Name: Medical Device Risk Management Under ISO 14971 and MDR/IVDR
Uploaded: 2026-02-17T16:01:10.878Z
Duration: 52 min 24 s
Description: Medical Device Risk Management Under ISO 14971 and MDR/IVDR

Transcript for "Medical Device Risk Management Under ISO 14971 and MDR/IVDR": So, good morning or good afternoon, everyone, depending from you're watching this. Welcome to another global keynote by NSF. Today's topic is on medical device risk management under ISO 14,971 and MDR and IVDR regulation. I would also like to add that if you have any questions, can add it on the tab on the right. And I will do my best to answer them toward the end of the keynote. If not possible, then I will try to reply to you in an email. Now, to give you a little bit of background about myself before we give it begin, let me introduce myself. My name is Kastro Kotz. I work as a consultant for medical devices at NSF located in Hamburg, Germany. And my primary focus is medical device risk management and usability. I have extensive experience working with risk management projects in line with ISO 14,971 and EU MDR compliance, as well as FDA and other jurisdictions. My work includes conducting gap assessment, addressing deviations, as well as establishing risk management documentation as well as processes. And I have a strong, also, focus and interest in usability engineering topics as well as human factors engineering, which goes hand in hand with risk management topic. A quick word about NSF's mission. So since 1944, we've been dedicated to the improvement of human and planet health. This mission is carried out by thousands of team members we have globally, including microbiologists, toxicologists, chemists, engineers and regulatory affairs specialists such as myself. To give you an introduction about NSF, NSF's expertise spans into three core industries, food and nutrition, water and life science. For today's keynotes, we're focusing on the life science part, which is the most relevant. And as of NSF, we support medical devices and IBD manufacturers throughout the entire product life cycle. So this includes from initial concept to post market. And as you can see from the wheel I have placed here for you, we have from the regulatory affair, design and development, clinical affairs. And we also take care of complete technical documentation, creating for submission ready documentation and establishing quality management systems, as well as all post market activities related to. I just want to put a note that this presentation is based on information available at the present time and has been complied to the best of my knowledge. So today agenda, cover it in three parts. First part is the background. We will explore why risk management matters and how it fits on the regulatory framework, like EU MDR and key foundational concepts, including top management responsibilities. Then we focus on the specifics, so we go into the requirements of the ISO, terms and definition, reasonably foreseeable misuse, what does that mean, the causality chain and probability of occurrence and severity of harm, as well as acceptance criteria. And finally, we finish off with the risk control measures and what are the verification of effectiveness and verification of implementation documentation as evidence that we have. And then the last part, we focus specifically on what we as, let's say, consultants in this area find to be the common mistakes in and pitfalls, let's say, that we see when it comes to audits, when it comes to technical documentation, gap assessments that we perform. So we provide provide you with an overview of what are the common mistakes and how you can avoid them. This part is not needed. So why risk management is so critical? So if you look into MDR and simply put the keyword risk, you would have two hundred and two forty 224 hits. And you can see that risk is something that is covered all over MDR and we get to why. So starting with one of the most important articles related to risk management, article ten two clearly states that manufacturers shall establish documents, implement, and maintain a system for risk management as described in annex one, section three. Notice the four verbs that we have here. Establish, meaning to create a system, a process, to document, to have it, let's say, formally written, and to implement, to put it into practice. Does it really work? And to maintain the system. So that's the product life cycle comes into place, let's say. Consequently, when risk management is weak or poorly executed, it can heavily impact how quickly you can get your product into the market. And most importantly, it's directly linked to patient safety, clinical benefit, and your device performance. That's why risk management is the center of all documentation when we are talking about medical devices. Now, what is ISO 14,971? We like to describe it as the how to for MDR risk management. It's harmonized standard for risk management on the MDR, and it covers the full process from planning to analysis to evaluation to risk control measures to what needs to be done also for, let's say, post market monitoring. We have additionally the amendments for these standards. So the 2019 a eleven two thousand twenty one amendments, and that's basically it's it adapts specifically for, let's say, MDR compliance to the annexes of