Risk Analysis: 14971 vs URRA

What's the difference and why I should care?

Defined, ISO 14971 Risk Management for Medical Devices is the seminal and definitive risk management standard. Following this standard is not optional in medical device design. This standard specifies the normative requirements for a comprehensive, life-cycle risk management process. The technical report ISO TR 24971:2020 is the companion document that guides the application of those requirements. The basis for Use Failure Modes Effect Analysis (UFMEA) is found in this document. A UFMEA typically contains the following table headers:

Risk Analysis

Risk rating pre-mitigation

Controls/actions

Risk post-mitigation

HF validation

Task No

User Task Description

Description of potential use Errors

Potential hazards

Potential hazardous situation

Clinical harm

Severity of the clinical harm

Probability

Risk ranking

Critical Task (yes/No)

Risk Control Measures (RCM)

Verification of RCM

Other risk generated by RCM

S

P

Risk ranking

Evaluation methods

A Use-Related Risk Analysis (URRA) originated in draft FDA guidance issued in February 2016 titled " Human Factors Studies and Related Clinical Study Considerations in Combination Product Design and Development." In this draft guidance, it is referred to as a key step in identifying use related hazards, and critical tasks. The process became more formally defined and emphasized in subsequent combination product guidances with the publication of the 2017 draft Threshold Analysis Guidance and the 2023 Q & A Guidance. The most detailed guidance dedicated to URRA is the 2024 draft "Purpose and Content of Use-Related Risk Analysis for Drugs, Biological Products and Combination Products" which provides step by step recommendations on URRA contents and use. Based on these guidances, a URRA contains the following table of information:

Task #

User Task Description

Potential Use Errors

Potential Hazards/Clinical Harm & Severity

Critical Task (Yes/No)

Risk Control Measure for Each Use Error

Evaluation Method

While both ISO 14971 and the URRA are used to communicate associated risk. Its important to note, they are different. ISO 14971 is an international standard whereas URRA is found in US FDA Guidances. Historically the URRA is rooted in CDER Guidances however is now considered a prominent cross-center guidance as the URRA became a standard expectation in submissions reviewed by CDRH's Human Factors Team and often cited as a common deficiency when incomplete.

In my opinion, the URRA is a cousin of the UFMEA format found in 14971 and you will likely need to do both. To ease the burden start with a great Task Analysis and build from there. Consider forming the URRA prior to the validation study but not too much earlier in the development process. The URRA will ease the burden of HF reviewers in the FDA and provide the information they want in the format they want. It helps to have good direction.

For outside the US applications, the URRA is optional. A nice benefit of the format post summative study is that if there is a change required to the risk control measure, its readily identified from the URRA table. Additionally since the FDA Guidance and IEC 62366 are in consideration of one another, a URRA table may be useful.