Risk-Based Approach

1. Risk-Based Approach Scott M Revolinski Washington Safety Management Solutions Carolyn Apperson-Hansen Cleveland Clinic Foundation Part 11 Public Meeting

2. Major Points • Use of risk based evaluation of electronic records systems • Defining which electronic records are Part 11 electronic records Part 11 Public Meeting

3. Major Points • Use of risk based evaluation of electronic records systems • Defining which electronic records are Part 11 electronic records Part 11 Public Meeting

4. Existing Risk Guidance • Use of COTS software in medical devices Part 11 Public Meeting

5. Existing Risk Guidance • COTS software in medical devices guide: • Basic Validation Documentation • Residual Risk Discussion Part 11 Public Meeting

6. Risk Assessment Difficulties • Most electronic records cannot be easily related to human safety categories: • major, moderate, minor • Failure probability for software cannot be defined Part 11 Public Meeting

7. General Risk Guide (draft) • Risk Management as an Integral Part of the Quality Management System, SG3 / N15R6 (draft) • Using Failure Mode and Effects Analysis (FEMA) techniques leads to a risk index. This is used to categorize the significance of various hazards Part 11 Public Meeting

8. What’s Missing • Relationship between electronic records and human safety • Evaluation of electronic record hazard probabilities and consequences • Basis for judging robustness of risk mitigation controls Part 11 Public Meeting

9. Systems Approach • Evaluate association between product quality / human safety and System under consideration • Examine electronic records use within System • Identify electronic record security and integrity hazard scenarios • Establish multiple layers of risk mitigation controls commensurate with hazard probability and consequences Part 11 Public Meeting

10. Risk Assessment Summary • In re-evaluating the risk-based approach to Part 11 requirements consider providing: • an approach to estimate the relationship between electronic records and human safety (e.g., FMEA – Systems Approach) • types of risk mitigation controls (e.g., layers of procedural and / or physical barriers) • basis for accepting residual risk Part 11 Public Meeting

11. Major Points • Use of risk based evaluation of electronic records systems • Defining which electronic records are Part 11 electronic records Part 11 Public Meeting

12. Existing Application Guidance • Scope and Application Guide for Part 11 Part 11 Public Meeting

13. Application Difficulties • Most predicate rules were written before use of computers for records management • Predicate rule requirements for Part 11 issues aren’t addressed • Few electronic records have direct links to product quality or human safety yet Part 11 application is anticipated Part 11 Public Meeting

14. Risk-Based Systems Approach • Business risk is the inappropriate use of narrow Part 11 scope • Systems approach to determine use of electronic records and potential regulatory impacts • Justification documentation Part 11 Public Meeting

15. Application Summary • In re-evaluating the scope of Part 11 application consider providing: • some examples of when electronic records could be considered Part 11 records and when they are not (when not specifically identified in the predicate rules) • basis for deciding what is significant to product quality / human safety Part 11 Public Meeting

16. Scott Revolinski Washington Safety Management Solutions 2131 S. Centennial Avenue Aiken, SC 29803 s.revolinski@wxsms.com 803-502-9678 Carolyn Apperson-Hansen Cleveland Clinic Foundation 9500 Euclid Avenue Cleveland, Ohio 44195 capperso@bio.ri.ccf.org 216-445-3618  Contact Information Part 11 Public Meeting