The perils of risk mitigation

Following the incident, we assessed her home and decided that a stairlift would help mitigate the risk of further falls. The stairlift was fine but its operation interfered with the phone wiring and eventually broke it; this rendered her phone, panic button and internet all useless. We only discovered this when we couldn’t get through to her on the phone and rushed to check that all was okay. In this case, luckily, it was.

One risk control measure (the stairlift) had failed, rendering ineffective another risk control measure (the panic button) and mum was left unprotected. The wiring was easily fixed and no harm done this time, but the consequences might have been more severe.

This incident prompted me to reflect on the way in which risk controls are layered over each other in the designing of medical device systems. In the case described, needs evolved at different times and focussing on the narrow zone of impact of a particular risk control caused us to neglect the bigger picture. By disregarding the impact of a particular risk control, we can provoke unexpected and potentially hazardous interactions between control measures applied.

In discussion with our risk manager Laura, she pointed out that these potential interactions are all anticipated and provided for in the Risk Management standard ISO14971 for medical device development. This regulation demands the review of new or changed risk arising from risk control measures, to see if they pose new hazards.

My recent experience serves to illustrate the importance of considering all potential changes and interactions when adding risk controls to deal with emerging hazardous situations. We must consider our changes broadly and creatively, to spot the non-obvious but potentially hazardous interactions between seemingly independent things.