the GSPR section. And it basically gives, let's say, a good traceability for us to have an understanding of where does it connect to. Risk management is not a one time activity. It must be continuous and iterative throughout the entire device lifecycle. So we're talking from the initial concept phase to design development and verification validation activities. Now I have put it this way just to give you examples of what are the inputs that we receive that feeds into risk management. And these include from CEP, CDP, CERs, summary of safety and clinical performance, design development data, findings that we have from usability, preclinical, bench testings, oil compatibility, and all other regulatory requirements. So these are all the inputs that we have pre, let's say, market phase that feeds into risk management, and we should take it into consideration. Now, as of the post market phase and what we have as the evidences that relates to the post market. We still have, let's say, update of, again, such document. As you see, you have clinical evaluation, we have PMCF reports, we have PSUR and PMS report for class one devices. We have complaint handling, so the PMS part. And we have literature review and also expert review. So there's a lot of, let's say, inputs coming into the risk management process, and it doesn't necessarily end once you have marketed their products. So it's iterative, it's a product life cycle, and it always feeds back as a cycle into the device. Now, here's the fundamental principle from MDR. So what do we mean by reducing risk as far as possible? Yeah, so of course, reducing risk as far as possible comes with an importer, let's say, qualifier. And that qualifier is that the regulation states that you should reduce risk without adversely affecting the benefit risk ratio and the balance. I tried to visualize it for you here. As you can see, you're not required to eliminate all risk at any cost. Instead, you should optimize, try to reduce risk as much as feasible while preserving the clinical benefit that justifies your device's use. And that's a really, really important take for us throughout the risk management documentation and process. So what are the on the topic of top management responsibilities and how this has been defined? So management must demonstrate commitment by providing adequate resources and assigning competent personnel to risk management activities. They must define this and document the policy that establishes what is the criteria for risk acceptability based on applicable regulation, international standards, state of the art, and also any stakeholder concerns. That's also related to the benefits of your product that you have. And this policy creates then your risk acceptance framework. And finally, management shall review the risk management process at planned intervals to ensure it remains effective and document all decisions and actions that needs to be taken. Bottom line is that risk management requires active leadership. It involvements and it's not only just delegation of work to your team members. There needs to be a policy to review this. And policies, for example, are we will manage risk according to ISO 14,971 and accept risk only when benefit outweighs them. So that's, let's say, one way to set a policy, let's say a statement that you find in the policy, and it's not your risk management plan. A common mistake that we see with manufacturer is that they try to squeeze their policy into the plan, and sometimes the risk management plan doesn't cover all the activities that are necessary. So now we get to the second part of our presentation. We look into the causality chain. But to start with, we would look into some, let's say, terms and definitions first. So what is risk? So these are all the definitions that we have according to ISO fourteen thousand nine seventy one. You find it in section three. Risk is a combination of probability of occurrence of a harm and severity of that harm. So we have two components. What is hazard? Hazard is the potential source of harm, and harm is injury or damage to the health of people or damage to the property or environment. And risk management, as the ISO's description, is systematic application of management policies, procedures, and practices to the tasks of analyzing, evaluating, controlling, and monitoring risk. So these are some of the very important definitions that we need to understand before we proceed. I have another slide for important definitions for you, and then I promise not to bore you with definitions. So what is hazardous situations? So it's circumstances in which people, property, or environment is or exposed to one or more hazards. What is risk analysis? So it's systematic use of available information to identify hazards and to estimate risk. What is risk evaluation? It's the process of comparing the estimated risk against given risk criteria to determine the acceptability of the risk. So we're going one step ahead with the evaluation. And finally, have the risk control. So it's a process in which decisions are made and measures implemented by which risks are reduced to or maintained within specified level. Now, if the definitions are confusing for you, we're to jump into examples and try to clarify. But before we begin, I would like to introduce this very important topic that is