Making Invisible Sustaining Work Legible in Regulated MedTech

Contents Executive summary Landscape map Deep dives Cross-cutting patterns Transfer to a regulated MedTech sustaining portfolio Sources

The MedTech-native work

The most relevant MedTech-native work sits around FDA CDRH, MDIC, and Xavier Health. Their shared contribution is not a universal metric, but an architecture: use production and post-production signals to assess risk to product quality, aggregate them in dashboards, and review them in ways that senior management can act on. That is the closest direct analog to a sustaining-engineering portfolio health system in regulated devices. FDA’s QMSR, effective February 2, 2026, now incorporates ISO 13485:2016 as the core quality-management framework, and FDA guidance explicitly treats production and post-production information as input to risk management and CAPA.

Google SRE

The best transferable analog outside MedTech is Google SRE. Its contribution is a governance mechanism, not a visualization trick: service-level objectives and error budgets create a common operating currency for work that is preventive, invisible when successful, and socially easy to underfund. The nearest regulated-hardware analog would be a bounded “risk budget” or “availability budget” for sustaining portfolios.

Process safety

For governing low-frequency, high-consequence exposure, process safety is the strongest analog. After Texas City, the Baker Panel and then API/CCPS formalized the distinction between lagging and leading process-safety indicators, specifically because injury-rate dashboards were not telling leaders whether catastrophic process risk was worsening. That transfer to MedTech is strong because marketed-device sustaining faces the same problem: absence of visible harm often means risk was absorbed locally, not that the system is healthy.

Asset-management standards

For maintenance and asset-heavy environments, ISO 55000 and IEC 60300-3-11 matter because they formalize value as a balance of cost, risk, and performance, rather than cost alone. The strongest lesson is structural: executives need a small dashboard aligned to business strategy, with separate views for asset performance, management performance, and system effectiveness. Transfer to MedTech is medium-to-strong for equipment, manufacturing, and supply-continuity elements of sustaining, but weaker for complaint handling and design-change governance unless paired with CAPA and design controls.

Hidden-cost methods

For pricing disruptions that finance does not natively track, the most useful body of work is cost of quality, hidden factory, and TDABC. The literature consistently shows that traditional accounting misses large categories of rework, opportunity loss, and absorbed operational effort; these methods do not solve portfolio governance alone, but they give leaders a way to price otherwise “invisible” disruption.

MDIC and FDA/Xavier Health

MDIC and FDA/Xavier Health created the most directly transferable MedTech measurement architecture. In 2016, the FDA/Xavier work group behind MDIC’s Case for Quality Medical Device Quality Metrics concluded that device makers needed linked metrics across the total product lifecycle, not isolated counts. The instrument had three layers: a pre-production metric focused on post–design transfer changes caused by inadequate development; a production Right-First-Time metric that triaged root causes related to product or process inadequacy; and post-production metrics that combined service records, installation failures, complaints, MDRs, and recalls, with added risk weighting and color-coded risk ranges so leaders could spot low-frequency, high-severity threats rather than only high-volume issues. The explicit aim was a “holistic QMS scorecard” and enterprise heat-map view, with CAPA fed by the same signals.

Documented outcomes: this document is primarily a best-practices framework, not a controlled outcome study; it does, however, document the logic of what senior leaders should review and why isolated metrics miss risk. Practitioner claims: the work group argued that combining internal signals such as Right-First-Time and design-transfer changes with external signals such as complaints and MDRs lets senior management focus resources “on the right area.” Inference: for a MedTech sustaining portfolio, this is highly transferable because it is already natively framed around product quality, patient safety, and lifecycle feedback under design controls and CAPA. The missing piece for a sustaining leader is to roll those product-family signals into a portfolio view by product line, business unit, and change category rather than by project count.

The MDIC Case for Quality pilot

The MDIC Case for Quality Pilot is the clearest documented example of abandoning compliance-heavy metrics for decision-useful operational domains. The pilot, run by FDA, MDIC, and the CMMI Institute, originally sought a common set of organizational metrics and a standard submission process. That did not work. Participants found the template confusing and burdensome; metrics were initially chosen to show FDA what firms thought FDA wanted to see, which made them reactive and downstream. The pilot then pivoted to a scorecard built around four domains more meaningful to both regulators and operators: Safety, Effectiveness, Reliability, and Availability. Firms were allowed to submit the metrics they already used to manage operations, within those domains.

