ISO 14971 Risk Management for Medical Devices: The Definitive Guide

iso 14971 risk management ultimate guide table of contentsiso 14971 risk management - what is risk?iso 14971 risk management - introductioniso 14971 risk management - risk management processiso 14971 risk management - role of managementiso 14971 risk management - risk management planiso 14971 risk management - risk management fileiso 14971 risk management - risk assessmentiso 14971 risk management - risk controlsiso 14971 risk management - overall risk acceptabilityiso 14971 risk management - risk management reviewiso 14971 risk management - production and post-productioniso 14971 risk management summary

Request a Demo

iso 14971 risk management - chapter twoWhat is Risk?

Take a moment and think about this:

How does RISK impact you every day?

The #1 definition in the dictionary defines RISK as possibility of loss or injury.

There are things that each of us do every day that involves RISK.

The food you eat, the habits you have, your daily routine--all full of risks in some way, shape, or form.

One of the riskiest things I do just about every single day is drive my car. But I don’t usually think about this being a risk at all. I take it for granted.

Could I get in an accident? Could I get injured or possibly die? Of course. Yet I estimate that the likelihood of these things happening to me are low enough that I’m willing get behind the wheel without question.

Maybe it’s because I know that my car has anti-lock brakes, seat belts, and airbags. Maybe it’s because I know that the car I drive has been through rigorous safety testing.

Risk per ISO 14971 is defined as the combination of the probability of occurrence of harm and the severity of that harm.

The intent behind Risk Management is to identify, evaluate, analyze, assess, and mitigate potential product issues.

Risk Management is a total product life cycle process.

The Importance of Risk and Medical Devices

The medical device industry is built on trust, between those who design, develop, and manufacture devices, and those who depend on those devices to work safely and effectively.

Imagine this from the perspective of a patient going in for any medical procedure. The patient probably thinks very little about the risks of the medical devices about to be used.

Generally, the patient trusts the expertise of the clinicians. The patient seldom wonders if the products used by the clinicians are safe and have been thoroughly and rigorously tested.

The patient, often unknowingly, accepts the risks of the medical device you and I design, develop, and manufacture. And this is exactly why Risk Management is so important to the medical device industry. You have to know that the medical devices you are involved with bringing to patients and end-users are safe.

iso 14971 risk management - chapter twoIntroduction to ISO 14971 Risk Management for Medical Devices

Make no mistake—the products that MedTech professionals design, develop, and bring to market have improved the quality of life for thousands and thousands of people. Here at Greenlight Guru, we are fortunate to have the opportunity to work with many others who have the same purpose and mission.

If you think about it, the ideal of improving the quality of life is the very premise of product risk management.

What You Will Gain From This Guide to ISO 14971

The topic of Risk Management is one that can be daunting, and at times confusing. Thankfully, ISO 14971 exists and is helpful in providing guidance and direction.

ISO 14971 provides a thorough explanation of relevant terms and definitions. And the standard defines a risk management process.

I’ve written this guide to align with the latest version of ISO 14971 and to provide you additional tips and insights for medical device risk management.

For me, it is very interesting to observe and listen to feedback and comments about the topic from the perspectives of the experts, the regulators, the consultants, and medical device companies.

Many times, it seems as though each of these perspectives has a very different view of the world regarding medical device Risk Management. At times, it seems as though no one agrees.

The practice of Risk Management in the medical device industry is also intriguing to me. By and large, what I have observed is that Risk Management is too often something we do because we have to-- a checkbox activity .

It seems that we seldom use Risk Management as a tool to help us design, develop, and manufacture safer medical devices.

The purpose of this guide is three-fold:

  1. To leave you with an understanding of what is expected from medical device regulators regarding Risk Management.
  2. To help you use Risk Management as a tool to design safer medical devices by providing a few helpful tips and pointers to guide you.
  3. To share with you all the steps that you need to define and address within your Risk Management procedures.

Please note that the focus of this guide is strictly medical device product risk management. I will not explore other “risk management” topics such as business or project.

Regulations & Standards for ISO 14971 Risk Management

Realize that nearly every medical device regulatory agency has placed the topic of Risk Management front and center.

In fact, regulatory agencies, including FDA, are now using risk-based processes throughout their own internal processes when reviewing device submissions and conducting inspections and audits.

Know this: U.S. FDA, Health Canada, EU Competent Authority, Australia TGA, and Japan MHLW all require you to have a Risk Management process defined and Risk Management documentation for your products.

And all these regulatory agencies endorse ISO 14971 Medical devices -- Application of Risk Management to Medical Devices.