often misunderstood. And that is what is reasonably foreseeable misuse. So it is defined as a use of a medical device in a way not intended by the manufacturer, but which can resolve from, let's say, readily predictable human behavior. And this includes, for instance, use errors. So we're jumping a little bit to the usability topic. Slips, lapses, mistakes, as well as intentional act of misuse or using the device for unintended application. It also ties then to our usability topic here a little bit. So we are referring to ISC sixty two three sixty six. And a practical example for many of you would also be that, let's say, we have a single use device and it's reasonably foreseeable that the user might reuse this device to save costs or any other reason. And for that, we must take this risk into account. And by taking this into account, we must apply risk control measures and make sure that there are warnings in place to let the user know that they should not reuse the product. That's one example, let's say. And what falls outside of this scope, so we have in the red area, and that is abnormal use. And that's, let's say, not reasonably foreseeable. And these are extreme or bizarre scenarios that you cannot predict. And it's I find it quite interesting because manufacturers find it quite difficult to make a distinguish between the two. Bottom line, if you can reasonably predict it, you must address it within your risk management. And that's my take on what is reasonably foreseeable misuse. Now, moving on to some example of hazards because hazard is at the end our source of harm and everything starts with from hazard. I would like to refer to this great table that we have from ISO 14,971, so table c one. And we often use this table as, let's say, a hazard checklist. It's a great starting point for us as the, let's say, risk managers to identify what hazards could be possibly linked to my product. So I just simply go through all of the hazards and see which one is applicable depending on my product. And as you can see, we have different categories of, let's say, hazards. So just going through one category. So for electrical energy, we have electric field leakage of currents, earth leak, enclosure leakage, and then it jumps into, let's say, subcategories of what this hazard can be. That's a great starting point if you don't know where to start to identify what are the hazards for your product. Now, moving on to the next important component for our risk estimation, we would like to point out to the severity of harm. So it's one major issue that I see with many of the risk analysis that we receive from the manufacturers and our clients is that they place, for instance, burn as a general harm and assign it, let's say, a single severity level. And this is fundamentally problematic because as we have just seen, burn have different severities. When you then apply this to your risk analysis, you might have two risk scenarios with same harm listed, but the actual severity differs significantly. You can have, let's say, first degree burn and maybe third degree burn depending on what was the height of the situation and what is the time and exposure in which the user is exposed to. And as a result, you are either overestimating or worse, you're underestimating your risks. And you need to be more specific about, let's say, the severity of which the harm can take place depending on the hazardous situation. That's just one thing I would like to point out. So now we understood what is hazard, and now we understood some examples of what could be severity of harm. And now let's see if we can make a connection between the two. Yeah? So we have different severity of harms, and this is, let's say, a standard five scale range for severity of harm we have from negligible to catastrophic. And this is typical. You would see it in many risk management plan. However, if you must design this specifically based on your product. So every risk management plan should have their own portfolio designed specifically for the device that we have in scope, yeah? And now to make the connection that we have between hazard, foreseeable sequence of events, and hazard situation which leads into harm. So between hazard, which is the source of harm and harm, there are things that happening in between and what are those. So this is where we have foreseeable sequence of events and hazardous situations coming into play. And this is again an example from ISO 14,971, and it brilliantly illustrates the causality chain, let's say. And just to walk you through one examples, we can see that for electromagnetic energy, we have it as the hazard. And the foreseeable sequence of event that's, for example, the electrode cables are unintentionally plugged into mains. That's, let's say, the sequence of events. And the hazardous situation is line voltage appears on electrodes, and the harm can be serious burns or heart fibrillation. As you see, the harm is applying to the user and that's, let's say, our endpoint. And it all starts from hazards. So between half, let's say, a series of events. And just to put this into a little bit better illustration for you, We have it in this slide. It starts with a cause, a potential source of harm. And then this leads to a hazard which can trigger one or more incidents. So we have let's say sequence of events