Welcome back to Morris Medical Monthly: a monthly series for medical device development companies (and companies who are related to such companies), providing some useful information about Polarion solutions and Polarion extensions.

Today we will start on the subject of Polarion’s RiskPack extension, and have a look into RiskPack’s Basics.

Risk control: Define risk control measure

After you have identified the risks like described above, the RiskPack will tell you whether you accept them or not
based on your risk policy. If mitigation is needed, you can use the “risk control measure” work item type to document
risk control measures. Each risk control measure can be linked to any number of risks using the “mitigates” link role.
You can use the work item’s status to track the implementation and verification of the risk control measure.

Risk control: Reevaluate risks

After application of risk control measures, a risk must be reevaluated. In RiskPack, this is done by a separate work
item of type “risk”, which considers a previously defined risk after application of all risk control measures that are
mitigating that risk (see last section). If you want to reevaluate a risk, simply create a new one, link it with “mitigated
from” link role to the initial risk work item that represents the risk without application of the risk control measures,
and set a new value for the probability of occurence.

How reduction of the severity is documented

In some cases, not the probability of occurence but the severity of harm changes. For example, a protection
measure prevents the death of a person (which was possible before), but still skin burn can occur. In that case,
simply link the new or changed harm to the residual risk and keep the value for probability of occurence. Just like
dedcribed above, the directly linked harm will override the inherited harms from the initial risk.

How to document a completely removed risk

Through a risk control measure that is implemented by a change of the design that makes the product inherently
safe, a risk can completely be removed. In that case, set the “risk type” value of the residual risk to “Removed Risk”
and leave the probability value unset.

Reporting: Prepare risk-benefit-analysis and risk management report

After you have finished your risk management, you have to make a final risk-benefit-analysis. This is usually done by
free text, so RiskPack provides a wiki page “Risk Management Report”, which provides a section for the risk-benefit
analysis. You can include any Risk Tables or the Risk Matrix if you like. If you prefer to document the risk-benefit
analysis in another format or separately from the risk management report, you are free to do so.

The risk management report is the final statement that risk management has been done according to the plan and
all tasks have been finished. RiskPack includes this statement in a second section of the “Risk Management Report”
wiki page.

Reporting: Compile a risk management file

Everything you need for your risk management file is included in the wiki pages provided by the RiskPack. As
Polarion is able to export any wiki page to PDF documents, those documents form your risk management file.

For more information about Polarion’s RiskPack visit our Extension Portal using following link: available here. I hope you liked this article and you will visit our Blog again when there is another Morris Medical Monthly article.

---