[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-200706-105":53,"doc-detail-200706-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","improving-software-risk-management-practices-in-a-medical-device-company","Improving Software Risk Management Practices in a Medical Device Company","","Medical devices increasingly rely on software, and market approval depends on meeting regulatory requirements and producing a design history file. Patient and end-user safety requires an effective, efficient software risk management process. The authors develop the RM Capability Model (RMCM), integrating medical-device risk management obligations with CMMI Capability Maturity Model Integration goals and practices. The paper evaluates how introducing RMCM into a medical device company improved its risk management process.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":51,"@type":70,"position":76},"https://docshare.wps.com/template/general/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/improving-software-risk-management-practices-in-a-medical-device-company/200706/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/improving-software-risk-management-practices-in-a-medical-device-company/200706.png","ImageObject",442,249,{"name":88,"@type":89},"Margaret","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/vnd.openxmlformats-officedocument.wordprocessingml.document","2026-09-27","2026-09-04",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",7,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"Why is software risk management critical for medical device companies?","Question",{"text":109,"@type":110},"Medical device companies must ensure compliance and achieve regulatory approval, and software safety is a primary concern. Inadequate hazard analysis and risk management can lead to inability to sell devices in certain markets.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"How does the RM Capability Model (RMCM) relate to CMMI and regulatory requirements?",{"text":114,"@type":110},"RMCM is an extension of the risk management process area within CMMI, tailored to medical-device software risk management regulations. It integrates requirements derived from FDA guidance as well as standards such as ISO 14971 and IEC 62304.",{"name":116,"@type":107,"acceptedAnswer":117},"What problem does the paper address regarding testing software in medical devices?",{"text":118,"@type":110},"Even simple software cannot practically test all possible execution paths. Therefore, software quality cannot rely on testing alone and must be supported by disciplined engineering practices with risk management as a core activity.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},200706,1788510170,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":50,"category_name":51,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":136,"language":137,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":138,"faqs":139,"seo_title":140,"seo_description":61,"update_tm":126,"read_time":76},137451207643,"https://ap-avatar.wpscdn.com/davatar_3d24733baf745e90a7e4bdd5f77d97b2","Improving Software Risk Management Practices in a Medical Device Company\nJohn Burton1, Fergal McCaffery2, Ita Richardson1\n1 Lero – the Irish Software Engineering Research Centre, University of Limerick, Ireland\n2 Dundalk Institute of Technology, Dundalk, Ireland\n\u0013 HYPERLINK \"mailto:John.Burton@ul.ie\" \u0014John.Burton@ul.ie\u0015, \u0013 HYPERLINK \"mailto:Fergal.McCaffery@dkit.ie\" \u0014Fergal.McCaffery@dkit.ie\u0015, \u0013 HYPERLINK \"mailto:Ita.Richardson@ul.ie\" \u0014Ita.Richardson@ul.ie\u0015\nAbstract. Software is becoming an increasingly important aspect of medical devices (MDs) and MD regulation. MDs can only be marketed if compliance and approval is achieved from the appropriate regulatory bodies. MD companies must produce a design history file detailing the processes undertaken in the design and development of their MD software. The safety of all MD software produced is of primary importance and it is crucial that an effective and efficient risk management (RM) process is in place. The authors have developed a software process improvement RM model that integrates regulatory MD RM requirements with the goals and practices of the Capability Maturity Model Integration (CMMI). This model is known as the RM Capability Model (RMCM). This paper evaluates how introducing the RMCM into a MD company improved their RM process. \u000b\u000bKeywords. Risk Management, Process Assessment, Software Process Improvement, Medical Device Standards, Compliance, CMMI, FDA, BSI, Action Research, Evaluation, Verification.\nIntroduction\nThe MD industry is currently one of the fastest growing industries in the world.  According to the World Health Organisation, in 2000, it was estimated that there were over one and a half million different MDs (incorporating MDs containing software) available on the market, representing a total value of over €114 billion [1] and were expected to grow to in excess of approximately €205 billion in 2006.\nSoftware RM within MD companies is a critical area.  MD manufacturers that do not devote sufficient attention to the areas of hazard analysis and RM are penalised as failure to comply can result in surrendering their legal right to sell their device in a specific market. However, with so many different standards, regulatory guidance papers and industry guides on RM, the task of collating this information into a usable model is a daunting one.  In an attempt to resolve this issue, the RMCM [2] was developed through extracting concepts from a number of industry accepted standards and guides. The RMCM is an extension of the RM process area within the CMMI but is specifically tailored to fulfil the RM regulations of the MD software industry.\nMedical Device Regulation\nRegulatory bodies worldwide are tasked with the job of ensuring that only safe MDs that cannot cause serious harm or injury to a patient or end-user are marketed.  Clearance of MDs varies between countries.  In the European Union, MD companies receive a European Community (EC) certificate and a CE mark (a European conformity mark). In the United States, the device manufacturer receives a Marketing Clearance (510K) or an Approval Letter for Pre Market Approval (PMA) from the Food and Drug Administration (FDA).\nTypically, before a MD company is certified to sell their product in a country, they must follow the registration or licensing procedure of that country.  This in turn establishes a contract between the device manufacturer and that country, whereby the device manufacturer is obligated to perform both pre-market and post-market duties as defined in the quality system requirements.  The quality system is defined as the organisational structure, responsibilities, procedures, processes and resources required to implement quality management. Applicable requirements are typically directly related to the regulatory classification of the device.  This in turn defines the potential of that device to cause harm.  However, hazard analysis and RM are key components that are applicable to all classes of device.  ","cbCaimQhi44uKCgu","https://ap.wps.com/l/cbCaimQhi44uKCgu","docx",46135,8,"English","# Introduction\n# Medical Device Regulation\n# Risk Management in Software\n# Overview of RMCM","[{\"question\":\"Why is software risk management critical for medical device companies?\",\"answer\":\"Medical device companies must ensure compliance and achieve regulatory approval, and software safety is a primary concern. Inadequate hazard analysis and risk management can lead to inability to sell devices in certain markets.\"},{\"question\":\"How does the RM Capability Model (RMCM) relate to CMMI and regulatory requirements?\",\"answer\":\"RMCM is an extension of the risk management process area within CMMI, tailored to medical-device software risk management regulations. It integrates requirements derived from FDA guidance as well as standards such as ISO 14971 and IEC 62304.\"},{\"question\":\"What problem does the paper address regarding testing software in medical devices?\",\"answer\":\"Even simple software cannot practically test all possible execution paths. Therefore, software quality cannot rely on testing alone and must be supported by disciplined engineering practices with risk management as a core activity.\"}]","Improving Software Risk Management Practices in a Medical Device Company | DOCX"]