FMEA (Failure Mode, Effects and Criticality Analysis — AMDEC in French) is the most widespread risk management tool in the medical device sector. It is useful, well documented, and familiar to auditors. It is also the tool most frequently turned into a formal exercise with no real analytical value.
A poorly completed FMEA table is worse than an empty one: it gives the illusion that an analysis has been carried out, when in fact the real risks have not been seriously examined.
What FMEA is supposed to do
FMEA identifies the possible failure modes of a device or process, analyses their potential effects on patient or user safety, and assesses the criticality of each failure mode according to two dimensions: the severity of the effect and the probability of occurrence.
For each failure mode with an unacceptable risk, control measures are defined. After the measures are implemented, the residual risk is reassessed. If the residual risk remains acceptable, the line is closed. Otherwise, additional measures are required.
The mistakes that drain FMEA of its substance
Mistake 1: failure modes that are too generic. “Failure of component A” is not a usable failure mode. A precise failure mode describes exactly what happens: “rupture of the weld on connector A under a tensile load greater than 15 N”, “drift in the calibration of sensor X after 500 cycles of use”. Precision is the condition for a useful analysis.
Mistake 2: effects defined as “harm to the patient” without precision. “Harm to the patient” is not an effect. The effect must describe the mechanism: “underdosing of the administered drug leading to insufficient treatment efficacy”, “unintended electric shock to the patient during the defibrillation procedure”. The precision of the effect determines the correct assessment of severity.
Mistake 3: severity and probability scores assigned without justification. A “3” in the severity column with no explanation of the basis for that figure is an arbitrary number. The scoring criteria must be defined in the risk management policy and applied consistently.
Mistake 4: unverified control measures. An FMEA that lists control measures without documenting the verification of their effectiveness is incomplete. Section 6.3 of ISO 14971 requires verifying the effectiveness of control measures before concluding on the acceptability of the residual risk.
Mistake 5: an FMEA frozen after design. The FMEA is a living document. It must be updated whenever the device undergoes a significant modification and whenever the risk management file is revised as a result of post-market data.
What notified bodies look for in an FMEA
An experienced notified body does not read an FMEA line by line. It selects the failure modes with high initial or residual risk and examines the corresponding analysis in detail: is the failure mode precise? Is the effect well described? Is the control measure relevant to the identified cause? Is the verification of effectiveness documented with objective data?