ISO/TR 18965:2025

Technical
Report
ISO/TR 18965
First edition
Medical devices — Examples of the
2025-02
application of the risk management
process to cardiac valve
replacement and repair systems
Dispositifs médicaux — Exemples d'application du processus
de gestion des risques aux systèmes de remplacement et de
réparation des valves cardiaques
Reference number
© ISO 2025
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 General risk management requirements . 1
5 Risk analysis . 2
5.1 Risk analysis process .2
5.2 Identification of intended use .2
5.3 Identification of reasonably foreseeable misuse .2
5.4 Identification of system characteristics related to safety .3
5.5 Identification of hazards, hazardous situations and associated harms .4
5.6 Risk estimation .6
5.6.1 General .6
5.6.2 Probability of occurrence classification .6
5.6.3 Bench testing (pre-clinical) data .6
5.6.4 Historical data .7
5.6.5 Expert judgment .7
5.6.6 Severity classification .8
6 Risk evaluation . 8
7 Risk control . 9
7.1 Risk control option analysis and implementation .9
7.2 Assessment of risks arising from risk control measures .10
7.3 Residual risk evaluation .10
7.4 Benefit-risk analysis .10
8 Evaluation of overall residual risk .11
9 Risk management review .11
10 Production and post-production activities .11
10.1 Clinical feedback mechanisms .11
10.2 Production feedback mechanisms . 12
10.3 How to manage risks throughout product lifecycle . 13
10.3.1 Immediate actions when risks are identified . 13
10.3.2 Assessment of change impact on clinical data . 13
11 Modified device considerations . 14
Annex A (informative) Risk assessment example template for a cardiac valve replacement
system.16
Bibliography . 19

iii
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out through
ISO technical committees. Each member body interested in a subject for which a technical committee
has been established has the right to be represented on that committee. International organizations,
governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely
with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of ISO document should be noted. This document was drafted in accordance with the editorial rules of the
ISO/IEC Directives, Part 2 (see www.iso.org/directives).
ISO draws attention to the possibility that the implementation of this document may involve the use of (a)
patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent
rights in respect thereof. As of the date of publication of this document, ISO had not received notice of (a)
patent(s) which may be required to implement this document. However, implementers are cautioned that
this may not represent the latest information, which may be obtained from the patent database available at
www.iso.org/patents. ISO shall not be held responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 150, Implants for surgery, Subcommittee SC 2,
Cardiovascular implants and extracorporeal systems.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.

iv
Introduction
Risk management is the underlying foundation of the product development process and should be considered
throughout all phases of the product development cycle. This document provides guidance to assist
manufacturers on the application of the risk management process, as described in ISO 13485 and ISO 14971,
to cardiac valve replacement and repair systems. Figure 1 demonstrates the relationship between the risk
and device standards as well as the applicable Technical Reports that support the risk management process.

v
Technical Report ISO/TR 18965:2025(en)
Medical devices — Examples of the application of the risk
management process to cardiac valve replacement and
repair systems
1 Scope
This document illustrates the implementation of the risk management process to the total product life cycle
of cardiac valve replacement and repair systems. It provides specific examples of how risk management
requirements and concepts can be applied to new or modified cardiac valve replacement and repair systems.
The informative examples included herein are not exhaustive.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content constitutes
requirements of this document. For dated references, only the edition cited applies. For undated references,
the latest edition of the referenced document (including any amendments) applies.
ISO 5840-2, Cardiovascular implants — Cardiac valve prostheses — Part 2: Surgically implanted heart valve
substitutes
ISO 5840-3, Cardiovascular implants — Cardiac valve prostheses — Part 3: Heart valve substitutes implanted by
transcatheter techniques
ISO 5910, Cardiovascular implants and extracorporeal systems — Cardiac valve repair devices
ISO 14971, Medical devices — Application of risk management to medical devices
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO 5840-2, ISO 5840-3, ISO 5910 and
ISO 14971 apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at https:// www .electropedia .org/
NOTE The defined terms in ISO 5840-2, ISO 5840-3, ISO 5910 and ISO 14971 are derived as much as possible from
ISO/IEC Guide 63, which was developed specifically for the medical device sector.
4 General risk management requirements
Decisions and actions, based on the information collected and analysed by application of this document,
are described in other standards, such as ISO 13485, ISO 14971 and ISO/TR 24971, and are therefore not
included in this document. The manufacturer may be required to perform other risk management activities
to fulfil applicable regulatory requirements ISO/IEC Guide 63, for medical devices that are not discussed
in this document. While regulatory requirements are not described here, this document can be helpful
for manufacturers in fulfilling those regulatory requirements. This document uses the definition of risk
management from ISO 13485 and ISO 14971.

