What is Risk Assessment and Control Table (RACT)?

The RACT is a large table, called by many other names (e.g. risk matrix, risk analysis chart, risk table). It is a risk management tool that integrates the results of all the analyses performed at lower levels of the device system and enables the computation of residual risks for the system. It contains information, such as the results of the hazards analyses, risk estimations and risk evaluation. It also captures the risk control option analysis, showing which risk control options were considered and implemented.

As overall, the RACT tells the story of how each hazard in the medical device system manifests itself, what causes it, how the exposure to it happens and what harms could follow. Additionally, RACT computes all risks (individual and overall) and can compare them against the risk acceptability criteria.

A template of what RACT could look like is presented in the table below. Quantitative risk management method is used. The template doesn’t show pre-/post risks, only the final risks of the medical device system. So, to track the pre-/post risks, the below template needs to be modified, which can be easily done by replicating columns P1 through Negl-Risk.

RACT is a living document that continuously evolves. Given that, it’s a good practice to have an earlier version of it called “pre-risk” and use its last version as “post-risk”.

RACT workflow

According to the above template, the workflow for RACT can be described in the following way:

• Examination of the clinical hazards list (CHL): By using the Clinical hazards list (CHL), all applicable hazards has to be defined in the hazard column. All not applicable entries in the CHL must be rationalized in the hazard analysis report, and if there are any new hazards identified in the underlying analyses, they need to be included in the RACT and the CHL updated.
• Capturing end-effects and safety impact: After examining the DFMEA, PFMEA and UMFMEA, the end-effects with a safety impact of Y has to be imported into the hazards column.
• Populating the column ‘Initial cause and sequence of events’: Initial cause of hazard and sequence of events are captured from the FMEAs for all the entries collected from the underlying FMEAs and added to the RACT.
• Populating the column ‘Hazardous situations’: This is where all hazardous situations have to be defined.
• Revising the preliminary hazard analysis (PHA): The goal is to capture any relevant information in the PHA missing from the RACT.
• Populating the P1 column: P1 provides information about the likelihood of occurrence of the hazardous situation.
• Populating the risk control and harm columns: The risk control column is divided into 3 subcolumns (safe by design, protective measures, information for safety) which consist of narratives describing the strategies for controlling the risks of the hazardous situations. The Harms assessment list (HAL) is used for providing the entries in the harm column.
• Populating the P2 columns: P2 numbers represent simple lookups from the harms assessment list, expressing the likelihood of sustaining different harm severities from the same hazardous situation.
• Computation of the risks: The computation of risks can be easily done automatically in a spreadsheet. It relates to multiplying P1 by the 5 P2 numbers.
• Risk evaluation: Once the quantitative risk acceptance criteria are defined in the risk management plan, the risk evaluation could be automated by numerical comparison between the computed risks and the risk acceptance criteria.

Depending on the selected risk estimation method, different ways for risk computation can be used. In a quantitative risk management method (e.g. BXM method), Boolean algebra can be used for computing the per-Hazard, per-Hazardous situation and overall residual risks. In semi-quantitative and qualitative methods, internal policies for the risks’ determination and evaluation has to be created by the manufacturer.

Source:
1. Elahi, B. (2018). “Safety risk management for medical devices”. Academic Press