Documented outcomes: after the pivot, FDA reported more engagement, more metrics submitted, and submissions that were “more relevant to product quality and organizational performance”; the modified submission structure also improved review timelines significantly when adequate resources and clean processes were in place. The pilot additionally reported increased trust, adoption, and data sharing because the engagement rules emphasized early interaction on safety issues and joint action plans. What backfired: the initial one-size-fits-all metrics approach added burden and pulled firms toward compliance theater rather than improvement. Inference: this is unusually important for a MedTech sustaining portfolio because it demonstrates a practical answer to a sustaining-portfolio leader’s “shared unit of value” problem: instead of forcing revenue or continuity into one scalar, create a bounded, regulator-legible four-domain scorecard that both business and operations leaders can read.

Google’s error budget

Google SRE’s error-budget model is the best documented way to convert invisible maintenance work into a decision currency. In Google’s SRE practice and workbook case material, the problem was familiar: product teams wanted velocity, SREs wanted reliability, and ordinary operational metrics did not force tradeoffs. The instrument was the service-level objective plus error budget. If a service stayed within its reliability target, product teams could keep shipping; if it burned too much budget, reliability work took precedence. The Evernote case in the workbook shows this model being introduced by defining targets, diagnosing gaps, and using the results to guide long-term reliability improvements.

Documented outcomes: the Evernote case reports that it took about three months to find targets that fit the service and the team’s expectations, and that once targets were set, teams used them to frame reliability improvement work. Google’s broader SRE material argues that teams that implement user-centered service metrics are typically glad they did because the metrics surface issues conventional dashboards miss. What failed or gets gamed: Google’s own material is explicit that bad metrics such as QPS can create a “soothing sense that all is well,” while another SRE handbook warns that MTTR and similar averages are often poorly suited to decision-making in incident contexts. Inference: transfer to regulated MedTech is medium, but the mechanism is powerful. The analog is not “error budget” literally; it is a bounded exposure budget for marketed products—for example, allowed unresolved availability risk, repeated emergency deviations, or outstanding risk-ranked postmarket issues—above which discretionary change work pauses until the debt is reduced.

BP Texas City and the Baker Panel

BP Texas City and the Baker Panel show what happens when leaders watch the wrong lagging metric. The 2007 Baker Panel found that BP had improved personal safety performance yet had not emphasized process safety; management mistakenly interpreted better injury rates as evidence of acceptable process-safety performance. The panel concluded that this reliance created a false sense of confidence and documented likely underreporting of incidents and near misses. It explicitly recommended an integrated set of leading and lagging process-safety indicators, executive accountability, auditing, and board monitoring.

Documented outcomes: the later API RP 754 framework established a four-tier structure spanning lagging and leading indicators, with Tier 3 and Tier 4 intended for internal use at sites. The U.S. Chemical Safety Board later judged API’s progress on the recommendation “acceptable” and highlighted contractor inclusion as a meaningful improvement, while still noting serious shortcomings. Why it matters: this is the strongest evidence for replacing retrospective counts with anticipation metrics in a high-consequence environment. Transfer: very high. In MedTech sustaining, personal injury rate is analogous to “no backorders this month” or “no recall this quarter”: useful, but not sufficient. A marketed device can still be deteriorating under the surface through recurring NCRs, supplier risk concentration, aging CAPAs, emergency workarounds, or complaint patterns that have not yet created a visible shortage or field action.

Honeywell’s Safety Observation System

Honeywell’s Safety Observation System is a strong example of surfacing absorbed impact by widening the signal net. Honeywell replaced a manager-only near-miss system with a multilingual, company-accessible Safety Observation System that allowed all employees to report near misses, unsafe conditions, and unsafe behaviors. The key mechanism was not a prettier dashboard; it was increased access to weak signals plus open and closed corrective-action visibility.

Documented outcomes: in Honeywell Building Solutions, more than 82,000 safety observations were reported in 2013, or about eight observations per employee per year; over roughly the same period, recordable injuries fell from 108 in 2010 to 54 in 2013 while observations nearly doubled. Practitioner claim: leaders argued that the value was not observation volume itself, but directing attention toward the risks actually causing injuries. Inference: this transfers well to sustaining engineering if “observation” is translated into logged operational compensations—expedites, operator cross-training, line-side workarounds, temporary deviations, pending supplier alternates, shipped-without features, repeated emergency ECOs, or field-service bandaids. Counting only realized stockouts is the equivalent of counting only injuries.