In addition to ISO 14971, there are several other key medical device industry standards requiring risk management. The partial list includes:

Yes, all these standards make reference to risk management (and ISO 14971).

Did you notice ISO 13485 is on that list?

This is significant because the ISO 13485 standard is specific to quality management systems .

The expectation is that you manage risk throughout the entire product lifecycle and throughout your entire QMS.

What is ISO 14971? An Overview of the Current State

I could share with you a history lesson on the genesis and evolution of medical device risk management.

While there may be some merit in going through this history, I suspect you are probably more interested in the present state of Risk Management, as well as where things are headed.

The current “state of the art” regarding risk management is described in the standard ISO 14971 Medical devices -- Application of Risk Management to Medical Devices.

A Brief Overview of the Standard and Accompanying Guidance

The current version of ISO 14971 was released in December 2019. This version replaced the previous two versions of the standard that were utilized by many of you across the world:

As you likely know, the EN version was applicable if you were selling medical devices in Europe. While there is still an EN version of ISO 14971:2019, it is now identical to the regular version of ISO 14971:2019. When selling in Europe though, it is important to know that additional risk requirements apply, which are outlined in the EU MDR .

Here is the abstract describing the standard:

This document specifies terminology, principles and a process for risk management of medical devices, including software as a medical device and in vitro diagnostic medical devices. The process described in this document intends to assist manufacturers of medical devices to identify the hazards associated with the medical device, to estimate and evaluate the associated risks, to control these risks, and to monitor the effectiveness of the controls.

The requirements of this document are applicable to all phases of the life cycle of a medical device. The process described in this document applies to risks associated with a medical device, such as risks related to biocompatibility, data and systems security, electricity, moving parts, radiation, and usability.

The process described in this document can also be applied to products that are not necessarily medical devices in some jurisdictions and can also be used by others involved in the medical device life cycle.

This document does not apply to:

— decisions on the use of a medical device in the context of any particular clinical procedure; or

— business risk management.

This document requires manufacturers to establish objective criteria for risk acceptability but does not specify acceptable risk levels.

Risk management can be an integral part of a quality management system. However, this document does not require the manufacturer to have a quality management system in place.

ISO 14971 is a very good standard. While not prescriptive per se, the standard does a very good job of explaining the requirements, expectations, and stages of a risk management process.

Additionally, the standard provides several informative annexes which provide more in-depth explanations and examples.

While this guide provides an overview, walk-through, and practical application of ISO 14971, I highly recommend that you do make the ~$200 decision to actually purchase the standard (no, I don’t get a commission). It is worth it.

The medical device regulatory world has adopted this standard. And I see no reason to abandon this notion.

You should also be aware of ISO/TR 24971 -- Guidance on the application of ISO 14971. 24971 (no, it’s not a typo) is a guidance document specifically for ISO 14971. If you are seeking additional insights and guidance on application of ISO 14971, the ISO/TR 24971 guidance is helpful.

Design Controls & Risk Management

Design Controls are intended to demonstrate that a medical device has been:

  1. Designed to address the needs of users and patients.
  2. Designed to meet inputs and requirements.
  3. Proven to meet applicable standards.
  4. Meets performance criteria.

Your Design Controls will prove that your medical device is safe for use.

Does this sound like Risk Management?

The intent behind Risk Management is to identify, evaluate, analyze, assess, and mitigate potential product issues.

There is a very strong correlation and relationship between Design Controls and Risk Management.

With Design Controls, you also identify, evaluate, analyze, assess, and mitigate potential product issues.

Design Controls and Risk Management address design, development, and manufacturing of medical devices from slightly different perspectives.

Good Design Controls Reduce Product Risks

If you are thorough with defining and documenting User Needs, Design Inputs, Design Outputs, Design Verification, Design Validation, and Design Reviews, then you will be on the right track towards ensuring your medical device is safe.

Prior to clinical use, you have to know without a doubt that the product is safe and/or determine that the medical benefits outweigh the risks (which should be documented in a benefit-risk analysis).

Embrace this in your own medical device product development efforts.

Realize that your overall goal in medical device product development and manufacturing is to prove and demonstrate that your product meets clinical needs, design inputs and requirements, and is safe and effective.

Risk Management Is Still Needed Even With Good Design Controls

Having solid Design Controls in place is NOT a substitute for Risk Management. Both are needed.

Realize that Risk Management is just as important (maybe more so) than Design Controls.

Realize that Risk Management is a way to evaluate your product from a different perspective.

