Risk? What risk?

Most people see the term “risk” as an indication of something to be avoided. Like the risk of being mugged if you walk alone in the night in a dark alley. Or that your bicycle is stolen. For many product sectors, including the medical devices sector, there is a special meaning associated with the term “risk”. This meaning is included in many regulatory frameworks, typically combined with the requirement to minimize risk. Since some 15 years, ISO allowed an additional meaning to this term, causing a lot of confusion and irritation. This article aims to explain some of that.

In the medical devices sector, risk is associated with the possibility that using these devices can cause harm. Actually, the definition of risk used in many regulatory frameworks combines the probability of occurrence of harm with the severity of that possible harm. This regulatory definition determines the required approach to manufacture and sell medical devices. ISO and IEC have adopted this definition in the first edition of their common ISO/IEC Guide 51[1], for standards developers, published in 1990.

With the publication in 2009 of ISO Guide 73, in support of ISO 31000 (“Risk management - Guidelines”), ISO introduced an additional definition of risk, one that refers to “effect of uncertainty on objectives”. Superficially, there is some commonality between uncertainty and potential harm: both should be minimized. Yet, there is a substantial difference. The definition in ISO Guide 73 speaks about the “effect of uncertainty”, and not the “uncertainty” itself. And Note 1 to the ISO Guide 73 definition of risk reads: “An effect is a deviation from the expected — positive and/or negative.” Meaning that - in this context - risk can also refer to something positive; supposedly not to be minimized.

It has been argued in (often rather academic) discussions that the definition of risk in ISO/IEC Guide 51 is a mere subset of the definition given in ISO Guide 73. Careful analysis by JWG1 of ISO/TC 210 and IEC/SC 62A, responsible for ISO 14971, concluded that the definitions are “vastly different”; see ISO/TC 210 N1001 (2018). This assessment was not the first to identify the significant difference; in 2001, the IEC Advisory Committee on Safety (ACOS) advised IEC to not agree with publication of Guide 73 as a joint ISO/IEC document. See ACOS/254/INF. Still, the first edition was published in 2002 as ISO/IEC Guide 73. The 2009 edition of Guide 73, however, is an ISO-only Guide.

Things got worse when ISO decided to make terminology related to ISO Guide 73 mandatory for its management system standards (MSSs). In 2012, ISO published Annex SL as part of the ISO supplement to the ISO/IEC Directives, Part 1. This Annex, also known as the ISO High-Level Structure (HLS), specifies structure, terminology, and - to a large extent - content for ISO MSSs. In 2012, ISO/TC 210 had started revision of ISO 13485:2003, and could publish the 2016 edition without it being HLS compliant.

ISO and IEC are both aware that the terminology ambiguity needs be addressed. Therefore, an ISO/IEC Joint Task Force was established “on the Concept of Risk and Associated Terms” with a mandate that includes (see ISO/TMB N1146):

• Information sharing among committees […]
• Identify how the concept of risk […] should evolve in the standardization community to meet the need of standards users and suggest solutions […]

The mandate description of the JTF in ISO/TMB N1146 concludes with the following: “The TF should reach out to standards users and ensure that the needs of the users are considered in the proposed solutions.” This gives assurance that our voice will be heard and taken to heart!

The medical devices sector is well represented in this JTF with ISO/TC 210 and IEC/TC 62, among others. Jointly, these medical devices committees issued a statement that regulatory requirements always prevail, and that standards intended to be used in regulatory context cannot deviate from regulatory terminology (see ISO/TC 210 N1322).