FDA Issues Draft Guidance On Use-Related Risk Analysis (URRA)

By Jayet Moon and Arun Mathew

The FDA released a new draft guidance, Purpose and Content of Use-Related Risk Analyses for Drugs, Biological Products, and Combination Products, in early July. It provides guidance to industry and FDA staff on the purpose and content of a risk management tool for usability, a use-related risk analysis (URRA), that has recently gained lot of currency with the FDA. A string of FDA guidances since 2016 that reference the URRA convey the FDA’s expectation (read: recommendation) to not only have a URRA as part of premarket submission but also have it updated post-market as required. In the premarket phase, a well-done URRA is expected to help determine human factors data needs during product development and to support a marketing application.

While this guidance overtly applies to drug- and biologics-led combination products that include a device constituent part, the concepts in it can easily apply to medical devices, in vitro devices, and, in some cases, stand-alone drug and biological products such as when human prescription and non-prescription drugs/biological products are part of an NDA, BLA, or IND (including supplements to these).

So far, this is the FDA’s most “to the point” and step by step guidance on URRA that almost reads like a work instruction.

The FDA encourages sponsors to engage with the FDA early in the design and development of a product to discuss the human factors (HF) development program via meeting requests.

The What?

The URRA is a risk management tool used to identify use-related hazards associated with product use and the measures implemented to reduce those risks. The URRA supports the entire HF engineering process and should be considered as part of an overall risk management framework per ISO 14971 or ICH Q9, as appropriate.

The Why?

URRA is the tool to identify use-related hazards associated with the user interface design of the combination product, as well as to characterize risks so they can be mitigated (such as through risk controls) or eliminated through improved product user interface design. It feeds into the determination whether HF validation study results are warranted as part of a new pre-market application. Additionally, the URRA is a key component in developing an HF validation study protocol and informing the acceptability of residual risks. The URRA also may aid in demonstrating compliance with applicable requirements codified in 21 CFR Part 4 Subpart A for combination products.

The When?

As opposed to a use failure mode and effects analysis (uFMEA) that was traditionally started later in the design process on the system level (often after design inputs and outputs were close to freeze), the URRA is started early during product development process and a healthy use of URRA is expected to generate new user, design and user interface (UI) requirements, some of which could be part of application of risk control measures. To be clear, in this guidance, the FDA does expect that uFMEA can be one of the tools used to identify potential use errors.

The FDA expects the URRA to be used and updated in all phases of the product life cycle as the product design changes or as new risks are identified during development or post marketing.

Per the FDA, the URRA should include the following:

• A comprehensive list of all tasks required for the use of the product
• The potential use errors and harms that may occur with those tasks
• A determination of whether each task is a critical task
• Risk controls employed in the user interface design to mitigate the use errors
• Evaluation methods that have been used or will be used to evaluate the effectiveness of the risk controls.

The How?

When developing the URRA, manufacturers should consider all the intended uses of the product, the potential product users, and the likely use environments. Each of these may impact product design, user tasks, and subsequent risks and potential harms associated with use of the product. The sequential steps of URRA development are summarized in Figure 1.

Figure 1: URRA Development Process per FDA Guidance.

Anatomy Of A URRA

In Figure 2, we analyze the example given by the FDA in the guidance. The philosophy is simple and sequential, as detailed in Figure 1. The table’s columns sequentially address the following:

1. Task Number: A task identifier for traceability
2. User Task Description: Description of instruction to the user, e.g., verbiage that goes in the instructions for use (IFU)
3. Potential Hazards/Clinical Harm and Severity: Describe the potential hazards and the harm that results from the use error and its associated severity through the lens of clinical impact.
4. Critical Task: A user task is critical if, performed incorrectly or not performed at all, it would or could cause harm to the patient or user. Critical tasks are the most likely candidates to undergo HF validation testing.
5. Risk Control Measure: Each use error requires a risk control measure identification. These can be a feature that makes the design safe, a protective measure, or information for safety.
6. Evaluation Method: The evaluation method should verify the effectiveness of the risk control measure. This largely occurs through HF validation testing.

Figure 2: Anatomy of URRA (FDA Example).

Commentary

• While FDA guidances on usability, including this one, often align well with AAMI HE75 standard, this guidance still does not fully map to IEC 62366 requirements. This leads to redundant documentation requirements for manufacturers to aim for both FDA clearance and CE mark. For example, 62366 requires identification of hazard-based use scenarios — an item that does not exist in the FDA’s vocabulary.
• Column 4 in the URRA example in the guidance tries to do too much in one column. It’s better off split into three columns that separately identify hazard, harm, and severity.
• URRA is defined as a risk analysis tool. Risk includes probability of occurrence and severity. Where does URRA feed into? Is it an FMEA? Is it a hazard analysis? Some guidance on how probability of occurrence and severity from the safety risk management tools and methods interface with URRA would have been useful.
• The definition of harm in this guidance is broad and it includes compromised medical care. This is where clinical impact and severity come in to identify critical tasks. While it can be assumed that every significant clinical impact can be a critical task, manufacturers will need to internally align on what is “significant” based on their severity scales per the risk acceptability criteria.
• The last column in URRA is now labelled as “Evaluation Method.” In some other previous guidances, it was called “Validation method for effectiveness of risk mitigation measure.” While the latter more clearly pointed to a HF study, it maybe opens the door to include other items as the guidance in Section III F is more flexible. After all, validation testing of the final design is not required for all HF category submissions.
• Previously, the FDA had used the word “Risk Mitigation,” and now it uses “Risk Control.” This is likely for alignment with ISO 14971:2019.
• While the guidance title mentions drugs and biologics first and combination products last, it is largely geared toward combination products. Some more specifics and nuances of creation of URRA for the former would have been appreciated. We feel that the final guidance might have that amendment, however small that may be.

The public comment period closes on September 9, 2024.

About The Authors:

Jayet Moon earned a master’s degree in biomedical engineering from Drexel University in Philadelphia and is a Project Management Institute (PMI)-Certified Risk Management Professional (PMI-RMP). Jayet is also a Chartered Quality Professional in the UK (CQP-MCQI). He is also an Enterprise Risk Management Certified Professional (ERMCP) and a Risk Management Society (RIMS)-Certified Risk Management Professional (RIMS-CRMP). He is a Fellow of the International Institute of Risk & Safety Management. His new book, Foundations of Quality Risk Management, was recently released by ASQ Quality Press. He holds ASQ CQE, CQSP, and CQIA certifications.

Arun Mathew works in quality systems in R&D at AbbVie. He holds an executive MBA, M.Sc., in real time embedded systems, and a diploma in electronics. He has more than two decades of experience in the medical devices industry, drug product development, manufacturing, and regulatory affairs. He is a longtime member of the American Society for Quality and is a certified CQA Certified Quality Auditor and CQE Certified Quality Engineer. Previously, Mathew has worked at Fortune 500 companies such as Zimmer Biomet, Medtronic, and Baxter.