which creates a hazardous situation, which leads into a harm. Then that would be, let's say, a typical risk line that we define in our risk analysis. And to, let's say, quantify this, we analyze this by assigning what is the severity of harm and what is the probability of occurrence. Severity of harm, we already covered a little bit. Probability of occurrence is a little bit trickier topic for some, so I would like to cover this next. And for that we have, let's say, a definition also from ISO which I would like to go through. So this is critical to understand correctly because probability of occurrence means how likely it is that for a given hazardous situation, a specific harm will occur. Note the emphasis that it's always linked to the defined harm. That's what we're always focusing on. And it's not simply just the probability of a component failure. Yeah? Instead it's about the probability that the whole chain from hazard to hazard situation can take place and lead into harm to patient or the user. A way to quantify this as a recommendation, we have it at two points, probability points. So with two p one and p two, as you see from the slide, we have probability that hazardous situation occurs, probability that this hazardous situation leads to harm. These are two different things as defined here. And then you have the overall probability defined as the multiplication of two. It's an interesting concept that you can use, But if you want to have things a little bit more simplified and you see that it's not applicable for your product, there are other ways that you can also define this. So example of probability of recurrence, we have two ways to look into it. So we have the qualitative approach, and we have the quantitative approach. So on the left, we have the quantitative description like always frequent probable down to, let's say, extremely improbable possible. And then these are, let's say, useful for your quantitative data. On the right, we have, let's say, the quantitative estimate. So these are estimates that are calculated based on the device's service life. Maybe you are referring to some PMS data for that. Or based on experience that you have from similar devices, that's also one possibility. And what's critical here is that ISO 14,971 does not mandate, let's say, specific probability level or categories. And this is going to be based on your risk management plan and your product needs. However, this needs to be justified and documented according to PMS data, according to literature, according to similar device experience or usability testing or expert opinion. So it needs to have something backing it up. In this case, I would like to give you one example of how we can calculate this. So it's just a walk through of, let's say, a practical example of how we can calculate the quantitative approach to estimate probability of occurrence of a harm. So now we are back to mathematic class. So first, we calculate the total number of application over the device's lifetime. Let's say we say that we use the device eight hours, and let's say it's a nine to five job, and we use it once application every fifteen minutes. And we have two hundred fifty days, and we know that the product lifetime as defined is, for example, five years. So then with simple calculation, we can understand that that leads us to 40,000 users per lifetime. That's let's say one number. But then how can we make this into, let's say, a probability of occurrence? Then we need some reference points to understand. For instance, we say that a sensor malfunction occurs once in every 40,000 users, and then that's a probability of 10 to the minus four. And that then corresponds to so 10 to minus five corresponds to remote in this case. Yeah, I was one slide behind so far. So we do the calculation for the users of that device, and that is into 40,000. And based on that, then we can translate this into based on data that we have for a central malfunction. And we say that this is then, that's the probability of occurrence for our products that we have calculated based on, let's say, a quantitative approach. Moving next, we have our, let's say, risk acceptance criteria. And now we have understood both the severity of harm and probability of occurrence. And we said these are the two elements we need to estimate risk. And with combining these, then we can call this a risk matrix as you see here. We have green areas which are the acceptable area, and we have red areas which are, let's say, not acceptable. And we must ensure that all risk fall into the green area, if possible, so with regard to what we have. So risk must be reduced by means of risk control measures, and you cannot simply launch, let's say, a medical device if you have all of your risk lines in the red zone on this, if you can justify them to, let's say, rigorous benefit risk analysis. And that is then a requirement we have also in the ISO 14,971. And as you can see, we have a hierarchy here and the chart is not so symmetric because, for instance, a severity of four, probability of two for us is completely unacceptable because that is a catastrophic event and we cannot even afford to have it on the lower side of the probability of occurrence. That's why the chart looks a little bit, let's say, on symmetric. So, up to this point, we have covered, let's say