What is R-MAP?

The definition of risk is “the combination of the probability of occurrence of harm and the severity of that harm.” This definition aligns with international standards such as ISO 14971 (Application of risk management to medical devices) and ISO 31000 (Risk management guidelines).

When this concept is plotted on a two-dimensional chart, it becomes quite straightforward. The vertical axis represents the probability of occurrence, while the horizontal axis represents the magnitude of harm (severity).

For example, if the harm is significant and the probability of occurrence is also high, this results in High × High = Very High, which is represented in deep red. Conversely, when both the harm and probability of occurrence are low, this is Low × Low = Very Low, which is shown in green. This chart is referred to as the R-MAP method, or Risk Matrix Approach.

Understanding the R-MAP Structure

In the R-MAP, each cell is assigned a rating. For severity, classifications typically include: negligible, minor, marginal/serious, critical, and catastrophic. For probability, classifications include: frequent, probable, occasional, remote, improbable, and extremely improbable.

The areas marked in red are designated as Region A. The areas in yellow are Region B. The areas in green are Region C.

Regions A and B are further subdivided with numerical designations such as A3, A2, and A1. These numbers indicate how many levels down one must move to reach the next region. For instance, A3 means that moving down three levels will bring you into Region B. The reason for moving downward rather than sideways is that while it is possible to reduce the probability of occurrence through various control measures, it is generally difficult to reduce the inherent severity of harm once it occurs.

The Three Risk Regions

Region C (Green): Acceptable Risk

The green region (Region C) represents acceptable risk. This is the range where patients or consumers would be willing to accept such a level of risk. This is what we call “safe” or “broadly acceptable risk.”

For example, consider disposable heat packs used in winter, particularly the adhesive type. The instructions state, “Do not apply directly to bare skin as this may cause low-temperature burns.” In other words, the risk is low-temperature burns. However, from the user’s perspective, low-temperature burns represent an acceptable risk. This level of risk is something they are willing to accept, which defines the acceptable risk region. Users understand the risk and can take appropriate precautions, such as placing a cloth between the heat pack and their skin.

Region A (Red): Unacceptable Risk – Development Discontinuation

The red region represents unacceptable risk and requires development discontinuation. In this region, it is not permissible to use the relevant equipment, device, or system to manufacture pharmaceuticals or conduct research and development. Risks in this region are intolerable and cannot be justified under any circumstances. Any hazard that falls into this region must either be eliminated through design changes or the product/process must be abandoned entirely.

Region B (Yellow): ALARP Region

The most challenging area is the yellow region, Region B. This is called the ALARP (As Low As Reasonably Practicable) region. The ALARP principle originates from UK health and safety legislation but has been widely adopted in risk management across various industries, including medical devices and pharmaceuticals.

The ALARP region requires risk to be reduced as low as reasonably practicable. However, importantly, risks in this region are not yet acceptable. The key question is: why “as reasonably practicable” rather than simply reducing all risks to the lowest possible level?

The answer lies in cost considerations. By investing financial resources, it is indeed possible to reduce risks. However, excessive investment drives up manufacturing costs and research and development expenses. These costs incurred by companies are ultimately transferred to drug prices and healthcare costs, and consequently, such expenses become the burden of patients.

Therefore, the ALARP region (Region B) seeks to reduce risks as much as possible without excessive financial investment. This requires a careful balance between risk reduction and resource allocation. For risks in the ALARP region, a benefit-risk analysis must be conducted.

Benefit-Risk Analysis

Benefit-risk analysis is exemplified by cancer chemotherapy agents. Chemotherapy drugs have strong side effects, but when there are no other treatment options available for the patient, the drug is administered because the benefits outweigh the risks. The drug is given after obtaining informed consent from the patient, which is consent based on thorough explanation of both risks and benefits.

This principle applies not only to pharmaceuticals but also to medical devices and manufacturing equipment. The decision to accept a risk in the ALARP region must be justified by demonstrating that the benefit clearly exceeds the risk, and all reasonable measures to reduce the risk have been implemented.

Overall Residual Risk Evaluation

However, there is an important consideration here. What happens if there are, for example, 100 items in Region B? Region B represents risks that are not acceptable in the strict sense. Patients or users might tolerate two or five unacceptable risks with appropriate benefit-risk justification.

However, even though they fall within the ALARP region, having 100 unacceptable risks would collectively move the overall risk profile up one level. Such a situation would not be acceptable. This highlights the importance of overall residual risk evaluation.

The concept of overall residual risk evaluation recognizes that while individual risks may be managed appropriately, the cumulative effect of multiple residual risks must also be assessed. This is explicitly addressed in ISO 14971:2019, which requires manufacturers to evaluate the overall residual risk and determine whether it is acceptable when considering the intended benefits of the medical device.

Contemporary Risk Management Considerations

Modern risk management approaches also emphasize:

Iterative Risk Management: Risk assessment is not a one-time activity but should be conducted throughout the product lifecycle, from initial design through post-market surveillance.

Risk-Benefit Tradeoffs: Particularly in medical applications, the acceptability of risk cannot be determined in isolation but must be weighed against the clinical benefits and the availability of alternative treatments.

Stakeholder Communication: Effective communication of residual risks to users, patients, and other stakeholders is essential. This includes clear labeling, instructions for use, and training materials.

Post-Market Risk Management: Monitoring of risks continues after product launch through complaint handling, adverse event reporting, and periodic safety updates. New information may require reassessment of previously evaluated risks.

The R-MAP method, when properly applied with these principles, provides a systematic and visual approach to risk management that facilitates decision-making and ensures that risks are managed in a transparent, justifiable manner. It serves as a crucial tool in ensuring patient safety while enabling innovation in medical products and pharmaceutical manufacturing.

Risk Matrix Table Example

Below is an example of how severity and probability classifications might be structured in an R-MAP:

Probability / Severity	Negligible	Minor	Serious	Critical	Catastrophic
Frequent	B2	B1	A3	A2	A1
Probable	C	B2	B1	A3	A2
Occasional	C	C	B2	B1	A3
Remote	C	C	C	B2	B1
Improbable	C	C	C	C	B2
Extremely Improbable	C	C	C	C	C

Legend:

• Region C (Green): Acceptable risk – Broadly acceptable
• Region B (Yellow): ALARP region – Risk reduction required as low as reasonably practicable
• Region A (Red): Unacceptable risk – Development discontinuation or fundamental redesign required
• Numbers (1-3): Indicate how many probability levels must be reduced to move to the next lower risk region

This table illustrates how different combinations of severity and probability map to different risk regions, guiding appropriate risk control measures and decision-making.