, regulators communicate this belief to industry. The introduction of Underwriter’s Laboratories’ ISO 14971 registration service is a further step in the codification of risk management within the device industry.


Paradoxically, favorable demographics and sales success breed increased “liability visibility” and risk for orthopedic device manufacturers. This reality is acknowledged in the prevalence of risk management standards and practices. Thanks to tangible benefits, an industry-wide belief has developed in the value of effective risk management. It is the responsibility of top management to see that this belief is communicated to the entire organization.

Marc H. Miller is president of the Crimson Life Sciences division of TransPerfect Translations. Crimson is the only translation organization in the world certified to ISO 9001:2000, ISO 13485:2003 and endorsed to ISO 14971:2000. Crimson’s translation risk management processes have received official Notified Body endorsement and are patent pending. Crimson is the world’s largest translation practice devoted exclusively to Class II and Class III medical devices and List A and List B IVDs. TransPerfect is the world’s largest privately held, diversified language services provider with 44 offices worldwide.