elements from risk analysis and risk evaluation. We have covered elements from what is the risk management review, and what are the activities that we have in terms of post markets and PMS, which feeds into risk management later. But what we haven't covered is the risk control implementation and evaluation of, let's say, overall residual risk. So let's focus on that and break that down a little bit more to understand what is risk control measures. Per ISO 14,971, we have a hierarchy of, let's say, risk control measures, and you must apply risk controls in the following priority order, if possible. And the first one is inherently safe design. That is, for instance, to make sure you use safer materials, design out sharp edges, build your design in the safe way. And with that in mind, you are eliminating the hazard altogether. And when a hazard is not in place, the risk simply cannot take in place. And that's why this has such high priority. So that's item A, inherently safe design and manufacture. Second item, we have protective measures in medical device. And these include, so if you cannot, let's say, change the design, what you can do is to put protective measures such as safeguards, alarms, locks, stereo barriers. And if you're dealing with software, maybe software checks, something pop ups again and again to make sure that the user doesn't make an error. So these are, let's say, protective measures in place that you can have. And finally, we have the third one in our priority list, and that is information for safety and for appropriate training to the user. Unfortunately, it's the case that with manufacturers, they're all relying on this third option and not the other two, because understandably it's the cheapest way and it's the easiest way to implement the third risk control measure and we get to why. But the priority should be following as this order, and this is the statement that we should usually see exactly as written here in your risk management policy. Important to note, if risk reduction is not practicable, It's not practical. After applying these controls, you must perform, let's say, benefits risk analysis per clause seven four. And this is, let's say, proving that the benefits risk outweighs the benefits outweighs the residual risk that you have in place. For understanding how you can perform a benefit risk analysis, I'm not going to cover it in this keynote, but you can have a look through ISO twenty four thousand nine seventy one where we have it covered there. Basically, we are looking for a little bit more in detail into what is our residual risk, what clinical outcomes we have achieved, and use clinical data to back this up and to document all residual risks, and if they remain, what's their severity, and to justify if benefits, let's say, outweighs the risk. And that's the purpose of this document. Next, we have the implementation of risk control measures. So for the implementation of risk control measures, there are two, let's say, distinct verifications required. One of them is verification of implementation, as we like to call it, and one is verification of effectiveness. What does verification of implementation mean? It means that you have, let's say, a plan for implementing specific risk control measure into your design. So it can be, let's say, a design, it can be software architecture, it can be your labeling verification. It's these documents that leads into, let's say, the planning phase of your risk control measure. And secondly, have the verification of effectiveness. And that is our evidence that, let's say, such risk control measures are in fact in place, and most importantly, they are effective. How do we show this? In case of, let's say, warnings and safety information, if you're dealing with instruction for use, we would use usability summative testing, for instance. If you have software, then we have software verification activities, design verification activities. If you have, for instance, packaging, then you have maybe some packaging testing as verification of effectiveness to show your product is to show that the risk conform measures are in fact, let's say, implemented. And that's very important evidence that we would usually expect to see in the risk analysis documents. So, since I know that as manufacturers, we love to use our third risk control measure, and that is information for safety, I would just like to clarify how can we use this. So here we're looking at, let's say, what residual risks might be remaining depending on the severity, and what does this translate to into instruction for use. Again, risk control measure information for safety should not be our first priority. First priority should be changing the design and adding protective measures. And thirdly, to add risk control measure as information for safety. But if you have, let's say, residuals that needs to be still disclosed, depending on the severity and probability, where do they fall into this chart, you can decide what type of caution, warning, or danger message you cannot place into your instruction for use or your labels. Notice that we have also one small place, the blue section, the notice, and that is everything that is not safety related. Regarding the product, you would like to disclose information. And that should be, let's say, a good guide for you to understand