CRAP Risk Assessment & Management 2 — Questions and Answers
Question 1: Under ISO 14971, what is the primary purpose of a risk management file?
- To document all marketing claims about device safety
- To provide a record of all risk management activities performed throughout the product lifecycle (Correct answer)
- To list only risks that exceeded acceptable thresholds
- To replace the design history file
Correct answer: To provide a record of all risk management activities performed throughout the product lifecycle
ISO 14971 requires a risk management file that records all risk management activities—analysis, evaluation, control, and residual risk review—throughout the product lifecycle.
Question 2: Which FDA guidance document establishes recommendations for applying risk management principles to combination products?
- 21 CFR Part 820
- FDA Draft Guidance on Combination Product Safety
- ICH Q9 Quality Risk Management (Correct answer)
- FDA Guidance for Industry: Applying Human Factors and Usability Engineering to Medical Devices
Correct answer: ICH Q9 Quality Risk Management
ICH Q9 Quality Risk Management provides principles and examples of tools applicable to pharmaceutical and combination product risk management.
Question 3: In a risk matrix, a hazard with 'Critical' severity and 'Remote' probability would typically fall into which risk category?
- Negligible risk requiring no action
- Acceptable risk needing only monitoring
- Medium risk requiring risk reduction consideration (Correct answer)
- Unacceptable risk requiring immediate mitigation
Correct answer: Medium risk requiring risk reduction consideration
Critical severity combined with remote probability typically produces a medium risk level that warrants consideration of risk reduction measures.
Question 4: What does the term 'residual risk' mean in the context of ISO 14971?
- Risk remaining after all risk control measures have been implemented (Correct answer)
- The initial unmitigated risk before any controls are applied
- Risk that is transferred to the user via labeling
- Risk associated with off-label use only
Correct answer: Risk remaining after all risk control measures have been implemented
Residual risk is the risk remaining after risk control measures have been implemented, and it must be evaluated against acceptance criteria.
Question 5: A company conducts a Fault Tree Analysis (FTA). What does a top-level event in an FTA represent?
- The root cause identified first during investigation
- An undesired event or failure mode being analyzed by working backwards to causes (Correct answer)
- The first hazard identified in a FMEA
- A safety requirement that must be met
Correct answer: An undesired event or failure mode being analyzed by working backwards to causes
In FTA, the top-level event is the undesired outcome, and the analysis works deductively backward to identify all contributing causes.
Question 6: Which risk acceptability principle states that a risk should be reduced as far as reasonably practicable, even if it is already below the acceptable threshold?
- ALARP (As Low As Reasonably Practicable) (Correct answer)
- FMEA severity scoring
- Benefit-risk balancing
- Hazard and Operability Study (HAZOP)
Correct answer: ALARP (As Low As Reasonably Practicable)
ALARP requires that risks be reduced as far as reasonably practicable, even when they fall below the broadly acceptable threshold.
Question 7: During post-market surveillance, newly identified field failures prompt a risk reassessment. Which step in ISO 14971 does this represent?
- Production and post-production information review (Correct answer)
- Initial hazard identification
- Risk benefit analysis
- Risk estimation
Correct answer: Production and post-production information review
ISO 14971 Clause 10 addresses production and post-production information, requiring manufacturers to review field data and update the risk management file accordingly.
CRAP Risk Assessment & Management 2
Under ISO 14971, what is the primary purpose of a risk management file?