Process rating; The capability section is introduced by listing Reporting and inputs to the risk the capability scale against which each process is management process. measured. The capability scale will be based upon ISO/IEC 15504-2 capability scales. A detailed breakdown of each activity into tasks will be described in the framework. Each process 7.3.2. Process Assessment activities. A medical included in the assessment will be assessed on the device software process assessment will consist of basis of available evidence. the following activities: The evidence may be gathered using interview, Initiation; inspecting organisational documents or analysing metrics. The information collected for each process Planning; area will meet assessment objectives and scope. Information that supports a particular process rating Briefing; will be recorded and maintained as evidence to Information and metrics acquisition; substantiate the ratings and to verify compliance with the requirements. Information and metrics validation; In addition to ISO14971, best practice models such 7.3.3. Risk management. The framework will as FMEA for medical devices will be introduced to include a last important step and identify, assess, reduce, accept, and control “Reporting providing inputs to the Risk Management Process”. software risks in a systematic proactive, The risk management process area is both a comprehensive and cost effective manner taking process area and the step of the assessment into account the project’s technical and activities, as it is important that risk management programmatic constraints. Risk identification is assigned a separate process area and that issues within the framework will consist of 5 stages found in other process areas are also reported into the risk management process. This is particularly important to software developed or implemented Stage 1 Creation of a forum for risk assessment. – in the medical device industry, as it is necessary to implement a risk management strategy throughout development. The risk management guidelines Stage 2 Systematically identify risk. – within the framework will acknowledge and endorse the ISO14971:2000 standard for of Risk Management to Medical “Application The Software Risk Taxonomy checklist (that Devices”. includes checklists relating to the regulatory standards and the SEI Software Risk Taxonomy
The capability section is introduced by listing the capability scale against which each process is measured. The capability scale will be based upon ISO/IEC 15504-2 capability scales. 7.3.2. Process Assessment activities. A medical device software process assessment will consist of the following activities: Initiation; Planning; Briefing; Information and metrics acquisition; Information and metrics validation; Process rating; Reporting and inputs to the risk management process. A detailed breakdown of each activity into tasks will be described in the framework. Each process included in the assessment will be assessed on the basis of available evidence. The evidence may be gathered using interview, inspecting organisational documents or analysing metrics. The information collected for each process area will meet assessment objectives and scope. Information that supports a particular process rating will be recorded and maintained as evidence to substantiate the ratings and to verify compliance with the requirements. 7.3.3. Risk management. The framework will include a last important step “Reporting and providing inputs to the Risk Management Process”. The risk management process area is both a process area and the step of the assessment activities, as it is important that risk management is assigned a separate process area and that issues found in other process areas are also reported into the risk management process. This is particularly important to software developed or implemented in the medical device industry, as it is necessary to implement a risk management strategy throughout development. The risk management guidelines within the framework will acknowledge and endorse the ISO14971:2000 standard for “Application of Risk Management to Medical Devices”. In addition to ISO14971, best practice models such as FMEA for medical devices will be introduced to identify, assess, reduce, accept, and control software risks in a systematic proactive, comprehensive and cost effective manner taking into account the project’s technical and programmatic constraints. Risk identification within the framework will consist of 5 stages Stage 1 – Creation of a forum for risk assessment. Stage 2 – Systematically identify risk. The Software Risk Taxonomy checklist (that includes checklists relating to the regulatory standards and the SEI Software Risk Taxonomy
A_Software_Process_Development_No.55.docx