how can you present such risk control measures in terms of information for safety to the user. Now, to connect the dots a little bit more, and to give you also an example of usability, I have placed for you here a chart to show you. So we have from cause to, let's say, hazard to hazardous situation and harm. And notice this is an example for use error. So the user makes an error due to poor layouting or so, and that is related. Let's say, that's the scope of IEC sixty two three six six one. And then we have a product in place, and for that we have product specific standards. And these standards ensure that, let's say, while we are in the design and development phase of our product, we plan our product in a way that can, let's say, function as intended. So we have product specific standards. And then we have environmental conditions. You see above the picture for the device. And these environmental conditions are including, for instance, lighting condition, noise level, space constraint, and distractions. So these are, let's say, factors that can add to what is realistic, also, usability testing when you were performing a testing. And finally, we have the next step that's in the hazard. So, for example, for a device which is intended to device some vital display for whatever reason, we have no display at all, so no delivery. And what happens here, in a sequence of events, we have a hazardous situation which eventually leads into harm depending on time and exposition. And the harm, for instance, as an example, can be organ damage to the user. And that's the general scope. And as you can see, ISO 13,485 is our quality management system where all of the above falls under it. And that's an important message also. So, now that we have understood, let's say, the basics, and now I can explain to you what are the common mistakes and what needs to be avoided, I think it's a good time to go ahead with that. And for that, we look into thought management and risk management process mistakes, risk management plan shortcomings, and when it comes to risk evaluation, what are the common mistakes. So, first, we have it a lot that often no documented, let's say, periods are for reviews of the risk management process has been documented. And you cannot prove that management is actually checking if the system, risk management system works. As you saw, we had the requirements above also for that. Secondly, we have it that the risk management process runs in isolation. As you remember, we said we have a lot of interfaces coming to risk management, including post market data production issues that must be fed into risk management. And sometimes there's not even a reference to these documents. And we have it a lot that the note for everybody asks, what is the evidence that you are implementing, let's say, PMS into your risk management? Because in risk management policy or plan, I cannot find any evidence. So that's one other one. Third one, so we're now moving to the risk management plan. We have a lot that it's only covering the development and design phase, and it's ignoring all of the life cycles. So manufacturing, distribution, storage, disposal, maintenance, all of that is missing. It's only R and D. That's also a very common mistake. Fourth, with regard to the risk management plans, so it's the fifth bullet points here. We have, let's say, no defined approach for accepting or managing risks when probability of harm, let's say, cannot be estimated. And that is really important that needs to be addressed hugely in your risk management plan. What's the policy when this cannot be estimated? How do you deal with it? Finally, we have the, let's say, plans, collection, and review of production, and post production information. Again, this is something related to the life cycle, and it's often missing, and it's not clear if there is actual evidence. There are no references. And unfortunately, sentences like we will monitor, so on and so on, is not sufficient. You need to have specific references to those processes, to those documents to have it as an objective evidence, etcetera. Next, we are covering, let's say, what are the common mistakes we have with regards to risk evaluation and risk assessment. So first is very simple, but I have seen it many times, and it has been pointed out, is that there is a mismatch between what has been defined. So we have this risk acceptance criteria, and what has been, let's say, provided within the risk analysis. For one risk line probability for severity two is unacceptable in the risk management plan, but it is for some reason acceptable. It could be basically, it could be a simple human error, but this is something that we have seen a lot. Secondly, we have incorrect use of ISO 14,971 terminology. And I have seen it very often that hazard and harm is very much mistake. Again, hazard is the source of harm. And we have examples of such, and these are often swapped. And sometimes the harm, as described in the risk analysis does not make sense. Thirdly, we have the foreseeable misuse scenarios, or let's say precedent in the instruction for use, but not reflected in the risk analysis. You have sometimes risks disclosed in the instruction for use, but then you look into the risk analysis and such risk has not been identified. And that's also one shortcoming that we have