ISO 14971 RISK Management For Medical Devices: The Definitive Guide
ISO 14971 RISK Management For Medical Devices: The Definitive Guide
ISO 14971 RISK Management For Medical Devices: The Definitive Guide
TOM RISH,
MEDICAL DEVICE GURU AT GREENLIGHT GURU
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 1
TABL E O F CONTENTS
WHAT IS RISK
• What is RISK?
There are things that each of us do every day that involves RISK.
The food you eat, the habits you have, your daily routine – all full of risks in some
One of the riskiest things I do just about every single day is drive my car.
But I don’t usually think about this being a risk at all. I take it for granted.
Could I get in an accident? Could I get injured or possibly die? Of course. Yet I
estimate that the likelihood of these things happening to me are low enough that
Maybe it’s because I know that my car has anti-lock brakes, seat belts, and airbags.
Maybe it’s because I know that the car I drive has been through rigorous safety testing.
Risk per ISO 14971 is defined as the combination of the probability of occurrence
The intent behind Risk Management is to identify, evaluate, analyze, assess, and
I remember the first day on the job as a medical device product development
engineer. During the orientation, I was shown a company video that included
Every person shown on the video talked about a common theme: realizing that
the medical devices they were part of bringing to market could someday be used
It started to hit me. The gravity and importance of the job I was about to start.
Imagine this from the perspective of a patient going in for any medical
procedure. The patient probably thinks very little about the risks of the medical
Generally, the patient trusts the expertise of the clinicians. The patient seldom
wonders if the products used by the clinicians are safe and have been
The patient, often unknowingly, accepts the risks of the medical device you and I
And this is exactly why Risk Management is so important to the medical device industry.
You have to know that the medical devices you are involved with bringing to
WWW.GREENLIGHT.GURU
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 4
My entry into the medical device industry was not a planned career path. Within
the first few months of starting as a product development engineer, I knew that I
would spend the rest of my life involved with the medical device industry.
Why?
Because I knew then, as I do now, that I have a positive impact on the quality of life.
Products that I have helped design, develop, and bring to market have improved
the quality of life for thousands and thousands of people. And today, I am
fortunate to have an opportunity to work with many others who have the same
If you think about it, the ideal of improving the quality of life is the very premise
The topic of Risk Management is one that can be daunting, and at times
confusing. Thankfully, ISO 14971 exists and is helpful in providing guidance and
direction.
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 5
ISO 14971 provides a thorough explanation of relevant terms and definitions. And
I’ve written this guide to align with the latest version of ISO 14971 and to provide
you additional tips and insights for medical device risk management.
For me, it is very interesting to observe and listen to feedback and comments
about the topic from the perspectives of the experts, the regulators, the
Many times, it seems as though each of these perspectives has a very different
view of the world regarding medical device Risk Management. At times, it seems
The practice of Risk Management in the medical device industry is also intriguing
to me. By and large, what I have observed is that Risk Management is too often
But we should.
WWW.GREENLIGHT.GURU
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 6
4. To share with you all the steps that you need to define and address
within your Risk Management procedures.
Please note that the focus of this guide is strictly medical device product risk
management. I will not explore other “risk management” topics such as business
or project.
Realize that nearly every medical device regulatory agency has placed the topic
In fact, regulatory agencies, including FDA, are now using risk-based processes
throughout their own internal processes when reviewing device submissions and
KNOW THIS: U.S. FDA, Health Canada, EU Competent Authority, Australia TGA,
and Japan MHLW all require you to have a Risk Management process defined
And all these regulatory agencies endorse ISO 14971 Medical devices —
In addition to ISO 14971, there are several other key medical device industry
• IEC 60601
• IEC 62366
• ISO 10993
• ISO 13485
Yes, all these standards make reference to risk management (and ISO 14971).
management systems.
The expectation is that you manage risk throughout the entire product lifecycle
I could share with you a history lesson on the genesis and evolution of medical
While there may be some merit in going through this history, I suspect you are
The current “state of the art” regarding risk management is described in the standard
WWW.GREENLIGHT.GURU
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 8
The current version of ISO 14971 was released in December 2019. This version
replaced the previous two versions of the standard that were utilized by many of
As you likely know, the EN version was applicable if you were selling medical
now identical to the regular version of ISO 14971:2019. When selling in Europe
though, it is important to know that additional risk requirements apply, which are
identify the hazards associated with the medical device, to estimate and
evaluate the associated risks, to control these risks, and to monitor the
that are not necessarily medical devices in some jurisdictions and can also
ISO 14971 is a very good standard. While not prescriptive per se, the standard
does a very good job of explaining the requirements, expectations, and stages
WWW.GREENLIGHT.GURU
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 10
of ISO 14971, I highly recommend that you do make ~$200 decision to actually
The medical device regulatory world has adopted this standard. And I see no
ISO 14971. 24971 (no, it’s not a typo) is a guidance document specifically for ISO
14971. If you are seeking additional insights and guidance on application of ISO
Design Controls are intended to demonstrate that a medical device has been:
Your Design Controls will prove that your medical device is safe for use.