5 Risk analysis
5.1 Risk analysis process
The risk analysis process is defined in ISO 14971 and guidance for the application of ISO 14971 can be found
in ISO/TR 24971. Risk analysis examples are provided in this document specific to cardiac valve replacement
and repair systems. These examples are provided as an illustration of how to apply the risk management
process to these devices and are not intended to be an exhaustive list.
Inputs to the risk analysis process are defined in ISO 14971 and ISO/TR 24971.
5.2 Identification of intended use
An example of the identification of the intended use of a Transcatheter Aortic Valve Replacement (TAVR)
system of one particular design, procedure, and set of use cases is shown below:
— Device or system description: The TAVR system consisting of three primary components: a bioprosthesis
consisting of bovine pericardial tissue mounted on a nitinol self-expanding frame, an 18 French catheter-
based delivery system, and a disposable loading system. The TAVR is designed to replace the native
aortic heart valve without open heart surgery and without concomitant surgical removal of the failed
native valve. The self-expanding frame is manufactured from nitinol and is composed of different strut
lengths and widths to accommodate expansion to its intended shape. The TAVR is indicated for the
replacement of a defective native aortic heart valve by transluminal delivery. The TAVR is intended to
be percutaneously inserted via the femoral artery access and deployed inside the existing failed native
aortic valve.
— Intended medical indication: treatment of aortic stenosis.
— Patient population: adults with severe, symptomatic aortic stenosis.
— Intended implant site: within a native tricuspid aortic valve.
— Intended user: health care provider suitably trained to perform procedure.
— Use environment: hospital catheter lab or operating room.
— Operating principle: delivery of heart valve substitute via transcatheter delivery under fluoroscopic
guidance; device can be recaptured and repositioned prior to final deployment.
5.3 Identification of reasonably foreseeable misuse
Reasonably foreseeable misuse is defined in ISO/TR 24971:2020, 5.2. Examples for cardiac valve replacement
and repair systems are provided in Table 1:

Table 1 — Examples of reasonably foreseeable misuse
Device type Misuse examples
— excessive crimp times;
— post-deployment dilation;
Transcatheter heart valve
— implanted outside the targeted annulus range (inappropriate
oversizing or under sizing);
— implanted outside the approved location.
— bending of stent during implantation;
— rotate non-rotatable mechanical valve after implantation;
Surgical heart valve
— surgical heart valve intentionally fractured to allow for valve-in-
valve procedure.
— gap in mitral leaflets larger than indicated gap size per device
Transcatheter repair labelling. Implanted in patient with contraindicated mitral
annular calcification (MAC).
Surgical repair — shape of annuloplasty ring deformed during surgery.
5.4 Identification of system characteristics related to safety
Identification of system characteristics related to safety are defined in ISO/TR 24971:2020, 5.3 and Annex A.
Table 2 provides example evaluations to questions in ISO/TR 24971:2020, Annex A, and the associated
hazards, hazardous situations, and harms derived from the answers. The list of answers and associated
hazards, hazardous situations, and harms are not intended to be exhaustive.

Table 2 — Examples of answers to system characteristics related to safety and the resulting
hazards, hazardous situations and harms
Question Example answers Hazards identified Hazardous situations Harm
A.2.31.4  Does the User fills the inflation User filled syringe a) THV deployed with a) aortic annular
medical device have device to specified excessive volume rupture;
a control interface? volume through bal- leading to over-
b) para valvular
loon inflation port. expansion;
leakage;
b) THV deployed with
c) migration.
insufficient volume
leading to under-
expansion.
User loads the THV Frame edges Insufficient crimping Vessel perforation
onto the delivery sys- leads to protruding
tem using a crimping frame edges that con-
accessory tact vessel wall during
tracking
User releases implant Release knob detach- Implant fails to detach regurgitation
by rotating implant ment mechanism from the delivery sys-
release knob on im- tem leading to leaflet
plant catheter handle damage
User de-airs trans- Flush port Unable to de-air Myocardial infarction
septal sheath through through flush port, or stroke
designated flush therefore air bubbles
ports on handle exit sheath tip during
procedure
User rotates a cinch- Cinching mechanism Unable to cinch appro- Regurgitation
ing mechanism to priately, mis coaptation
contract the posts of the leaflets due to
trapping leaflets behind
suture
A.2.4  What materi- Biological tissue for Pericardial bovine Insufficient rinse Systemic inflamma-
als or components valve leaflets leaflets packaged in during device prep ex- tion
are utilized in the glutaraldehyde posing patient to excess
medical device or glutaraldehyde
are used with, or
Nitinol for implant Presence of nickel in Nickel leaching due to Systemic inflamma-
are in contact with,
nitinol insufficient corrosion tion due to nickel
the medical device?
resistance toxicity
A.2.1  Is special Balloon inflation of Balloon Overinflation causing Annular rupture
intervention neces- stenotic leaflets on annular rupture
sary in case of fail- Surgical Replacement
Cracking of calcium Emboli
ure of the device? Valve
leads to calcium frag-
ments
5.5 Identification of hazards, hazardous situations and associated harms
Identification of hazards, hazardous situations, and associated harms are defined in ISO/TR 24971:2020, 5.4.
Table 3 provides examples of Hazards, Hazardous Situations, and Harms for cardiac valve replacement or
repair systems. This list is not intended to be exhaustive and is only being provided for consideration by
manufacturers. Consider specific design and use elements for each situation.

