Safety, Risk Management, and Incident Investigation
What this domain tests
This domain tests structured risk management under ISO 14971 and disciplined incident investigation. You must distinguish hazard, hazardous situation, harm, and risk; apply the risk-control hierarchy; and investigate without destroying evidence or blaming individuals prematurely.
Core rules
- ISO 14971 sequence: define intended use → identify hazards → estimate and evaluate risk → control risk → evaluate residual risk → monitor production and post-production.
- Risk-control hierarchy: inherently safe design first, then protective measures, then information for safety. Training and labels are the weakest controls.
- Incident investigation: secure the device and logs, preserve chain of custody, interview staff separately, build a timeline, review alarms and error codes, consider human factors and workflow, then perform root cause analysis (RCA) or fault tree analysis.
- Reporting: report to the manufacturer and FDA MedWatch when required, and complete internal CAPA with effectiveness checks.
- Just culture: separate system failures from reckless behavior; honest error should not be punished like intentional violation.
Worked example
An infusion pump delivers an overdose. Reasoning: preserve the pump, drug library, and event logs before testing; reconstruct the programming sequence; check whether the dose error reduction system was bypassed; inspect the cassette and set loading; interview the nurse without interruption. The proximate cause may be a misloaded cassette, but root causes may include poor lighting,ambiguous alarms, and a library that permits override. Controls should prioritize design and workflow changes over a new poster.
Traps that cost marks
- Powering on or resetting a device before downloading logs.
- Writing the RCA around one person's “carelessness.”
- Treating training as a sufficient risk control.
- Confusing residual risk acceptance with ignoring risk.
- Missing the reporting clock.