The intent behind Risk Management is to identify, evaluate, analyze, assess, and
There is a very strong correlation and relationship between Design Controls and
Risk Management.
With Design Controls, you also identify, evaluate, analyze, assess, and mitigate
If you are thorough with defining and documenting User Needs, Design Inputs,
then you will be on the right track towards ensuring your medical device is safe.
Prior to clinical use, you have to know without a doubt that the product is safe
and/or determine that the medical benefits outweigh the risks (which should be
Realize that your overall goal in medical device product development and
WWW.GREENLIGHT.GURU
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 12
Having solid Design Controls in place is NOT a substitute for Risk Management.
Realize that Risk Management is just as important (maybe more so) than Design
Controls.
Realize that Risk Management is a way to evaluate your product from a different
perspective.
Realize that good Risk Management involves a series of tools, when used
properly, will drastically improve the quality, safety, and effectiveness of your
medical device.
The best practices of medical device product development have a good flow
between Design Controls and Risk Management.
For example, as you identify hazards and hazardous situations, these should
“feed” into the Design Controls process in defining User Needs and Design
Inputs.
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 13
When you evaluate risks, you will need to establish Risk Controls to mitigate
and reduce risks. Design Outputs, Design Verifications, and Design Validations
In fact, using Risk Management as a real tool will help you with Design
Risk Controls are used to help identify ways to reduce the risks. Your Risk Controls
should align with and include Design Verification and Design Validation activities.
Are you starting to see how closely related Risk Management and Design
reference the ISO 14971 standard (the reasons for this are described earlier
in this guide).
WWW.GREENLIGHT.GURU
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 14
• Risk Analysis
• Risk Evaluation
• Risk Controls
The infographic below aligns directly with the ISO 14971 standard on a one to
7 Risk Control
RISK CONTROL (7)
Risk Control
No Measure Yes
Required?
Does Design
Residual Output
If you are developing
Risk Level medical devices
Require Risk
in this day and age,
Is the Risk
as low as
you absolutely must
Verification
Yes Validation
Benefit Analysis? possible?
Documents
Risk Benefit Output
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 15
As you go through this guide, I will share with you all the steps that you need to
Risk Management needs to involve more than just engineers and product
developers.
Why?
All of these functional areas provide different perspectives and experiences for
There are several key terms pertaining to Risk Management defined in ISO 14971
WWW.GREENLIGHT.GURU
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 16
monitoring risk
that harm
evaluation
implemented by which risks are reduced to, or maintained within, specified levels
RESIDUAL RISK – risk remaining after risk control measures have been taken
Realize that in practice, many people use the terminology incorrectly and/or
interchangeably.
For example, someone might use “risk analysis” to refer to “risk management”.
When this happens, I recommend asking the person to explain what they mean.
I’ve witnessed (and probably participated in) several disagreements where the
Often times, it is assumed that the topic of Risk Management is only the
new products.
WWW.GREENLIGHT.GURU
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 18
While it is true that product developers and engineers do play a pivotal role,
This means that, in addition to product developers and engineers, other functional
2. Executive management has the responsibility for making sure there are
adequate and appropriate resources for conducting risk management
activities.
The Risk Management Plan should identify the risk management activities you
The Risk Management Plan is dynamic and should be revisited and updated
5. Criteria for the product’s risk acceptability. (Note, that often times this is
WWW.GREENLIGHT.GURU
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 20
The Risk Management Plan evolves and should be kept current — even after
A Risk Management File (RMF) is the place where you keep your risk
• Risk Analysis
• Risk Evaluation
• Risk Controls
Why?
A best practice is to keep the contents of the product Risk Management File
This is very difficult to manage and maintain using a paper-based approach. And
you can search far and wide for a software solution that is compliant with ISO
14971.
But I’ll save you a bit of time and effort and point you to the only software
solution that aligns with ISO 14971: Greenlight Guru (That’s part of the reason we
built it).
If you’d like to see just how much easier managing and maintaining a Risk
Management File is with Greenlight Guru vs. a paper-based approach, click here
WWW.GREENLIGHT.GURU
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 22
ISO 14971 discusses Risk Analysis and Risk Evaluation as separate sets of tasks
As a practical matter, I will generally conduct Risk Analysis and Risk Evaluation at
To do so, it is important for you to understand the tasks involved with each.
RISK ANALYSIS
The starting point for identifying specific risks related to medical device products
is Risk Analysis.
Many techniques are used throughout the industry, including preliminary hazards
You should also know that if you are using FMEA only for your Risk Management
FMEA is a reliability tool that assumes single-fault failures as part of analysis. Risk
Management is broader than just failures; risks exist when medical devices are
You should define an approach that helps you document and capture all of these
Risk Management steps (which I explain in the Ideal Risk Management Workflow
Management procedure.
The Risk Analysis must identify the medical device, as well as who was involved,
Intended Use
When you start your Risk Analysis, you should work from a documented intended
use statement.
Yes, this should be the same intended use that you capture as part of Design
Knowing the intended use is important for Risk Management. This statement helps
define the scope and will be instrumental as you identify hazards, harms, etc.
Once you have defined the intended use, chances are you will be able to also
WWW.GREENLIGHT.GURU
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 24
You should define these and include intentional and unintentional misuse cases.
There will be hazards from your product being used correctly and as intended.
document is to define these as specific Design Inputs in your Design History File.
Identification of Hazards
For your product, you need to identify all the possible hazards. ISO 14971 Annex
• Electromagnetic Energy
- Line Voltage
- Leakage Current
- Electric Fields
• Thermal Energy
• Mechanical Energy
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 25
- Gravity
- Vibration
• Biological
- Bacteria
- Viruses
• Chemical
A good technique for identifying hazards is to go through all the steps required
for your product to be used. At each step, identify if there are any potential
sources of harm.
Keep in mind that “harm” is generally focused on the patient. But it should also
You may be wondering how you can possibly identify hazards when you do not
And I encourage you to attempt to identify hazards as early in the medical device
WWW.GREENLIGHT.GURU
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 26
Why?
When you identify hazards early, you have an opportunity to make sure that
your product’s User Needs and Design Inputs are defined in a way to address
any potential concerns. Doing so ensures that your Design Controls and Risk
And there is only one software platform designed specifically to integrate Design
Controls and Risk Management. Yep, you guessed it: Greenlight Guru.
Hazardous Situations
hazard.
Once again, understanding the intended use and the steps involved in using
your medical device should help guide you through this process.
The foreseeable sequence of events that someone will go through in using your
As you can see from the provided example, in order for the Hazardous Situation
to occur, there are a series of things that must happen first (Foreseeable
Sequence of Events).
single medical device. This is 100% true even if the medical device is used
Once a Hazardous Situation is identified, you need to identify all the possible harms.
Each Hazardous Situation is likely to have multiple possible harms. Capture each.
Once harms are identified, you need to estimate the risk of each harm.
WWW.GREENLIGHT.GURU
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 28
Risk per ISO 14971 is defined as the combination of the probability of occurrence
I should also remind you of the definition of harm. Harm is physical injury or
So risk estimation requires you to identify two things: severity and probability of
occurrence.
A common technique that is used is defining descriptions for various levels for
Severity Description
The severity levels and descriptions should align with your medical devices.
Frequent 1 in 100
Probable 1 in 1,000
Occasional 1 in 10,000
Remote 1 in 100,000
Improbable 1 in 1,000,000
the example above). Sometimes this can be difficult to estimate because your
Note that there is no medical device industry standard for severity and
probability of occurrence.
• Similar products
WWW.GREENLIGHT.GURU
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 30
• Industry standards
• End-user expertise
For each Hazardous Situation, you need to estimate the Severity and estimate
The table below shows the occurrence and severity levels. As you can see, risk
RISK EVALUATION
Once Risks for each Harm has been estimated, you now need to evaluate these
example, I identified three risk levels or “zones”: low, medium, and high.
Your risk acceptability does not necessarily need to have three zones.
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 31
A common practice for Risk Evaluation is to identify which risk zones are
acceptable and which require risk reduction. This is something that you need to
For those selling in the US, the typical practice is to correlate the low zone with
an acceptable risk and the high zone with unacceptable risk. The medium zone
often fits into what is referred to “as low as reasonably practicable.” Items in
the high risk levels require risk reduction and those in the medium level are
For those selling devices into the EU market, it is important to know that the EU
MDR states that you must “reduce risks as far as possible” meaning you need to
consider risk reductions for all risks, regardless of the risk level.
RISK CONTROLS
Now that you have conducted a Risk Analysis and Risk Evaluation, you are now
RISK REDUCTION
During Risk Evaluation, you identified items that require risk reduction. Risk
WWW.GREENLIGHT.GURU
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 32
Risk Controls are measures that you take with your medical device to reduce the
speaking, a Risk Control will have the most significant impact on the probability
of occurrence of a harm.
All too often, when Risk Controls are identified, they are more likely to involve
But please remember this. You should consider Risk Control options according
Risk Controls should be focused on the specific design features first and labeling
as a last resort.
And yes, it is possible to include multiple Risk Controls to reduce risk. This is
I’ve shared a few times throughout this guide on the connection between Design
Controls and Risk Management. Risk Controls is an area with very strong ties to
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 33
Design Controls.
Using Greenlight Guru’s software allows you to easily link Risk Controls to specific
Design Controls (and this is the only solution available on the market for this).
Once Risk Controls are identified, the next step is to implement them.
And if you follow my tip above about using Design Outputs, Design Verifications,
easier since these items are required as part of your Design Controls process.
Once Risk Controls are implemented, then you need to verify that this has
happened and determine the effectiveness of the measures taken. Record of this
shall be documented.
Now that Risk Controls have been implemented and verified for effectiveness, it
WWW.GREENLIGHT.GURU
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 34
You are going to use the same criteria you established for severity, occurrence,
The objective is to evaluate the residual risks to determine if the risk level has
possible).
In the event the residual risks are still unacceptable, revisit Risk Controls to
BENEFIT-RISK ANALYSIS
The concept of a benefit-risk analysis is this: the medical benefits of the medical
After you identify Risk Controls and evaluate residual risks, it is still possible that
you will have some risks that are still in the unacceptable level. In these cases, it
The BRA must be documented and provided objective evidence and rationale
for why the medical benefits outweigh the unacceptable risks. If you are able to
do so, the BRA is a special provision for moving forward with unacceptable risks.
in a BRA.
Please note that the benefit-risk analysis topic can be a slippery slope. You should
definitely take every possible measure to reduce the risk first via Risk Controls.
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 35
As an important side note, some individuals that are following the EU MDR say
that a BRA is required for all risks. The rationale is the regulations state that all
risks shall be reduced as far as possible. This is something to consider when you
There is another twist to consider after you have implemented Risk Controls.
And the twist is, “did your Risk Controls introduce any new hazards or hazardous
situations?”
If so, then you need to add the hazards and hazardous situations and go through
So far, you have evaluated the individual risks identified for your medical device.
The next step is to now evaluate the overall residual risk acceptability of the
WWW.GREENLIGHT.GURU
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 36
To do so, you are going to use the same severity, occurrence, risk level, and risk
If you determine that the overall residual risk of the entire product is not
acceptable, this is another case where you can conduct a benefit-risk analysis.
The overall BRA should be included with your Risk Management Report.
If you determine that the overall residual risk of the entire product is acceptable,
document this decision and support your rationale. I recommend including this in
Before going to market with your medical device, the results of all steps in your
You need to establish a Risk Management Report which will summarize all your
risk management activities and include any benefit-risk analyses and explanation
The Risk Management Report should also discuss your plans for evaluating risks
PRODUCTION &
POST-PRODUCTION INFORMATION
Very few companies have figured out how to ensure RMF is living after product
development.
However, Greenlight Guru’s software allows you to keep your RMF documents
You need to ensure that post-production processes that you have in place to
support your QMS are feeding into your Risk Management process.
Complaints need to tie into Risk Management. Did the complaint identify a new
hazard or hazardous situation not captured? Does the occurrence of harm align
Customer feedback needs to tie into Risk Management. Did you learn something
WWW.GREENLIGHT.GURU
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 38
The point is this: Once you begin manufacturing and launch your medical device
into the market, you are going to learn a great deal about the product.
You need to make sure that your Risk Management documentation is current and
as best as possible, an accurate reflection of the actual risks your product poses.
One poor practice I have observed is adding a “risk” section to CAPA, complaint,
I do not recommend taking this angle. Yes, these forms should identify whether
favor and make an update to the actual Risk Management File that you worked
SUMMARY
• Risk Analysis
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 39
• Risk Evaluation
• Risk Controls
Risk Management can be a difficult process. Use ISO 14971 and this guide to help
make it easier.
To help you with Design Controls and Risk Management. To help you align with
devices.
You can definitely try to manage all this with paper. I did this — 15 years ago.
There is no reason that you have to take that kind of risk today. We’ve built
If you’re ready to get serious about your risk management and product
WWW.GREENLIGHT.GURU
ISO 14971 RISK MANAGEMENT FOR MEDICAL DEVICES: THE DEFINITIVE GUIDE PAGE 40
ISO 14971
RISK MANAGEMENT
FOR MEDICAL
DEVICES: THE
DEFINITIVE
GUIDE
317-960-4220
WWW.GREENLIGHT.GURU