Table 3 — Examples of Hazards, hazardous situations and harms for cardiac valve replacement or
repair systems
Sequence of
Device type Hazard Hazardous situation Harm
events
Common to replace- Introducer sheath Catheter inserted Haemostasis valve Minor blood loss
ment and repair inserted into patient into sheath damages unable to seal around
devices vasculature sheath seal due to catheter.
incorrect geometry
(seal ID)
Material is insufficient Haemostasis valve Minor blood loss
durometer to form unable to seal around
seal around catheter catheter
Catheter coating High push force at Vascular access site
incompatible with seal access site hematoma
material
Transeptal puncture High transeptal punc- Needle perforation Pericardial effusion
in atrium to access ture location into pericardial space
mitral valve
Replacement valves Replacement of aortic Flow stagnation with Valve leaflet thick- Valve stenosis
valve using biologi- insufficient washout ening
cal prosthetic tissue
valve
Repair devices Implant requires Unintentional Grasping feature Severe regurgitation
grasping of mitral grasping of chordal ruptures chords
leaflets structure
The list below provides examples of harms associated with cardiac valve replacement and repair systems.
This list is not intended to be exhaustive and is only being provided for consideration by manufacturers.
Consider specific design and use elements for each situation:
— blood loss – major;
— pericardial effusion leading to cardiac tamponade;
— endocarditis;
— embolic event or stroke or myocardial infarction;
— annular damage;
— subvalvular structure damage;
— ventricular damage;
— conduction disturbance;
— vascular access site damage;
— renal failure;
— coronary obstruction;
— heart failure;
— recurrent or residual moderate to severe regurgitation;
— prosthetic valve leaflet thrombosis;
— clinically significant atrial shunt caused by septal puncture;
— prosthetic valve leaflet calcification;

— prosthetic valve stenosis;
— haemolysis;
— outflow tract obstruction;
— coronary vessel damage;
— native leaflet tear;
— chordal rupture;
— native valve stenosis.
5.6 Risk estimation
5.6.1 General
The following clauses refer to risk estimation based on occurrence and severity rates. Analysis of risk
estimation is defined in ISO/TR 24971:2020, 5.5.
5.6.2 Probability of occurrence classification
To facilitate risk estimation for identified failure modes, verification and validation testing, historical data,
predictive techniques, and expert judgement can be used to assess the failure probability quantification
for devices, both with and without any direct clinical history. Table 4 is an example of a five level semi-
quantitative probability level table for a medium volume medical device typical of valve replacement
or repair. The example is only for illustrative purposes and the probabilities can be adjusted based on
anticipated sales or usage volume.
Table 4 — Example of a five level semi-quantitative probability level table
[Occurrence ranking for medium volume products (50,000 to 750,000)]
Quantitative estimate of occur-
Qualitative estimate of occurrence Occurrence rank
rence (P % rate)
The occurrence is improbable or
P ≤ 0,001 %
highly unlikely. The failure is not 1
(≤1/100,000)
expected to occur.
The occurrence is remote. Failures 0,001 % < P ≤ 0,01 %
are seldom expected to occur.
(1/100,000 < P ≤ 1/10,000)
The occurrence is occasional.
0,1 % < P ≤ 0,1 %
Failures may occur at infrequent 3
1/10,000 < P ≤ 1/1,000
intervals.
The occurrence is probable. Repeat- 0,1 % < P ≤ 1,0 %
ed failures are expected to occur.
1/1,000 < P ≤ 1/100
The occurrence is frequent. Failure
P > 1,0 %
may be almost certain with high num- 5
P > 1/100
ber of occurrences likely.
The following are examples of methods that can be used to estimate the probability that a hazardous
situation could occur (P ) and the probability of the hazardous situation to cause harm (P ):
1 2
5.6.3 Bench testing (pre-clinical) data
Bench testing data can be collected throughout the development cycle, including design verification
and validation, characterization testing, and process or lot verification testing. It can also be used in
conjunction with predictive modelling (e.g. finite element analysis, Monte Carlo simulation) to further assess
probabilities.
Figure 1 is an example of using design verification test data to estimate the probability of a specific situation
from occurring (P ). Assuming all test methods are clinically relevant, the distribution of bond strength can
be compared to the expected deployment forces from a separate design verification test and the overlapping
region can provide an estimate of the probability of failure due to a bond breakage. The overlapping region
can be calculated with confidence intervals if each of the distributions can be modelled (e.g. normally
distributed, Weibull, log-normal etc.). Additionally, the probability of the bond breakage leading to a specific
harm (P ) can be estimated based on state-of-the-art knowledge (i.e. literature, prior clinical experience
and bench testing) from the device or similar predicate devices. For instance, suppose there were 100 bond
failure events in clinical use of a predicate device; however only 5 resulted in patient harm (e.g. conversion
to surgery). The P occurrence rate for the potential for patient harm could be estimated to be 5 %. If there
is no state-of-the-art knowledge for the device, use a conservative estimate of P equal to 100 % occurrence
rate of patient harm.
Key
X force
Y probability
1 distribution of deployment force
2 distribution of bond strength
3 overlapping region (equating to probability of failure)
Figure 1 — Example of design verification test data to estimate the probability of a specific situation
from occurring
5.6.4 Historical data
Historical data that exists for similar or equivalent products or components. For instance,
...