What is the Three-Step Method?

Introduction to Risk Management Standards and the Three-Step Method

Numerous risk management standards exist throughout the world. However, all international standards must comply with ISO/IEC Guide 51 “Safety aspects – Guidance for their inclusion in standards,” which is jointly created by ISO and IEC. ISO 14971, the standard for medical device risk management, similarly adheres to this foundational guidance.

ISO/IEC Guide 51 employs the “Three-Step Method” as its core framework for implementing safety in products and services. The “Three-Step Method” is defined as a systematic approach to safety that encompasses three distinct measures and procedures that designers must implement: (1) Inherent Safe Design Measures, (2) Safeguarding and Supplementary Protective Measures, and (3) Information for Residual Risk. These steps form a hierarchical approach to risk reduction, ensuring that designers prioritize the most effective risk control measures.

Safety Principles and the Three-Step Method: Understanding Risk Reduction Strategies

The Evolution of Risk Management Approach in Japan

When the Product Liability Law (PL Law) was enacted in Japan in 1995, activities to strengthen warnings about hazards in instruction manuals and warning labels were significantly intensified. While communicating hazards is inherently important, human attention has inherent limitations, and the risk reduction effectiveness of warnings alone is modest. To adequately reduce major risks, manufacturers must combine inherent safe design strategies with protective devices and safeguarding measures.

This recognition reflects a fundamental principle in risk management: the hierarchy of risk control measures. The most effective risk reduction is achieved when multiple measures are implemented in a coordinated manner, with higher-priority measures addressing the root causes of hazards rather than relying solely on user behavior or information provision.

Hierarchy of Risk Reduction Measures

Reducing significant risks requires more than measures implemented by the manufacturer alone. Appropriate risk control measures from the user side are also necessary. The hierarchy of risk control measures on the user side includes the following, in order of effectiveness: (1) Additional Protective Devices, (2) Training, (3) Personal Protective Equipment, and (4) Organizational Controls.

A critical principle in applying risk reduction measures is that higher-priority measures must not be omitted in favor of lower-priority measures. In other words, manufacturers cannot skip more effective risk reduction strategies and instead rely solely on less effective ones such as warnings or training. The application of any risk reduction measure must be based on the results of a comprehensive risk assessment that evaluates the effectiveness of each measure in reducing the specific risks identified for the device or product.

Risk Reduction Measure Priority	Measure Type	Description
1 (Highest)	Additional Protective Devices	Engineering controls and safeguards that prevent or mitigate hazardous situations
2	Training	User instruction and competency development to ensure safe use
3	Personal Protective Equipment	Equipment worn by users to protect against residual hazards
4 (Lowest)	Organizational Controls	Administrative procedures and policies to manage risk

Integration with International Medical Device Standards

The Three-Step Method is not limited to general safety standards but is specifically incorporated into medical device regulatory frameworks. For example, ISO 14971:2019 “Application of risk management to medical devices” explicitly references ISO/IEC Guide 51 and applies the Three-Step Method throughout its risk management process. Similarly, medical device regulations in major jurisdictions—including the FDA’s guidance documents, the EU Medical Device Regulation (MDR), and Japan’s Pharmaceuticals and Medical Devices Agency (PMDA) expectations—align with this hierarchical approach to safety and risk reduction.

The principles embedded in the Three-Step Method ensure that medical device manufacturers implement risk controls systematically, with emphasis on design-based solutions before relying on safeguards or information provision. This approach has proven effective in reducing device-related adverse events and improving patient safety across the global medical device industry.

Conclusion: Application and Significance

Understanding the Three-Step Method is essential for anyone involved in product safety, risk management, and regulatory compliance. By systematically applying the hierarchy of risk reduction measures and ensuring that higher-priority measures are implemented before lower-priority ones, manufacturers can achieve more effective risk management. The Three-Step Method serves as the foundational principle for safety across virtually all product categories and regulatory frameworks worldwide, making it a critical concept for design engineers, risk managers, and regulatory professionals alike.