How to Design a Risk Analysis Matrix for Your Medical Device Development

Some people say that the only constants in life are that you will die and you must pay taxes. Obviously, this is a sarcastic attempt to demonstrate the extent to which the Internal Revenue Service (IRS) will go to ensure that your financial contribution to our government’s operations is not overlooked. Even so, it is hard to dispute its veracity. There is another attribute of life that in many cases is overlooked or regarded as negligible: the fact that every action undertaken involves some degree of risk. When it comes to medical devices, the risk involved cannot be overlooked nor trivialized.

Medical devices are intended to support, enhance, or save lives. Therefore, safety is the primary concern during the design, manufacturing, and testing of electronic devices and PCBs intended for medical use. Of the many regulatory requirements for medical device development, the most directly focused on safety are ISO 13485 and ISO 14971, which provide guidelines for quality management and risk management, respectively. These two activities are interlinked. In fact, effective risk management can lead to improved quality management. And the most important aspect of risk management is the ability to accurately assess risks and their impact, which is typically done by utilizing a risk analysis matrix. The importance of this tool demands that we establish a reliable design, which is done below.

How to Design a Risk Analysis Matrix for PCB Development

A risk analysis matrix, also known as a risk assessment matrix or simply risk matrix, is a graphical tool for assessing an individual risk and its impact on a process or activity. For the assessment of a single event or process, designing the matrix may follow the identification of risks step of creating your risk management plan. However, for multistage processes, it is advisable to begin at Step 1 of the risk analysis matrix development procedure below.

Step 1: Establish a standard format

Your format should be similar to the one shown above, including an axis for risk occurrence and one for event impact.

Step 2: Determine the stage or event for assessment

The stage or event involves a process or activity which, if not done properly, could have a significant impact on the objective or result. For medical development, you could select the board fabrication or PCB assembly stage.

Step 3: Create the list of risks

The list of risks is a risk analysis essential that should contain

items that can impact the completion of the activity or process. For example, for

PCB assembly, the following may be included:

• Components unavailable
• Wrong orientation for component
• Inadequate solder mask clearance
• Footprint-component package mismatch
• Lack of support for flex board
• PCB layer delamination
• Board contamination
• Board mechanical or structural breakdown

The list of risks should include all contingencies for which you want to apply a separate set of controls to address. As an example, if your response is different for delamination and warping risks, they should be listed as separate risks. Otherwise, they can be contained within a single risk, such as structural failure or breakdown.

Step 4: Define the risk occurrence axis

The entries for the risk occurrence axis should range over the possibilities that the risk will happen or occur. The number of possibilities most likely will be from three to five. For example “IMPOSSIBLE” and “SOMEWHAT POSSIBLE” are categories that could be added to the template shown in Step 1. It is advisable to use numeric quantifiers like percentages or number of occurrences in addition to or in place of descriptions, such as Unlikely, May Occur, or Very Likely.

Step 5: Define the event impact axis

The impact axis should contain an entry for each different level of impact that may result in a control being taken. Similar to the occurrence axis, numeric quantifiers should be used for each entry, ranging from lowest to highest for least to greatest impact, respectively.

Step 6: Define the controls

Next, the controls or actions that should be taken for each impact should be defined. The controls should be numerically determined based upon the desired action to be taken for the risk based on the occurrence probability. For example, a risk that shows up due to a low probability occurrence may be deemed unlikely to happen again and less severe control may therefore suffice. By contrast, if a risk is due to a highly likely source, it is probably indicative of a major process issue that requires a more severe control.

Step 7: Fill in the matrix elements

The colored entries in the risk analysis matrix are determined using the following equation:

Control value = occurrence (vertical axis) x impact (horizontal axis)

The cells are color-coded based upon the control scale (top) range within the cell value falls.

Step 7: Repeat Steps 4 - 6 for each risk

Step 8: Repeat Steps 3 - 7 for each stage or event

Following the steps above will enable you to design your risk analysis matrix for medical device development. While creating your matrix, it is a good idea to keep in mind design for manufacturing (DFM) and design for assembly (DFA) guidelines as they are targeted at preventing or mitigating many of the potential risks to your board’s development.