Products Solutions Services Industries Meet ValGenesis
Schedule a Demo

ValGenesis Blog

Risk Management for Medical Devices

Blog Home | Published: May 25, 2017

Leveraging Technology to Address the ALARP vs AFAP Challenge

It is a regulatory requirement for Medical Device companies to perform Risk Management and provide documented evidence to demonstrate compliance with regulation and a company’s own Quality Management System (i.e., Policy & Standard Operating Procedures). Expectations are stipulated in ISO 14971: Medical devices – Application of risk management to medical devices. This is evident to the extent of harmonization of this standard by regulatory agencies including the FDA and EU. The EU went even further with the release of EN ISO 14971:2012.

Additionally, medical device companies must have a Quality Management System (QMS). Comprehensive QMS requirements for design and manufacture of medical devices can be found in ISO 13485: Medical devices – Quality management systems – Requirements for regulatory purposes.

A major challenge medical device companies faced was when the requirement to mitigate risk from As Low As Reasonably Practicable (ALARP) to As Far As Possible (AFAP) came into effect. The requirement became “get rid of all the risks” as opposed to “do the best job you can afford to do”. This was because companies started using the phrase “…as reasonably practicable” as a loophole. Risks would simply be accepted because it was reasonable given economic considerations; in other words, it was too expensive to fix. This practice is no longer acceptable.

Methods & Tools for Mitigating Risk

Most medical device companies employed Failure Mode Effects Analysis (FMEA) as their risk management tool and incorporated this into their official processes. This is no longer effective for medical device companies to specifically achieve the AFAP requirement. Sure, FMEA can be a good tool to use, but it’s insufficient to completely comply.

Technology to the Rescue

Fortunately, technology can be leveraged to help companies comply. The ValGenesis Validation Lifecycle Management System (VLMS) offers features and functionality designed to not only assist with compliance, but also to significantly reduce cycle times.

Requirements Management functionality is inherent in the ValGenesis VLMS. Requirements can be managed individually and even shared across products. This is beneficial because it introduces the concept of reusability. Not only can requirements be effectively managed, risks management processes and outcomes can be performed and associated with risks so duplicating effort is eliminated.

The highly configurable ValGenesis VLMS allows for each company to create their own risk levels, scoring, weighting to automatically calculate risk scores. This is a configurable attribute of the Commercial-Off-The-Shelf (COTS) ValGenesis VLMS. This means that companies can continue to use FMEA, but also design their own 14971 compliant risk management practice.

Assessing Impact can happen automatically in the ValGenesis VLMS. When a requirement or document is changed, then all associated validation efforts can be flagged with an “Impacted” status. In turn, qualified professionals can determine if, in fact, the impact affects the validated state of a Validated entity.

Binding documents to a Validation package allows for many different artifacts (documents, files, graphics, drawings, illustrations, videos, etc.) to be logically linked. This includes a link to the source document or, if preferred, an automatic copy of the source document being made by the system.

Automatic Trace Matrix generation is not only useful in verifying comprehensive testing of an entity, it is also an effective tool that can be used throughout the entire development lifecycle.

Document management is another feature of the ValGenesis VLMS. This includes the ability to electronically route documents through predetermined workflows and electronically sign documents. Any changes are tracked through audit trail functionality. The result is a paperless solution where all associated documentation, including both current approved documents and legacy documents, are always readily available.

In Summary

Many medical device companies have struggled with implementing a risk management process that results in risk being mitigated to the level of AFAP. Fortunately, technology allows companies to utilize systems such as the ValGenesis VLMS which provides not only a comprehensive solution, but a highly configurable system that can be implemented to meet the unique needs of each individual customer.

Contact ValGenesis today to see how the ValGenesis VLMS can significantly assist medical device companies.


Many medical device companies have struggled with implementing a risk management process that results in risk being mitigated to the level of AFAP.


Steve Thompson

Steve Thompson has worked in Life Sciences for over two decades in both Information Technology and Quality Assurance roles. He’s a certified systems auditor and has audited hundreds of companies globally. A published author, a frequent speaker at industry conferences, on the Board as a Director for PRCSQA, Editorial Advisory Board for ISPE, and Elite Faculty member for KENX, and Adjunct Lecturer, Temple University, School of Pharmacy, RA/QA Graduate Program. He was honored with an APEX 2020 award of excellence for a peer-reviewed article he co-authored for Pharmaceutical Engineering on Blockchain. Currently, as Director Industry Solutions at ValGenesis, Steve helps Life Science organizations realize the potential benefits of advanced technologies, along with inherent risks.