Case Study: A Warning Letter Exposes Issues in Risk Analysis

The EYE-SYNC(R) device uses a modified virtual reality headset, connected to a tablet, to track eye movement in response to visual stimuli for assessment of a concussion. In a recent warning letter, FDA cited the following issue with software risk analysis:Your Risk Management Procedure, SOP-10011, Rev 002, states that the level of risk is determined by Risk Priority Numbers(RPN) and that the design (b)(4) will use the severity and occurrence rating scales described in the procedure. However, your software (b)(4), RA-10110, Rev 006, does not use RPNs, and the impact and probability scale used to calculate inherent and residual risk are not adequately defined within SOP-10011.When software risk analysis is not correctly done, it can have a serious impact on design verification and validation. As a result, the device may fail to reliably function during real-world use, leading to serious risk of harm from false negative, false positive and unreliable results.🎧Listen to a brief audio summary of this case above and lessons QA/RA and Risk professionals can apply in practice. Thanks for reading Let's Talk Risk!. This post is public so feel free to share it.Note:The audio summary was prepared using Google NotebookLM, an AI-enabled research tool. Here is the list of resources used for this analysis:* FDA: Warning letter issued to NeuroSync, Inc., CMS 705489, May 09, 2025. * DEN170091, EyeBox, Predicate device for EYE-SYNC, granted December 28, 2018. * K202927, EYE-SYNC 510k clearance, October 2, 2021.* YouTube: Podcast with Scott Anderson, CCO, SyncThink, 2022. This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit naveenagarwalphd.substack.com/subscribe