Risk Management Specialist

Risk Management Specialist

ISO 14971:2019 risk management implementation throughout the medical device lifecycle.

Table of Contents

• Risk Management Planning Workflow
• Risk Analysis Workflow
• Risk Evaluation Workflow
• Risk Control Workflow
• Post-Production Risk Management
• Risk Assessment Templates
• Decision Frameworks
• Tools and References

Risk Management Planning Workflow

Establish risk management process per ISO 14971.

Workflow: Create Risk Management Plan

1. Define scope of risk management activities:
   • Medical device identification
   • Lifecycle stages covered
   • Applicable standards and regulations
2. Establish risk acceptability criteria:
   • Define probability categories (P1-P5)
   • Define severity categories (S1-S5)
   • Create risk matrix with acceptance thresholds
3. Assign responsibilities:
   • Risk management lead
   • Subject matter experts
   • Approval authorities
4. Define verification activities:
   • Methods for control verification
   • Acceptance criteria
5. Plan production and post-production activities:
   • Information sources
   • Review triggers
   • Update procedures
6. Obtain plan approval
7. Establish risk management file
8. Validation: Plan approved; acceptability criteria defined; responsibilities assigned; file established

Risk Management Plan Content

Risk Acceptability Matrix (5x5)

Risk Level Actions

EU MDR — AFAP, not ALARP: For CE-marked devices, risks must be reduced as far as possible (AFAP) without economic considerations (MDR Annex I, GSPR 1–4; EN ISO 14971:2019/A11:2021 Z-annexes deviation). ALARP ("as low as reasonably practicable"), which permits cost-benefit weighing in acceptability decisions, is not an acceptable criterion under the EU MDR — a notified body will flag it. ISO 14971:2019 itself removed ALARP from the normative text. ALARP may persist in some non-EU jurisdictions (e.g., the UK HSE tradition); if used outside the EU, flag the deviation from EU requirements explicitly.

Risk Analysis Workflow

Identify hazards and estimate risks systematically.

Workflow: Conduct Risk Analysis

1. Define intended use and reasonably foreseeable misuse:
   • Medical indication
   • Patient population
   • User population
   • Use environment
2. Select analysis method(s):
   • FMEA for component/function analysis
   • FTA for system-level analysis
   • HAZOP for process deviations
   • Use Error Analysis for user interaction
3. Identify hazards by category:
   • Energy hazards (electrical, mechanical, thermal)
   • Biological hazards (bioburden, biocompatibility)
   • Chemical hazards (residues, leachables)
   • Operational hazards (software, use errors)
4. Determine hazardous situations:
   • Sequence of events
   • Foreseeable misuse scenarios
   • Single fault conditions
5. Estimate probability of harm (P1-P5)
6. Estimate severity of harm (S1-S5)
7. Document in hazard analysis worksheet
8. Validation: All hazard categories addressed; all hazards documented; probability and severity assigned

Hazard Categories Checklist

Analysis Method Selection

Probability Criteria

Severity Criteria

See: references/risk-analysis-methods.md

Risk Evaluation Workflow

Evaluate risks against acceptability criteria.

Workflow: Evaluate Identified Risks

1. Calculate initial risk level from probability × severity
2. Compare to risk acceptability criteria
3. For each risk, determine:
   • Acceptable: Document and accept (EU MDR: still reduce as far as possible)
   • Reduction required (AFAP): Proceed to risk control
   • Unacceptable: Mandatory risk control
4. Document evaluation rationale
5. Identify risks requiring benefit-risk analysis
6. Complete benefit-risk analysis if applicable
7. Compile risk evaluation summary
8. Validation: All risks evaluated; acceptability determined; rationale documented

Risk Evaluation Decision Tree

Risk Estimated
      │
      ▼
Apply Acceptability Criteria
      │
      ├── Low Risk ──────────► Accept and document
      │
      ├── Medium Risk ───────► Reduce as far as possible (AFAP)
      │   │                    Document why further reduction impossible
      │   ▼
      │   Further reduction possible?
      │   │
      │   Yes──► Implement control
      │   No───► Document AFAP rationale (no economic considerations)
      │
      ├── High Risk ─────────► Risk reduction required
      │   │                    Must demonstrate reduction AFAP
      │   ▼
      │   Implement control
      │   Verify residual risk
      │
      └── Unacceptable ──────► Design change mandatory
                               Cannot proceed without control

AFAP Demonstration Requirements (EU MDR)

Economic considerations (cost of further risk reduction) must not enter the EU acceptability decision (MDR Annex I GSPR 2; EN ISO 14971:2019/A11:2021). Cost may inform business decisions about whether to market the device — never whether a risk is acceptable.

Benefit-Risk Analysis Triggers

Risk Control Workflow

Implement and verify risk control measures.