Cummins’ leading-indicator program

Cummins offers one of the clearest examples of converting leading indicators from theory into a managed prediction system. When Cummins launched its program, leaders did not begin with a giant dashboard. They chose a few candidate leading indicators, then tested them empirically. For training hours, Cummins calculated the correlation against incidence rate and found a very strong negative correlation, r = -0.86, across the corporation and business units. The company then set aggressive training targets, investigated why training seemed predictive, and found that risk-assessment and job-safety-analysis training explained much of the effect.

Documented outcomes: the case documents adoption of the metric, target-setting, and periodic review; it also documents a disciplined refresh cycle, with indicators reviewed every six months and updated annually if they lost predictive value. What did not work: Cummins explicitly rejected the idea of a permanent “holy grail” indicator; saturation and decay of predictive power were treated as normal. Inference: this is highly transferable to a sustaining portfolio stuck on project counts. A MedTech leader can do the same by testing which internal process signals actually predict bad outcomes—e.g., change-review cycle slippage, recurring manufacturing NCRs, supplier or inventory risk age, CAPA recurrence, complaint escape rates, or emergency deviation frequency—then refreshing the set regularly rather than defending a static scorecard for years.

USG and Fluor

USG and Fluor show that leading indicators only matter when operations own them and executives react to them. USG’s Safety Activity Rating was deliberately built by plant managers and operations leaders over a multi-year design period, then executed by mixed operational teams visiting peer sites. Scores were used for self-evaluation, not force-ranking, and were followed by corrective-action discussions with the receiving plant manager. Fluor, by contrast, revamped its corporate HSE audit tool to put more weight on leading indicators; after the first six months showed weakness in “management in action,” corporate HSE took the findings directly to executive leadership and prescribed concrete behaviors such as weekly site walks and participation in shift-start safety planning.

Documented outcomes: USG reported injury-rate reduction plus broader employee awareness and ownership; Fluor reported that six months after the executive intervention, “management in action” became the highest-scoring audit category. Why these cases matter: both avoided the shelfware-dashboard trap by linking the indicator to human ownership and corrective action. Transfer: high. For a MedTech sustaining portfolio, this means a business-unit–facing scorecard should not be built by analytics alone. It should be co-defined by operations, quality, supply chain, and engineering leaders, and each metric should have an explicit owner and response rule.

Hidden factory and cost of quality

Hidden-factory and cost-of-quality methods matter because they price work that finance often cannot see. In Cheah, Shahbudin, and Taib’s manufacturing action-research case, the researchers extended conventional prevention-appraisal-failure costing with opportunity loss and uncovered significant hidden quality costs. They concluded that total quality costs exceeded the company’s current profit margin, and that traditional accounting was inadequate for tracking the full amount. Schiffauerova and Thomson’s literature review reached a broader conclusion: CoQ is not widely used in practice, but where it is adopted, companies often reduce quality costs and improve quality. Kaplan and Anderson’s TDABC work supplies the practical accounting logic for translating time and process consumption into cost when ERP-level attribution is missing.

Documented outcomes: the action-research case found hidden costs large enough to exceed profit margin and reported that making them visible improved quality awareness. What backfired: managers resisted the program because exposing hidden costs also exposed operational inefficiency; the authors describe “learning anxiety” and warn that measurement alone does not improve profitability without follow-up action. Transfer: medium-to-high. In MedTech sustaining, this is best used selectively—to price, for example, repeated expedites, manual inspection, emergency supplier qualifications, revalidation loops, field-service overuse, or engineering rework—rather than as the sole portfolio value system. It is a support tool for escalation, not a complete executive language on its own.

ISO 55000 asset management

ISO 55000 asset-management work provides a useful architecture for balancing risk, cost, and performance when “value” is contested. In the hydropower-plant case published by da Silva, Melani, and Michalski, the authors built maintenance performance indicators aligned to ISO 55000 and the Balanced Scorecard. ISO 55000 defines asset management as coordinated activity to realize value from assets, where value involves balancing costs, risks, and performance. The case used three levels of evaluation: critical-asset performance; maintenance-management performance through financial, customer, internal-process, and learning perspectives; and system-level effectiveness and compliance.