Realize that good Risk Management involves a series of tools, when used properly, will drastically improve the quality, safety, and effectiveness of your medical device.

Risk Management & Design Controls Must Be Linked

The best practices of medical device product development have a good flow between Design Controls and Risk Management.

For example, as you identify hazards and hazardous situations, these should “feed” into the Design Controls process in defining User Needs and Design Inputs.

When you evaluate risks, you will need to establish Risk Controls to mitigate and reduce risks. Design Outputs, Design Verifications, and Design Validations become these risk controls.

In fact, using Risk Management as a real tool will help you with Design Verification and Design Validation planning . Let me explain.

Risk Controls are used to help identify ways to reduce the risks. Your Risk Controls should align with and include Design Verification and Design Validation activities.

Are you starting to see how closely related Risk Management and Design Controls should be?

iso 14971 risk management - chapter 3Risk Management Process Overview

Let’s start to dive into the details of Risk Management .

As I go through this guide on medical device risk management, I will often reference the ISO 14971 standard (the reasons for this are described earlier in this guide).

Medical device Risk Management requires top management involvement. It requires that a company establish a Risk Management Policy.

The process itself includes:

The infographic below aligns directly with the ISO 14971 standard on a one to one basis and is a high-level overview of the Risk Management process.

(Click infographic to enlarge)

iso-14971-risk-management-process infographic

If you are developing medical devices in this day and age, you absolutely must have an established Risk Management process defined, documented, and implemented.

As you go through this guide, I will share with you all the steps that you need to define and address within your Risk Management procedures.

Risk Management needs to involve more than just engineers and product developers.

You need to include end-users, marketing, sales, business development, quality, regulatory, and manufacturing on your product Risk Management team.

THIS IS VERY IMPORTANT: Risk Management is an enterprise-wide process.

All of these functional areas provide different perspectives and experiences for the medical devices you are designing, developing, and manufacturing.

It is important to ensure your Risk Management efforts are holistic.

Risk Management Definitions You Need To Understand

There are several key terms pertaining to Risk Management defined in ISO 14971 that you definitely need to understand.

RISK MANAGEMENT - systematic application of management policies, procedures, and practices to the tasks of analyzing, evaluating, controlling, and monitoring risk

RISK - combination of the probability of occurrence of harm and the severity of that harm

HAZARD - potential source of harm

HAZARDOUS SITUATION - circumstance in which people, property, or the environment are exposed to one or more hazard(s)

HARM - physical injury or damage to the health of people, or damage to property or the environment

SEVERITY - measure of the possible consequences of a hazard

RISK ANALYSIS - systematic use of available information to identify hazards and to estimate the risk

RISK ESTIMATION - process used to assign values to the probability of occurrence of harm and the severity of that harm

RISK EVALUATION - process of comparing the estimated risk against given risk criteria to determine the acceptability of the risk

RISK ASSESSMENT - overall process comprising a risk analysis and a risk evaluation

RISK CONTROL - process in which decisions are made and measures implemented by which risks are reduced to, or maintained within, specified levels

RESIDUAL RISK - risk remaining after risk control measures have been taken

Realize that in practice, many people use the terminology incorrectly and/or interchangeably.

For example, someone might use “risk analysis” to refer to “risk management”.

When this happens, I recommend asking the person to explain what they mean. I’ve witnessed (and probably participated in) several disagreements where the terminology created confusion. Getting a grasp on the list of terms above is critical to understanding medical device risk management.

iso 14971 risk management - chapter fourRole of Management in Risk Management

Oftentimes, it is assumed that the topic of Risk Management is only the responsibility of the medical device product developers and engineers designing new products.

While it is true that product developers and engineers do play a pivotal role, medical device Risk Management is a much more comprehensive process that should span all functional areas of a medical device.

This means that, in addition to product developers and engineers, other functional areas including business development, marketing, manufacturing, sales, and end-users should be an integral part of your Risk Management process.

The cornerstone of a medical device company’s risk management process must be executive management.

  1. Executive management is the ultimate authority within the company. This resource, whether he / she realizes it or not, has the responsibility for determining whether the product risks are acceptable or not.
  2. Executive management has the responsibility for making sure there are adequate and appropriate resources for conducting risk management activities.
  3. Executive management has the responsibility of ensuring the company’s risk management processes are adequate and effective.
  4. Executive management must review the company’s risk management processes for effectiveness. This means that the company’s risk management processes are described, documented and controlled as part of quality system procedures.
  5. Executive management also has the responsibility for defining the company’s risk management policy. This involves determining the risk acceptability criteria. The criteria should be based on solid, objective evidence, such as industry standards.