seen. And other way around also is quite applicable. And, nicely, we have the sequence of events and hazardous situation. I have seen in many occasions that for this, as you saw, we have to give, let's say, a sequence of events. What leads to what to what that leads into, let's say, a hazardous situation. And simply putting few words is not enough description to explain the risk. Next, we have probability ratings set by default to low. And that is just, I'm guessing, to make our own work easier. But if you open a risk analysis for a high risk profile device and everything is set as probability one, that is just not a good look. Reduction of larger than two points, I'm talking about reduction of probability of occurrence. So you go from probability five to probability two or probability one. I have seen that in risk analysis, and that is also not acceptable, especially if your only risk control measure is information for safety. So there needs to be, let's say, a logic on how much you reduce probability of occurrence. And finally, I think I said this many times, overreliance on IFU warnings and training materials as primary controls, instead of design changes and protective measures. With that in mind, that covers today's keynote. It covers the content that I wanted to deliver to you. I hope that you have enjoyed. But before we finish, I would like to also introduce to you some of our services, other services that we have. So for PMCF, you can scan the bar code here and you will see a list of services that we provide for PMCF activities. And in addition to that, we have also additional materials that you can read through, which are useful for you for knowledge and also to have an idea of what services we offer for you. And so, yeah, we have tech file factory, clinical affairs, and some of the, let's say, recommendation on what is regulatory compliance depending on jurisdiction. So you can have a look at these brochures as well if you want. Finally, we have the upcoming webinars, and they are free of charge. And just like today, you can sign up and watch them. And I believe they are valuable for manufacturers to, first of all, understand the concept and to have some feedback also from us to understand what are the shortcomings in each of the topics. And we enjoy giving these trainings also very much. So now, I have come to the end of the keynotes. It's exactly on time. I would quickly check some of the questions. I try to answer the shorter one and the longer one. I would go through it, let's say, through email response. I'm not sure if the time would allow. So one question on, let's say, predicate devices. So you are also taking into account what adverse events you had with the predicate device. And for that then you can let's say perform a root cause analysis to see what was the root of the problem, and to try to implement that into your design of your product. We have another question. Can the risk control measure information for safety reduce the RPN? So in most cases, it is possible to reduce the probability, but I would only recommend to reduce the probability of the occurrence by one point and no more than one point when it comes to, let's say, your risk analysis. That's important to take. What other? Yes. So electric shock, electric energy is the category of the hazard. So the slide I showed for you, it's a category of hazards that we have. And if you look at the subcategories, shock is one of them, I believe. I hope that answers also your question. I don't know if there are any more questions. Yeah. Okay. Doesn't seem to be any other questions at the moment. But Yeah. So how do we handle low severity but reoccurring incidents? So we're talking about severity one, probability five, let's say in the risk index that we had. Obviously, if we are in an area that's probability is five and severity is one, that is still unacceptable for us. And our responsibility as a manufacturer is to make sure that we reduce risk as far as possible without affecting the product benefit, let's say, and that is very important. So still, even though it is the lowest severity, we must ensure to reduce risk as much as possible. I believe I answered all of the questions in the session. In that case, I wish you a great afternoon. One more question. How do we handle hazardous situations that occur sometimes, but the harm never occur or hardly ever occurs. So when we're looking at probability of occurrence, we are always looking at what is the probability of occurrence that such harm can take in place. And in that case, you can look at, for example, the two factor, the two probability factor that we had early on in the presentation. That's one way to look at it. And if it's the case that the probability of the sequence happening is very low or very high, and the probability of, let's say, such harm actually taking place is very high or low, then it can affect what we have as our overall understanding of what is the risk level. So we need to look into both combination, and that is our recommendation. Okay. Thank you very much. If you have any other questions, feel free to add them here. I would try to answer to you via email. I hope that you enjoyed the keynotes. And I look forward to see you in the upcoming keynotes, and I wish you a great afternoon or day, and see you until next time. Thank you very much.