Documented outcomes: the authors report that the method provided a consistent way to define maintenance indicators that contribute systematically to business strategy. Limitation: this is a single case in a hydroelectric plant, not MedTech, and not a controlled study. Inference: transfer is medium. The important idea is structural rather than sector-specific: do not force all stakeholders into one homogeneous number. Instead, evaluate the portfolio at multiple levels—product-family health, sustaining-process health, and system effectiveness or compliance. That is exactly the architecture a multi-BU MedTech firm needs when one function values revenue and another values continuity.

FDA’s pharmaceutical quality economics

FDA’s recent pharmaceutical quality-economics work is one of the better documented cases that preventive quality investment can create visible operational returns. FDA’s 2024 paper, Quality Management Initiatives in the Pharmaceutical Industry: An Economic Perspective, synthesizes economic logic with pharma examples and argues that quality investment reduces defects, waste, rework, and supply unreliability. In one example cited by the paper, a biopharmaceutical site with intermediate quality-management maturity reduced defects by more than 50%, waste by 75%, and redirected 25% of staff to other work. The same paper explicitly links mature quality-management practices to lower recall, defect, and lead-time-related costs and to greater supply reliability. Separately, Fellows et al.’s global pharmaceutical benchmarking study, involving more than 200 establishments, found that selected quality-management practices correlated positively with manufacturing KPI performance and delivery performance.

Documented outcomes: the FDA paper reports concrete case outcomes, though the underlying examples are secondary rather than presented as a standalone primary case study in the FDA document. Inference: transfer to MedTech is fairly strong because marketed-device sustaining has the same central asymmetry: prevention rarely books clean revenue, but better quality maturity can free capacity, reduce waste, and protect supply. That “capacity freed for innovation or remediation” is one of the few non-financial value languages that operations and business leaders can jointly understand.

The visceral display

The visceral-display literature is real, but the evidence base is thin. The well-known “gloves on the boardroom table” story, attributed to Jon Stegner in Kotter and Cohen’s The Heart of Change and later popularized by the Heath brothers, describes using 424 glove types piled on a boardroom table to trigger executive support for procurement standardization. The mechanism is memorable because it converts an abstract waste problem into a physical confrontation.

Documented outcomes: the case is primarily a practitioner anecdote; it is useful as a sponsorship tactic, not as rigorous evidence of sustained operating improvement. Inference: for a MedTech sustaining leader, a visceral display can reopen attention during a reorganization—e.g., physically or visually showing the volume of emergency deviations, open supplier obsolescence exposures, or repeated field-service workarounds—but it should be used only to create urgency around a scorecard that is already decision-ready. The evidence is materially stronger for governance-linked metrics than for theater alone.

Exposure, not activity

The winners all converged on the same design choice: they measured exposure, not activity. The instrument that mattered was rarely “how much work got done.” It was the thing executives actually feared: risk to safety, loss of containment, reliability burn, availability shortfall, postmarket escape, or hidden-quality cost. MedTech evidence is especially clear here: MDIC’s pilot shifted away from generic compliance metrics to Safety, Effectiveness, Reliability, and Availability; MDIC’s lifecycle metrics emphasized risk-weighted complaints, MDRs, recalls, and Right-First-Time rather than raw volume alone.

Decision-forcing governance

A second shared trait was decision-forcing governance. Error budgets work because they trigger a constraint. Fluor’s audit scores mattered because executive leaders were told exactly what specific managers had to do next. Baker-style process-safety indicators mattered because they were meant for executive and even board monitoring. The pattern is blunt: dashboards without consequences become background scenery. Research on decision dashboards reinforces this, showing that information quality, currency, completeness, and cognitive load affect whether dashboards improve decisions at all.

Signal broadening

A third pattern was signal broadening. High-performing systems captured weak signals that ordinary reporting suppresses: Honeywell widened access to observations; CCPS and API treated near misses and lower-tier events as learning material; FDA’s device and pharma frameworks explicitly connect production and post-production data back into risk management; hidden-factory work looks for opportunity loss and absorbed effort that standard accounting ignores. This is the clearest answer to a sustaining-portfolio leader’s “no measured impact often means impact absorbed invisibly” problem: measure the absorption mechanisms themselves.

