I85PREP
⌘ K
CMDA study materials
CMDA study resources

CMDA: Risk Management, Design Controls, and Process Validation

CMDA · Work through your exam, one topic at a time.

All guide sections

Risk Management, Design Controls, and Process Validation

Risk management (ISO 14971:2019)

Know the sequence: risk management plan, risk analysis (intended use, reasonably foreseeable misuse, hazard → foreseeable sequence of events → hazardous situation → harm), risk evaluation, risk control, evaluation of residual risk, benefit-risk analysis, risk management report, and production/post-production activities feeding back into the file. Risk = combination of the probability of occurrence of harm and the severity of that harm - never probability alone.

Risk control follows a fixed hierarchy: inherently safe design → protective measures in the device or process → information for safety. Each control needs two separate verifications: implementation (was it built in?) and effectiveness (did it actually reduce risk?).

Design controls (21 CFR 820.30)

Planning, inputs, outputs, review, verification, validation, transfer, change control, and the design history file. Verification asks whether the output meets the input; validation asks whether the device meets user needs and intended use in the actual or simulated use environment.

Process validation

The classic state: installation qualification (IQ), operational qualification (OQ), performance qualification (PQ). Approaches are prospective, concurrent, and retrospective, and retrospective is generally not acceptable for new FDA-regulated processes. Also know test-method validation, software validation, sterilization validation, and ongoing process verification required by ISO 13485 clause 7.5.6.

Traps

  • Treating “three lots” as a regulation: it is a widely accepted convention, not a codified rule.
  • Mixing up design verification and validation.
  • Accepting a risk control with only an implementation record and no effectiveness evidence.
  • Assuming revalidation is unnecessary after a change.

Rule of thumb

Verification = “did we build it right?” Validation = “did we build the right thing?” For processes: IQ installed right, OQ works at the extremes, PQ consistently in routine production.