AFAP As Far As Possible – Risk Reduction...

Information & Training. | Risk Management.

“As Far As Possible” (AFAP) versus “As Low as Reasonably Practicable” (ALARP).
For manufacturers of medical devices, when looking to manage and reduce risk, many have looked to the ISO 14971 standard as a means of managing the risks associated with the manufacture and processing of their medical device. This standard references and suggests the use of ALARP. As a result ALARP has become widely applied and is the basis for the acceptance by many manufacturers of the low to moderate levels of residual risks which may be associated with the development, processing and use of their medical devices.

However, ALARP is now no longer going to be acceptable (in Europe at least).

Under the incoming European Medical Device Regulations (MDR’s), the requirement for those involved in development and manufacture of Medical Devices is that all risks need to be reduced “as far as possible”.

What is the difference? Well there is quite a significant difference.

Basically ALARP allows a manufacturer to include economic impacts into considerations as to what are acceptable and unacceptable risks. AFAP (as far as possible), does not allow economic impacts to form part of the risk decision making process.

As the European Medical Device Regulations come into legal force across the European area, those manufacturers, which have been using ALARP in the risk management processes will need to change over to AFAP. In some cases, where economic considerations have been part of the risk decision processes, then changes will need to be made to align with the AFAP requirements, otherwise such medical devices may not be legally marketed across the European Market.

AFAP As Far As Possible. Risk reduction.

AFAP As Far As Possible. Risk reduction.  …  Risk Management:
Risk Identification. Risk Evaluation. Risk Mitigation. Risk Control. Etc..
Requirements. Standards. Current best practices. … …Information & Training Presentation.

To explain:

In the 2012 version of ISO 14971, Annex D. D.8, the concept of ALARP is detailed.

“When establishing the risk acceptability policy, the manufacturer might find it convenient to use an as-low-as reasonably-practicable approach”.


The standard then goes on to explain how economic factors can input into the risk decision processes:

“After a particular risk control option has been applied, there are three possible results:

a) the residual risk exceeds the manufacturer’s criterion for risk acceptability;

b) the residual risk is acceptable because it is so small as to be negligible or

c) the residual risk is between the two states specified in a) and b); for these risks the residual risk is acceptable for the option that reduces the risk to the lowest practicable level, bearing in mind the benefits resulting from its acceptance and taking into account the costs of any further reduction.”

The standard specifically, states that the costs associated with further reduction of residual risks can be considered and justification of not taking further risk reduction activities are acceptable if the costs associated with such actions are not justifiable.

ALARP has been frequently legally interpreted, and detailed into various legal acts, along the basis that the “implementation of risk-reducing measures until the cost of further risk reduction is disproportional to the potential risk reducing effect achieved by implementing any additional measure.”


However, the European Medical Device Regulations’ detail that all risks associated with medical devices be reduced as far as possible (AFAP).


Per Article 10, 2 of the Medical Device Regulations (EU MDR 2017 / 745). Manufacturers are required to establish, document, implement and maintain a product safety risk management system. The detailed requirements of the system are listed in the Annex I Chapter I, points 2-9.




General Requirements. Part 1.

“Devices shall achieve the performance intended by their manufacturer and shall be designed and manufactured in such a way that, during normal conditions of use, they are suitable for their intended purpose. They shall be safe and effective and shall not compromise the clinical condition or the safety of patients, or the safety and health of users or, where applicable, other persons, provided that any risks which may be associated with their use constitute acceptable risks when weighed against the benefits to the patient and are compatible with a high level of protection of health and safety, taking into account the generally acknowledged state of the art.”

General Requirements. Part 2.

“The requirement in this Annex to reduce risks as far as possible means the reduction of risks as far as possible without adversely affecting the benefit-risk ratio.”


The MDR’s do not allow financial considerations to override the Essential Requirements for the safety and performance of medical devices. If risks are identified via a risk analysis, and risk controls are not implemented, the justification for any non-implementation cannot be based on financial reasons.


In reality, the costs associated with risk controls will always be considered, however, that is not acceptable per the MDR’s. Risk decisions need to remain focused on safety risk benefits.


In order to help manufacturer’s understand the meaning of the “as far as possible” concept, the European Commission published an interpretation of “as far as possible”.

Per the EU Commission, “the phrase as far as possible has led to significant confusion for those involved in placing medical devices on the market. Strict interpretation would create practical problems such as where to stop in reducing risk before a product can be placed on the market. This may restrict patient access to safe and affordable devices.”


The Commission raises concerns that the use of ALARP could result in economic considerations surmounting safety considerations. On the other hand, the reduction of a risk “as far as possible” could be without limits and the resulting devices might no longer be affordable for a larger group of patients.

Recommendation of the Commission: “Although economic considerations will always be relevant in decision-making processes, the safety of the product must not be traded off against business perspectives. For transparency the manufacturer must document the end-point criteria of risk reduction based on his risk policy.”

The clarification provided by the EU Commission, still leaves room for discussion, however, while the extent of the meaning of “as far as possible” still leaves some room for discussion, the focus of risk management and risk mitigation under the MDR’s must be primarily driven by safety concerns, e.g. “risk versus safety” benefits, not “risk versus cost/safety” benefits. Therefore, when a risk is identified, the product developer / manufacturer needs to be able to demonstrate that all practical risk control measures, which reflect “current state of the art” have been implemented and any further risk controls would not further reduce risks.

Medical Device Developers / Manufacturers need to revisit their Risk Management procedures are ensure that:

All risks, including those determined as “negligible” under ISO 14971,  have been reduced AFAP, based on the “state of the art”. Note “state of the art” refers to “generally accepted state of the art”, which relates to current best practices in the industry. It does not mean the most advanced or latest technology, just what is widely seen as current best practices.

When making risk reduction decisions, and identifying and implementing risk controls, cost is not part of the decision-making process.

The benefits to the producer / user / society, etc. outweigh the residual risks associated with the device.

Where residual risks remain, addition risk controls would not result in lower risk levels.


Information & Training:

Medical Devices.

      • Validation. Classification. Regulation. Requirements. Current best practices.
      • FDA cGMP’s, EU MDR’s / MDD’s.
      • Risk Identification. Documentation. DHR’s. DMR’s.
      • Information & Training presentation >>>
Risk Management Full Details

Information & Training:

Risk Management.


Medical Device Regulation MDR 2017 545.