Where efforts failed

Where the efforts failed, the pattern was equally consistent. The most common failure modes were proxy addiction and metric burden. BP watched personal-safety rates; Google warns against QPS and simplistic averages; the MDIC pilot’s initial metrics were reactive and compliance-centered; CoQ programs sometimes died under managerial defensiveness; dashboard-adoption research warns that overloaded or poorly aligned dashboards are rejected. Early warning signs were visible: executives stopped asking for the report, teams optimized documentation rather than performance, and frontline adaptations disappeared from the scoreboard.

Revenue versus continuity

On the specific question of revenue versus continuity, the strongest answer from the evidence is: do not adjudicate that fight with one number. The better systems transcend it by using a bounded set of quality domains or risk layers. API RP 754 uses tiers; ISO 55000 uses cost, risk, and performance; MDIC uses Safety, Effectiveness, Reliability, and Availability. That approach is more transferable to regulated MedTech than forcing finance to invent project-level revenue attribution for sustaining work.

A four-domain sustaining health review

The most likely move to work in a large, reorganizing MedTech manufacturer is a four-domain sustaining health review anchored in the QMSR and management review: Safety and Compliance, Availability and Continuity of Supply, Reliability and Field Performance, and Execution and Learning. Each domain should be fed by a handful of risk-weighted signals already native to MedTech operations: recurring design-transfer changes, production Right-First-Time exceptions triaged to design or process inadequacy, complaint and MDR risk scores, recall or field-action severity, supplier or inventory issue age, emergency deviations, CAPA recurrence and aging, and time-to-resolution by lifecycle phase. This is the closest direct translation of MDIC’s work into a sustaining-portfolio instrument.

A decision-forcing risk budget

The second move likely to work is a decision-forcing risk budget for marketed products. Rather than chasing impossible financial attribution, create an agreed threshold for unresolved exposure—for example, an availability-risk budget by product family or business unit, or a bounded stock of unresolved recurring process or field failures. If the threshold is exceeded, new discretionary changes or lower-priority sustaining work pause until the exposure is reduced. That is the regulated-hardware analog of the error budget, and it is more likely to survive functional disagreement because it is tied to patient safety, continuity, and quality-system health rather than speculative revenue math.

Capturing absorbed impact

The third move is to explicitly capture absorbed impact. In practical terms, that means logging the coping behaviors that currently erase the signal: shipment exclusions, operator cross-training around line interruptions, emergency supplier changes, repeated deviations, manual inspection add-ons, late-stage validation rework, and field-service patches that prevent backorders today while increasing hidden engineering debt tomorrow. The reporting logic should mirror Honeywell and hidden-factory methods: treat these as early-warning observations of system strain, not as proof that nothing bad happened.

Sponsorship through the governance ritual

The fourth move is to rebuild sponsorship through the governance ritual, not only through better visuals. Under ISO 13485 and the QMSR, management review is already mandatory. Use that as the home for the sustaining portfolio review, but make the meeting explicitly decision-oriented: what risk will be accepted, what redesign will be funded, which obsolescence exposures will get last-time buys or alternate qualification, which cross-BU escalations need executive arbitration, and what gets paused. If reorg fatigue is severe, a visceral artifact can help reopen attention once—but the evidence says the durable solution is a review cadence with thresholds, owners, and consequences.

The moves most likely to fail

The moves most likely to fail are the ones the literature repeatedly punished. First, a single enterprise scalar such as “business value dollars” will likely stall, because finance rarely has defensible, project-level sustaining attribution and because continuity-of-supply is not reducible to the same logic as revenue. Second, a counts dashboard—open projects, closed projects, active projects, canceled projects—will continue to look orderly while concealing large differences in risk, scope, and suppressed operational burden. Third, a tool-first Power BI program without decision rules, owners, and co-designed business meaning will likely become shelfware; dashboard research is clear that relevance, trust, and manageable cognitive load are prerequisites for use.

Open questions

Three field-discovery questions remain open. Which absorbed-impact signals already exist in the Microsoft estate but are not being rolled up—deviations, expedites, supplier-risk logs, complaint triage, service records, or line-side workarounds? Which lifecycle phase contributes most of the unresolved sustaining “risk debt”—design transfer, manufacturing, or post-market? And which executive forum can legitimately arbitrate tradeoffs across business-unit revenue logic and enterprise continuity logic? The literature points toward the answer, but only field discovery will show which data are trusted enough to govern with.

Most authoritative and directly transferable

Strong adjacent analogs

Maintenance, asset management, and hidden-cost literature

Pharma and biologics analogs

Anecdotal or practitioner-only material