Generally, a Risk Management Policy is a top-level document included within the company’s quality management system.

iso 14971 risk management - chapter five

Risk Management Plan

A Risk Management Plan is a product-level document.

The Risk Management Plan should identify the risk management activities you anticipate and plan throughout the product’s life cycle.

The Risk Management Plan is dynamic and should be revisited and updated often. This is not a “one and done” activity.

A Risk Management Plan must include the following criteria:

  1. Scope of the Risk Management activities. Define the product included. It is possible to have multiple products described within a single Risk Management Plan.
  2. Describe the intended use of the product(s).
  3. Identify all Risk Management activities planned throughout the product life cycle.
  4. Define roles and responsibilities. Identify the Risk Management team that will be reviewing and approving risk documentation.
  5. Criteria for the product’s risk acceptability. (Note, that oftentimes this is likely to be defined within your Risk Management Procedure.)
  6. Specify methods to verify Risk Control measures are implemented and reduce risks to the pre-established acceptable levels.
  7. Define how post-production information will be captured and fed into Risk Management activities for the product.

The Risk Management Plan evolves and should be kept current--even after product development is completed.

iso 14971 risk management - chapter 6

Risk Management File

A Risk Management File (RMF) is the place where you keep your risk management activities, documentation, and records.

A Risk Management File contains evidence of:

A Risk Management File can be structured and organized by an individual product or for a product family.

It is possible for the RMF to be a reference / pointer document and identify location of the contents, although I do not recommend this approach.

This approach is full of opportunities for document and record-keeping errors.

A best practice is to keep the contents of the product Risk Management File together in a single location for ease of access and use.

This is very difficult to manage and maintain using a paper-based approach. And you can search far and wide for a software solution that is compliant with ISO 14971.

But I’ll save you a bit of time and effort and point you to the only software solution that aligns with ISO 14971: Greenlight Guru (That’s part of the reason we built it).

Our purpose-built workflows enable you to align and maintain compliance with ISO 14971:2019 and the risk-based requirements of ISO 13485:2016. Learn more about Greenlight Guru’s Risk Management Software ➔

iso 14971 risk management - chapter sevenRisk Assessment = Risk Analysis + Risk Evaluation

ISO 14971 discusses Risk Analysis and Risk Evaluation as separate sets of tasks that together comprise Risk Assessment.

As a practical matter, I will generally conduct Risk Analysis and Risk Evaluation at the same time.

To do so, it is important for you to understand the tasks involved with each.

Risk Analysis

The starting point for identifying specific risks related to medical device products is Risk Analysis.

There are lots of ways you can conduct Risk Analysis.

Many techniques are used throughout the industry, including preliminary hazards analysis, FMEA, and fault tree analysis.

Know that each of these techniques has pros and cons.

You should also know that if you are using FMEA only for your Risk Management efforts, you are NOT meeting the intent of ISO 14971.

FMEA is a reliability tool that assumes single-fault failures as part of analysis. Risk Management is broader than just failures; risks exist when medical devices are used without failure modes.

In my opinion, as you go through Risk Analysis, Risk Evaluation, and Risk Controls, there is a good flow and progression.

You should define an approach that helps you document and capture all of these Risk Management steps (which I explain in the Ideal Risk Management Workflow section of this guide).

Risk Analysis Process

The Risk Analysis Process is typically described in your company’s Risk Management procedure.

The Risk Analysis must identify the medical device, as well as who was involved, risk analysis scope, and date(s).

Intended Use

When you start your Risk Analysis, you should work from a documented intended use statement .

Yes, this should be the same intended use that you capture as part of Design Controls when defining User Needs and Design Inputs.

Knowing the intended use is important for Risk Management. This statement helps define the scope and will be instrumental as you identify hazards, harms, etc.

Once you have defined the intended use, chances are you will be able to also identify cases of foreseeable misuse too.

You should define these and include intentional and unintentional misuse cases. Yes, you should consider off-label uses of the device.

There will be hazards from your product being used correctly and as intended.

There will also be hazards from foreseeable misuse.

The safety characteristics included in your medical device should be identified. Things like special guards or redundant features are good examples.

One excellent way to ensure safety characteristics are established and documented is to define these as specific Design Inputs in your Design History File.

Identification of Hazards

Hazards are potential sources of harm.

For your product, you need to identify all the possible hazards. ISO 14971 Annex C contains a great list of examples of hazards.

Here are a few examples: