ISO 14971:2019 risk management checklist

A comprehensive risk management process must be established that covers the entire product lifecycle from initial concept through design, manufacturing, distribution, use, and final disposal. This process must be systematic, documented, and continuously maintained with defined roles, cross-functional participation, and integration into the quality management system. The process should address both foreseeable and emerging hazards using structured techniques such as FMEA, fault tree analysis, and severity-probability matrices.

Risk management is not a one-time activity but must be maintained from initial conception through design, production, distribution, clinical use, servicing, and final disposal of the device. Each lifecycle phase introduces unique hazards that require identification and control. Design changes, manufacturing process modifications, and post-market field data must all trigger risk re-assessment activities to ensure ongoing safety throughout the device's commercial life.

The risk management process must systematically address all four key elements to ensure comprehensive risk management: risk analysis identifies hazards and estimates risks, risk evaluation determines acceptability, risk control reduces unacceptable risks, and production/post-production activities provide ongoing monitoring. These elements must be interconnected with clear feedback loops, not treated as isolated sequential steps, to maintain a living risk profile throughout the device lifecycle.

Risk management must be integrated into existing product development and realization processes rather than operating as a separate parallel system. Design reviews, verification planning, validation protocols, and change control procedures should all include risk management deliverables as mandatory inputs. This integration ensures risk considerations drive design decisions in real time and that design changes trigger immediate risk re-assessment rather than periodic batch updates.

All risk management activities must be documented to demonstrate compliance with the standard through objective evidence. Documentation must be sufficient for an independent reviewer or auditor to reconstruct the risk management rationale, trace each hazard from identification through control and residual risk acceptance, and verify that the process was followed systematically. Records must be controlled, retained, and readily accessible for regulatory inspection.

A risk management process must cover the full device lifecycle: identifying hazards across all reasonably foreseeable use scenarios, estimating risk against defined scales and criteria, evaluating risk against approved acceptability thresholds, implementing risk controls in the established priority order, and monitoring control effectiveness using production and post-market data. The process can sit within the existing quality management system and should connect to product-realization activities such as the design and production controls in ISO 13485. Auditors should confirm the process is actually maintained in practice, not documented once and shelved.

The process must systematically address all four core elements of risk management in a coordinated manner: risk analysis to identify and estimate hazards, risk evaluation to judge acceptability, risk control to reduce unacceptable risks, and production/post-production activities for ongoing monitoring. These elements form an iterative cycle where post-production data feeds back to refine risk analysis. Each element must have defined inputs, outputs, decision criteria, and documentation requirements to ensure a complete and auditable risk management record.

Risk management must be integrated into existing development processes, not run in parallel as a separate administrative exercise. Product realization activities such as design input definition, design verification, design validation, process validation, and change control should each incorporate risk management deliverables. Gate reviews must include risk status as a mandatory criterion for progression. This ensures risk considerations actively drive design decisions rather than merely documenting them after the fact.

Risk management must be an ongoing process from initial concept through final disposal, not just during design and development. Each lifecycle phase introduces unique hazards: design decisions may create latent failure modes, manufacturing variations can affect safety margins, distribution and storage conditions can degrade device integrity, clinical use exposes patients to residual risks, and disposal may involve biohazard or environmental concerns. The process must have defined triggers for re-assessment at each phase transition.

Top management must show active commitment through real resource allocation and personnel assignment, not just a signed policy. ISO/TR 24971 stresses that this commitment should be visible and measurable. Operational responsibility can be delegated, but accountability remains with top management, so look for evidence of genuine engagement (budget, headcount, participation in risk reviews) rather than a policy statement alone.

Management must establish a formal policy that defines how risk acceptability criteria are determined, considering regulatory requirements and state of the art. The policy should include clear statement of risk philosophy, reference to applicable regulations, process for determining acceptability levels, consideration of similar devices, and benefit-risk framework.

Management must conduct periodic reviews of the risk management process effectiveness, not just individual risk assessments. ISO/TR 24971 recommends at least annual reviews, or when significant changes occur. Reviews should assess effectiveness indicators such as field issues, process timeliness, quality of assessments, and regulatory findings.

Organizations must define competency requirements for risk management roles, ensure personnel meet these requirements, and maintain evidence of competence. ISO/TR 24971 identifies key competency areas: risk management principles and methods, medical device technology, clinical application and use environment, regulatory requirements, statistical methods, human factors/usability engineering, manufacturing processes, and quality system requirements.

Competence must cover both technical device knowledge and broader contextual understanding including clinical use and regulatory environment. Not every person needs all competencies, but the team collectively should cover all areas including clinical/medical expertise, engineering/design expertise, manufacturing expertise, quality/regulatory expertise, service/field experience, and human factors expertise.

Competence records must be documented, controlled, and retained per quality system and regulatory requirements. Records should demonstrate not only that training was completed but that competence was assessed and confirmed through objective means such as examinations, practical demonstrations, or supervised work products. Records must be maintained throughout employment and updated when roles change, new competency requirements emerge, or periodic reassessments are conducted.

A documented plan must be created before risk management activities begin, either for individual devices or device families where appropriate. The plan establishes the scope, methodology, and acceptance criteria for all subsequent risk management activities. Device family plans must include a clear justification for grouping and analysis of common versus unique hazards. The plan must be formally approved, version-controlled, and stored in the risk management file. It serves as the foundational roadmap ensuring systematic and consistent risk management execution.

The plan must comprehensively address all aspects of how risk management will be conducted, with specific required elements covering scope, responsibilities, review requirements, acceptability criteria, overall residual risk evaluation methodology, verification activities, and post-production information collection. Each element should be sufficiently detailed to guide execution without ambiguity. The scope must clearly identify the device, lifecycle phases covered, and any exclusions. Responsibility assignments should use a RACI or equivalent framework.

The plan must be actively maintained and updated throughout the risk management process as new information becomes available. This requires defined criteria for when updates are necessary, a formal change control process for plan modifications, management approval of significant changes, and distribution of updated plans to all stakeholders. The plan should be reviewed at minimum when significant design changes occur, when post-market data reveals new hazards, when regulatory requirements change, or when process improvements are identified.

The plan must clearly define what device(s) it covers and which lifecycle phases are addressed, including any exclusions with documented justification. The scope should reference the device name, model numbers, intended use statement, regulatory classification, applicable standards, and all variants or configurations covered. Lifecycle phase coverage must explicitly address design, manufacturing, distribution, clinical use, maintenance, and disposal phases. Any narrowing of scope must be justified and approved.

Clear assignment of who is responsible and has authority for each risk management activity is essential for accountability and efficient execution. The plan should use a RACI matrix or equivalent to define responsibility, accountability, consultation, and information roles for each major activity. Authority levels for risk acceptance decisions, the composition and charter of the cross-functional risk team, competency requirements for each role, and backup or succession assignments should all be documented.

The plan must define when and how risk management activities will be reviewed, including the frequency, participants, criteria, and escalation procedures for review activities. Reviews should occur at planned milestones aligned with design control phases, when significant new information becomes available, and at defined intervals during the post-production phase. Review criteria should be objective and testable, reviewer qualifications should be specified, and review outcomes must be documented with action items tracked to closure.

The plan must define how to determine if risks are acceptable, including special cases where probability cannot be determined. Criteria must include clearly defined probability and severity scales with unambiguous category boundaries, a risk acceptability matrix showing acceptable, ALARP, and unacceptable zones, specific criteria for handling risks where probability of occurrence cannot be estimated, guidance on benefit-risk considerations for borderline decisions, and alignment with applicable regulatory requirements and state of the art.

The plan must define how all remaining risks will be evaluated collectively and what makes the overall residual risk acceptable. The overall residual risk evaluation must consider not just individual residual risks in isolation but their cumulative and synergistic effects on patient safety. The methodology should address how individual residual risks are aggregated, how interactions between residual risks are evaluated, and how the benefit-risk balance is assessed when overall residual risk exceeds normal thresholds.

The plan must define how risk control measures will be verified to ensure they are effective, including both implementation verification and effectiveness verification. Verification planning should specify methods such as testing, analysis, inspection, or demonstration; acceptance criteria derived from risk reduction targets; sample sizes and statistical rationale where applicable; and the relationship between risk verification activities and QMS design verification and validation activities.

The plan must define how production and post-market data will be collected and reviewed for risk implications, including sources such as complaint data, adverse event reports, field service records, clinical follow-up studies, and literature monitoring. The plan should specify data collection methods, review frequency, criteria for triggering risk re-assessment, responsible personnel, and feedback mechanisms to update the risk management file. This element ensures risk management remains a living process.

A risk management file must hold all risk management documentation with clear traceability from hazard identification through final risk acceptance. ISO/TR 24971 recommends a standardized structure spanning the risk management plan, analysis reports, evaluation documentation, control documentation, overall residual-risk evaluation, the risk management review, and post-production information. The file does not have to be a single binder; it can be assembled by reference from other QMS or regulatory records, in any suitable medium, as long as the traceability holds together.

The file must contain all key risk management deliverables either directly or through clear references to their locations. ISO/TR 24971 provides content details: risk management plan (version-controlled, approved), risk analysis (all worksheets, FMEAs, FTAs, use error analysis), risk evaluation (decisions with rationale, meeting minutes), risk control (specifications, verification/validation reports), residual risk (final risk levels, benefit-risk analyses), risk review (management review with actions), and post-production (complaint data, field experience, updates).

The file is a living document that must be updated with new information throughout the entire device lifecycle. ISO/TR 24971 identifies update triggers: design changes, manufacturing process changes, new clinical data, adverse events, regulatory changes, new standards, complaint trends, and audit findings. Best practices include annual file review minimum, clear update procedures, version control system, archiving superseded documents, and maintaining file integrity.

Risk analysis is a comprehensive process that systematically identifies and estimates all risks associated with a medical device throughout its lifecycle. This is the foundation of risk management and must be systematic and comprehensive.

All five sub-elements must be completed systematically and documented for comprehensive risk analysis. Each element builds on the previous one. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Risk analysis is not a one-time activity but must be maintained and updated as the device and knowledge evolve. Updates should occur when design changes, new clinical data emerges, post-market events occur, or regulations change.

A comprehensive risk analysis must be performed that systematically identifies and estimates all risks associated with the device, including both intended use and foreseeable misuse scenarios.

All risk analysis activities, methods, data, and results must be documented and maintained in the risk management file. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Every hazardous situation must have an associated risk estimate, even when probability cannot be determined. In such cases, list all possible consequences. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Risk analysis must be evidence-based, using all available relevant information sources to ensure comprehensive hazard identification and accurate risk estimation. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

The risk analysis must cover the scope defined in the risk management plan, ensuring consistency and completeness across all planned areas. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Hazard identification must follow a structured, repeatable methodology to ensure consistency and completeness. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

A comprehensive definition of intended use must be documented, covering all aspects of how, where, by whom, and for what purpose the device will be used. Additionally, potential misuse scenarios including both unintentional use errors and intentional misuse must be documented.

Both intended use and misuse documentation must be included in the risk management file and actively used in the hazard identification process. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

ISO/TR 24971:2020 A.2.5.2 states: 'The intended use of the medical device is an important aspect and is the starting point of the risk analysis. The manufacturer should consider the intended user(s) of the medical device, e.g., whether a lay user or a trained medical professional will use the medical device.'

ISO/TR 24971:2020 A.2.5.2 clarifies: 'This analysis should consider that the medical device can also be used in situations other than those intended by the manufacturer and in situations other than those foreseen when the idea for a medical device was first conceived. It is important that the manufacturer tries to look into the future to see the hazards due to potential uses of their medical device and also the reasonably foreseeable misuse.'

All device characteristics that could potentially impact safety must be systematically identified, documented, and where applicable, have defined limits. This includes physical, chemical, electrical, biological, and software characteristics.

Use ISO 14971 Annex C questions systematically. Document all characteristics with clear limits where applicable. Consider full lifecycle including degradation. Categories include: physical, chemical, electrical, biological, and software.

All identified characteristics and defined limits must be formally documented and maintained in the risk management file with clear traceability. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

For quantitative characteristics, specific acceptable limits must be defined based on safety requirements. Limits should be based on scientific evidence, standards, and clinical requirements.

All potential hazards must be systematically identified considering normal use, fault conditions, use errors, and environmental factors throughout the device lifecycle. Use multiple identification methods including top-down, bottom-up, and experiential.

All identified hazards and hazardous situations must be documented comprehensively with clear traceability. Maintain comprehensive hazard log with unique identifiers. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Use multiple identification methods. Include diverse team members. Consider all lifecycle phases. Document all hazards even if later deemed not applicable. Methods include: FMEA, FTA, HAZOP, PHA, incident analysis, and expert consultation.

Hazard identification must systematically address every lifecycle phase, not just the use phase. Create lifecycle phase checklist. Analyze each phase systematically. Consider phase-specific standards.

The analysis must identify how hazards lead to hazardous situations through various event sequences, considering the chain of events from hazard to potential harm. Document clear event sequences from hazard to hazardous situation. Consider multiple pathways and combination events.

Risk must be estimated for every hazardous situation by combining probability of occurrence and severity of potential harm. Define clear probability and severity scales. Use available data for estimates. Document estimation rationale.

Risk estimation combines P1 (probability of hazardous situation occurring) × P2 (probability of hazardous situation leading to harm). Severity considers type of injury, number affected, duration, reversibility, and impact on quality of life.

All risk estimations including probability, severity, methods used, and supporting data must be documented. Create comprehensive estimation records. Include all supporting information. Maintain clear audit trail.

Probability estimates should be based on objective data where available, with multiple information sources considered. Prioritize quantitative data. Document all sources used. Address uncertainty explicitly. Use conservative estimates when data is limited.

Severity must be estimated based on the worst credible consequence that could result from the hazardous situation. Define clear severity categories with medical input. Consider worst credible outcomes. Be consistent across similar harms.

A consistent, systematic method must be applied to all risk estimations, with appropriate detail based on device complexity and risk level. Document standard estimation method. Train all participants. Implement peer review. Scale detail to risk level.

Every identified risk must be evaluated against pre-defined acceptability criteria to determine if risk reduction is needed. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Risks that meet acceptability criteria do not require risk control measures but still need to be documented and communicated. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Any risk that does not meet acceptability criteria must proceed to risk control to reduce the risk to acceptable levels. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

A deliberate decision process must determine which residual risks are disclosed to users, with documented rationale for non-disclosure decisions. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

All risk evaluation activities, decisions, and rationales must be documented in the risk management file. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

The same criteria must be applied uniformly to all risks, ensuring objectivity and consistency in evaluation. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Risk control is a systematic process to reduce unacceptable risks to acceptable levels through various control measures following a defined hierarchy. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Risk controls must be selected and applied following a strict hierarchy that prioritizes elimination and engineering controls over warnings. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Risk control requires flexible thinking about how measures work and can be combined for optimal risk reduction. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

All six sub-elements must be completed systematically to ensure comprehensive risk control. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

For each unacceptable risk identified during risk evaluation, the manufacturer must identify potential control measures that can reduce the risk to acceptable levels. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

When risk cannot be reduced to acceptable levels through any practicable means, a benefit-risk analysis is required to determine if the residual risk is acceptable. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

All selected risk control measures must be documented with clear traceability to the risks they address. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

The highest priority should be given to design features that eliminate hazards entirely or reduce risks through inherent characteristics of the design. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

When hazards cannot be eliminated, protective measures should be built into the device or manufacturing process to prevent or detect hazardous situations. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

When risks cannot be adequately controlled through design or protective measures, information must be provided to users to enable safe use. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

All selected risk control measures must be fully implemented in the device design, manufacturing process, or accompanying documentation. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Complete documentation of implementation and effectiveness verification must be maintained with clear traceability. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Beyond implementation verification, the actual effectiveness in reducing risk must be verified through appropriate testing or analysis. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Each implemented control must be verified to ensure it was correctly implemented as specified. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Each risk must be re-evaluated after controls are implemented to determine if the remaining (residual) risk is now acceptable. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Even acceptable residual risks may need to be disclosed to users depending on their nature and significance. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

All residual risk evaluations, decisions, and supporting analyses must be documented. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Unacceptable residual risks require either additional controls or formal benefit-risk analysis if no further controls are practicable. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Residual risk evaluation must verify both intended risk reduction and absence of new risks from controls. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

When risk cannot be reduced to acceptable levels despite all practicable controls, a formal benefit-risk analysis may justify proceeding with the unacceptable residual risk. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

The benefit-risk analysis must reach a clear, evidence-based conclusion that is either positive (benefits outweigh risks) or negative (risk remains unacceptable). This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Residual risks that required benefit-risk analysis must be disclosed to users in product documentation. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Complete documentation of the analysis methodology, evidence, reasoning, and conclusions must be maintained. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Different patient populations may have different benefit-risk profiles that must be analyzed separately. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Every risk control measure must be evaluated to determine if it creates new risks or affects other existing risks. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

All evaluations of risks arising from control measures must be documented, including new risks identified and management decisions. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

New risks must be evaluated considering degradation, wear, user habituation, and other time-dependent factors. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

New risks introduced by control measures must go through the complete risk management process from estimation through control. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Evaluate whether the control measure itself creates entirely new hazards that did not exist before. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Evaluate whether implementing the control measure changes the probability or severity of other existing risks. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

A systematic review must verify that every identified risk has been addressed through the risk control process with no gaps or omissions. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

The completeness review must be formally documented with clear evidence of comprehensive verification. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Risk control completeness includes ensuring all necessary information is available for ongoing risk management. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Any gaps identified during completeness review must be addressed before risk control can be considered complete. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Every residual risk must have a documented acceptability decision or completed benefit-risk analysis. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

Completeness review must confirm not just that controls exist, but that they are fully implemented and proven effective. This requirement must be addressed through documented procedures with clear responsibilities, objective acceptance criteria, and evidence maintained in the risk management file. Compliance verification should confirm both the existence and effectiveness of the documented approach.

The cumulative effect of all individual residual risks must be evaluated as a whole to determine if the device's overall risk-benefit profile is acceptable. This requires: - Systematic method for combining individual risks - Clear documentation of clinical benefits - Visualization tools (risk matrices, dashboards) - Multi-disciplinary review EVALUATION METHODS (ISO/TR 24971 Guidance): QUALITATIVE: - Expert panel assessment - Comparative analysis with predicate devices - Clinical opinion evaluation - Risk profile visualization SEMI-QUANTITATIVE: - Weighted risk scoring - Risk index calculation - Multi-criteria decision analysis - Risk matrices with accumulation CONSIDERATIONS: - Interaction between risks - Common mode failures - Risk accumulation effects - User population vulnerability - Use environment factors BENEFIT ASSESSMENT: Clinical benefits include: - Disease diagnosis improvement - Treatment effectiveness - Patient quality of life enhancement - Reduced invasiveness - Earlier intervention capability Documentation sources: - Clinical literature - Clinical trial data - Real-world evidence - Professional society positions - Regulatory precedents

Pre-defined criteria from the risk management plan must be applied to determine acceptability, and significant risks must be communicated to users. CRITERIA APPLICATION (ISO/TR 24971 Guidance): - Compare to predefined thresholds - Benchmark against similar devices - Consider medical necessity - Evaluate alternative treatments - Assess societal need DISCLOSURE FRAMEWORK: ALWAYS DISCLOSE: - Death or serious injury risks - Risks requiring user action - Risks with no control measures - Contraindications - High probability events CONSIDER DISCLOSING: - Moderate severity risks - Training-dependent risks - Environment-specific risks - Long-term risks DISCLOSURE METHODS: - Warnings in instructions for use - Device labeling - Training requirements - Quick reference cards - Electronic alerts

When overall risk exceeds plan criteria, a formal benefit-risk analysis with additional evidence may justify acceptance, otherwise the device cannot proceed. BENEFIT-RISK FACTORS (ISO/TR 24971 Guidance): BENEFIT CONSIDERATIONS: - Life-saving capability - Significant morbidity reduction - No alternative treatments available - Breakthrough technology - Address unmet medical need - Public health impact RISK CONSIDERATIONS: - Severity of potential harms - Probability of occurrence - Reversibility of harm - Duration of exposure - Vulnerable populations EVIDENCE HIERARCHY: 1. Randomized controlled trials (highest) 2. Systematic reviews/meta-analyses 3. Observational studies 4. Registry data 5. Expert consensus 6. Case reports (lowest) DOCUMENTATION REQUIREMENTS: - Systematic literature search - Evidence quality assessment - Quantitative benefit measures - Uncertainty analysis - External expert input

Unacceptable overall risk requires either additional risk controls, design modification, or intended use changes - the device cannot proceed as-is. OPTIONS TO CONSIDER: - Return to Section 7 for additional risk control measures - Modify device design - Restrict intended use - Change user population - Terminate project if risk cannot be made acceptable All options and decisions must be documented.

Complete documentation of the overall evaluation, methods, decisions, and supporting evidence must be maintained in the risk management file. REQUIRED DOCUMENTATION: - Overall evaluation report - Evaluation method and justification - Decision records with rationale - Supporting evidence and analyses - Review and approval records

A formal review must verify complete and proper execution of all risk management activities before the device can be released to market. REVIEW TIMING (ISO/TR 24971 Guidance): The review must occur when risk management activities are sufficiently complete but before commercial release. REVIEW PARTICIPANTS: The review team should include representatives from various functions with appropriate competence (technical, clinical, quality, regulatory). REVIEW CHECKLIST: PLAN IMPLEMENTATION: - All planned activities completed - Deviations documented and justified - Required competencies demonstrated - Responsibilities fulfilled as assigned TECHNICAL COMPLETENESS: - Risk analysis comprehensive - All risks evaluated against criteria - Controls implemented and verified - Residual risks assessed DOCUMENTATION: - Risk management file complete - Traceability demonstrated - Decisions documented with rationale - Reviews and approvals obtained

Review findings must be documented, and any identified gaps must be resolved before the device can be released. Per ISO/TR 24971, emphasis is on keeping records of changes to facilitate audit and review of the risk management process for a particular medical device. DOCUMENTATION REQUIREMENTS: - Comprehensive review report - Finding documentation - Action item list - Completion evidence for all actions - Final approval records

The review must confirm that every element of the risk management plan was executed as intended with appropriate resources and documentation. Per ISO/TR 24971, the review should verify that the risk management process has been applied to each identified hazard. VERIFICATION ELEMENTS: - Plan vs actual comparison - Activity completion checklist - Personnel competency verification - Document completeness assessment - Deviation documentation and justification

Both individual and overall residual risks must be verified as acceptable according to predetermined criteria from the risk management plan. VERIFICATION REQUIRED: - All individual risks evaluated against criteria - Overall risk assessment performed - Criteria properly applied - Benefit-risk analysis completed (if needed) - Risk communication decisions documented

The system for ongoing risk monitoring during production and post-market phases must be established and verified as adequate. Per ISO/TR 24971, methods for collection and review of production and post-production information need to be established so there is a formal way to feed back production and post-production information into the risk management process. SYSTEM VERIFICATION: - Post-production surveillance procedures exist - Data collection mechanisms defined - Review frequency documented - Feedback loops established - System adequacy tested

Risk management continues throughout the entire product lifecycle with systematic collection and review of real-world data to identify new hazards or changes in risk levels. ISO/TR 24971:2020 ANNEX A.2.10 GUIDANCE: Production and post-production information is essential to verify risk management effectiveness and identify new risks. SYSTEM ELEMENTS: - Information collection mechanisms - Review procedures and frequency - Action triggers and escalation - Documentation requirements - Feedback to risk management - Regulatory reporting links INTEGRATION POINTS WITH QMS: - Complaint handling (ISO 13485:2016, 8.2.2) - Feedback (ISO 13485:2016, 8.2.1) - CAPA system - Management review - Post-market surveillance

Production data must be monitored for risk-relevant information including quality trends and process variations. PRODUCTION INDICATORS (ISO/TR 24971 Guidance): - Yield rates and trends - Defect patterns - Process drift - Component failures - Calibration issues - Environmental excursions MONITORING SCOPE: - Manufacturing deviation reports - Quality trend analyses - Non-conformity data - Process capability studies - Supplier performance data - Equipment maintenance records

Post-market data provides real-world evidence of device performance and safety that must be systematically collected and analyzed. POST-MARKET SOURCES (ISO/TR 24971 Guidance): - Direct customer feedback - Distributor reports - Service organization data - Clinical registries - Scientific publications - Regulatory authority databases - Social media monitoring DATA TYPES: - Field failure reports - Customer complaints - Service/maintenance data - Clinical follow-up studies - Literature surveillance - Regulatory database monitoring (FDA MAUDE, EU EUDAMED)

Production and post-production activities are an integral part of the risk management process. The manufacturer must have a systematic and documented approach to gathering and acting on real-world device performance information throughout the entire product lifecycle.

The system must have defined triggers and processes for taking action when information indicates potential safety issues or risk changes. ACTION SYSTEM REQUIREMENTS: - Action trigger criteria defined - Escalation procedures documented - Decision trees for actions - Action tracking system - Management notification process - Timelines for action initiation

All post-production information, evaluations, decisions, and actions must be documented and maintained as part of the risk management file. DOCUMENTATION REQUIREMENTS: - Post-production surveillance reports - Information evaluation records - Decision documentation with rationale - Action plans and completion records - Risk management file updates - Trending analysis reports - Retention periods aligned with regulatory requirements

Collected information must be systematically evaluated to determine if it impacts the device's risk profile or the validity of previous risk management decisions. EVALUATION CRITERIA: a) New hazards: Previously unrecognized hazards or hazardous situations b) Risk acceptability: Changes that make previously acceptable risks unacceptable c) Benefit-risk validity: Changes affecting benefit-risk balance d) State of the art: Evolution of standards, technology, or best practices SYSTEMATIC EVALUATION REQUIRED: - Information evaluation criteria defined - New hazard identification process - Risk re-estimation triggers - Benefit-risk reassessment process - State of the art monitoring

A formal system must be in place to systematically collect and review information about the device once it enters production and throughout its market life. SYSTEM REQUIREMENTS: - Comprehensive surveillance system covering both production and post-market phases - Clear data collection requirements - Defined review frequencies - Assigned responsibilities - Integration with quality system and regulatory reporting REGULATORY REFERENCES: - FDA: 21 CFR 820.100 - Corrective and preventive action - EU MDR: Article 83-86 - Post-market surveillance - ISO 13485: Clause 8.2.1 - Feedback

Information collection must be systematic, planned, and comprehensive — covering both production-phase data and post-market performance information. Collection must be proactive (not limited to reactive complaint handling) and must feed into the risk management review process.

All collection activities must be documented with clear records of what was collected, when, and from which sources. DOCUMENTATION REQUIREMENTS: - Collection procedures - Source documentation - Collection logs - Database records - Search strategies (for literature) - Surveillance reports - Retention periods defined - Data integrity controls

Collection frequency should be risk-based with higher-risk devices requiring more frequent data collection. ISO/TR 24971 GUIDANCE - FREQUENCY FACTORS: - Device risk classification - Market maturity - Historical issue rate - Regulatory requirements - Technology novelty TYPICAL FREQUENCIES: - High risk devices: Continuous or weekly - Moderate risk devices: Monthly - Low risk devices: Quarterly - Literature surveillance: Quarterly minimum IMPLEMENTATION: - Define risk-based collection frequencies - Consider device classification - More frequent for new devices - Document rationale for chosen frequencies

Information collection must be proactive and comprehensive, not limited to complaint handling or adverse event reporting. ISO/TR 24971 GUIDANCE - COLLECTION METHODS: ACTIVE METHODS: - Targeted surveys - Clinical follow-up studies - Proactive customer contacts - Field observations - Focus groups PASSIVE METHODS: - Complaint systems - Service reports - Warranty claims - Sales feedback - Social media monitoring SYSTEMATIC METHODS: - Literature searches - Database queries - Registry participation - Benchmarking studies IMPLEMENTATION REQUIREMENTS: - Develop comprehensive collection plan - Include both active and passive sources - Standardize collection methods - Consider automation where appropriate

Multiple diverse information sources must be monitored to ensure comprehensive risk information gathering. ISO/TR 24971 GUIDANCE - SOURCE DETAILS: a) MANUFACTURING: Deviations, yields, quality trends b) SUPPLY CHAIN: Component issues, changes, shortages c) INSTALLED BASE: Performance data, utilization patterns d) USERS: Complaints, satisfaction, off-label use e) SERVICE: Failure modes, maintenance issues f) PUBLIC: Literature, databases, competitors g) REGULATORY: Safety communications, recalls IMPLEMENTATION: - Map all potential sources - Establish collection mechanism for each - Include global sources - Ensure regular updates

Learning from similar devices helps identify potential risks that may not yet have manifested in your device. ISO/TR 24971 GUIDANCE - SIMILARITY CRITERIA: - Same intended use - Similar technology - Same patient population - Similar risk profile - Common components - Equivalent principles of operation SURVEILLANCE SOURCES: - FDA MAUDE database - EU EUDAMED - Recall databases - Scientific literature - Conference proceedings - Industry alerts IMPLEMENTATION: - Define 'similar device' criteria broadly - Monitor multiple sources - Include predicate and competitor devices - Track recalls systematically

Collected production and post-production information must be systematically reviewed to determine if it has safety implications — including whether new hazards exist, whether previously estimated risks are still acceptable, and whether the benefit-risk balance remains valid.

Reviews must involve qualified individuals who can properly assess technical, clinical, and regulatory implications of the data. ISO/TR 24971 GUIDANCE - REVIEW TEAM EXPERTISE: - Risk management expertise - Clinical/medical knowledge - Engineering/technical understanding - Regulatory affairs knowledge - Quality assurance - Statistical analysis skills COMPETENCY AREAS: - Device technology understanding - Clinical application knowledge - Risk assessment methods - Data analysis skills - Regulatory requirements IMPLEMENTATION: - Form multidisciplinary review team - Include clinical, technical, and regulatory expertise - Document competencies - Consider external experts when needed

All review activities, findings, decisions, and rationales must be formally documented and maintained. ISO/TR 24971 GUIDANCE - DOCUMENTATION ELEMENTS: - Review date and participants - Information reviewed - Analysis methods used - Findings and observations - Decisions and rationale - Actions assigned - Approval signatures IMPLEMENTATION: - Create comprehensive review reports - Document all decisions with rationale - Include supporting data - Obtain appropriate approvals

Review intervals must be risk-based and appropriate to the device type, with clear justification for the chosen frequency. ISO/TR 24971 GUIDANCE - FREQUENCY DETERMINATION: - Device risk classification - Market history - Technology maturity - Volume of data collected - Regulatory requirements TYPICAL INTERVALS: - High risk, new devices: Monthly or quarterly - High risk, established: Quarterly or semi-annually - Moderate risk: Semi-annually - Low risk: Annually IMMEDIATE REVIEW TRIGGERS: - Serious adverse events - Multiple similar complaints - Regulatory alerts - Significant literature findings - Major recall of similar device IMPLEMENTATION: - Set risk-based review frequency - Define trigger events for immediate review - Document rationale - Maintain review schedule

Each review must reach clear conclusions about safety implications and necessary actions, including risk management documentation updates. ISO/TR 24971 GUIDANCE - POTENTIAL OUTCOMES: - No action required - risk profile unchanged - Update risk management file - Implement new risk controls - Modify existing controls - Initiate field action - Update labeling/IFU - Enhance surveillance IMPLEMENTATION: - Document clear conclusions - Make explicit action decisions - Update risk file as needed - Justify no-action decisions

Collected information must be systematically analyzed to identify changes in the device's risk profile or new safety concerns. ISO/TR 24971 GUIDANCE - REVIEW OBJECTIVES: - Identify new hazards - Detect risk level changes - Assess cumulative effects - Evaluate risk control effectiveness - Monitor state of art evolution REVIEW INDICATORS: NEW HAZARDS: - Unexpected failure modes - Novel use errors - Emerging misuse patterns - New clinical findings RISK CHANGES: - Increased occurrence rates - Higher severity outcomes - Broader affected populations - Cumulative effects observed STATE OF ART: - New standards published - Advanced technologies available - Updated clinical guidelines - Regulatory expectations evolution IMPLEMENTATION: - Establish structured review process - Define clear review criteria - Include multidisciplinary expertise - Document all findings and decisions

Statistical and trend analyses must be performed to detect subtle changes or patterns in the data over time. ISO/TR 24971 GUIDANCE - TRENDING METHODS: - Run charts - Control charts - Pareto analysis - Time series analysis - Regression analysis - Pattern recognition algorithms TREND INDICATORS: - Increasing complaint rates - Shifting failure modes - Geographic clusters - Temporal patterns - User group variations IMPLEMENTATION: - Implement statistical trending methods - Establish baselines for comparison - Use appropriate analytical tools - Look for subtle patterns

When production or post-production information indicates a safety impact — such as a new hazard, changed risk level, or invalid benefit-risk assessment — the manufacturer must take timely and proportionate action, which may include risk management file updates, corrective actions, or field safety corrective actions.

Actions must be risk-proportionate and may range from gathering more data to implementing new controls or conducting comprehensive risk re-assessment. ISO/TR 24971 GUIDANCE - ACTION HIERARCHY: 1. Immediate safety actions if needed 2. Additional information gathering 3. Detailed risk analysis 4. Risk control implementation 5. Overall risk re-evaluation PROPORTIONALITY FACTORS: - Severity of potential harm - Probability of occurrence - Number of devices affected - Vulnerable populations involved - Availability of alternatives ACTION EXAMPLES BY RISK LEVEL: - Minor risk increase: Enhanced monitoring, documentation update - Moderate risk: Label updates, user notification, training - Significant risk: Design modification, recall, cessation IMPLEMENTATION: - Develop risk-based action criteria - Create action plans with timelines - Implement through established processes - Verify effectiveness

Sometimes initial review reveals information gaps that must be filled before appropriate actions can be determined. ISO/TR 24971 GUIDANCE - INFORMATION SOURCES: - Focused clinical studies - Enhanced field surveillance - Root cause investigations - Expert panels - Usability assessments - Comparative effectiveness research IMPLEMENTATION: - Identify information gaps systematically - Plan targeted data collection - Set timelines for obtaining information - Document interim risk mitigation if needed

Complete documentation trail must exist for all post-production actions from decision through effectiveness verification. ISO/TR 24971 GUIDANCE - DOCUMENTATION REQUIREMENTS: - Action trigger and rationale - Risk assessment basis - Implementation plan and timeline - Resources allocated - Effectiveness criteria and results - Closure approval IMPLEMENTATION: - Document all action decisions and rationales - Track implementation progress - Record effectiveness verification - Maintain complete audit trail

All actions must be verified for effectiveness, including checking for unintended consequences or new risks. ISO/TR 24971 GUIDANCE - VERIFICATION METHODS: - Complaint rate monitoring - Field performance data - Clinical outcome tracking - User feedback surveys - Audit observations SUCCESS INDICATORS: - Reduced incident rates - Improved performance metrics - User satisfaction increase - No new safety signals - Regulatory acceptance IMPLEMENTATION: - Define success criteria upfront - Plan verification methods - Monitor for sufficient duration - Check for new risks introduced

Field actions must follow regulatory requirements and internal procedures, with appropriate urgency based on risk level. ISO/TR 24971 GUIDANCE - FIELD ACTION TYPES: - Product recall - Field correction - Product modification - Safety advisory - Software update - Enhanced monitoring REGULATORY CONSIDERATIONS: - Notification timelines (FDA, EU, etc.) - Content requirements - Distribution verification - Effectiveness checks - Periodic status reports IMPLEMENTATION: - Follow established field action procedures - Meet all regulatory timelines - Ensure comprehensive customer notification - Verify effectiveness

Management must be informed of significant post-production actions to ensure appropriate resources and strategic alignment. ISO/TR 24971 GUIDANCE - MANAGEMENT CONSIDERATIONS: - Resource requirements - Business impact - Regulatory implications - Reputation considerations - Strategic alignment IMPLEMENTATION: - Include in management review process - Provide clear executive summaries - Request necessary resources - Obtain strategic approval for significant actions

The risk management file must remain current, reflecting all changes resulting from post-production findings and actions. ISO/TR 24971 GUIDANCE - UPDATE REQUIREMENTS: - New hazards added - Risk levels revised - Control measures modified - Residual risks updated - Overall risk re-assessed - Benefit-risk analyses revised IMPLEMENTATION: - Update risk file promptly - Use revision control - Maintain change history - Ensure traceability to triggering information