Risk Management · ISO 14971 · MDR/IVDR · PRRC
What Is Risk Management in Medical Device Development?
Effective risk management protects patients and your business. This audit-ready guide explains what risk management is, why it matters, how it’s required under MDR/IVDR and FDA expectations, and exactly how to implement it per ISO 14971— with PRRC oversight, practical checklists, and copy-paste templates.
ISO 14971 Process MDR Annex I §3 Risk Controls (1→2→3) Traceability SaMD & Hardware PRRC Gate
Definition — And Why It Matters
Risk management is a systematic process for identifying hazards, estimating and evaluating risks, implementing risk controls, and monitoring effectiveness throughout the device lifecycle. Done right, it keeps devices safe, effective, and reliable—and keeps your submissions defensible.
- Patient safety: Reduces likelihood and severity of harm.
- Regulatory compliance: Required by MDR/IVDR and expected by FDA; embedded in ISO 13485.
- Business resilience: Fewer recalls, smoother audits, clearer design decisions.
Key principle: Benefits must outweigh residual risks, and residual risks must be known,
controlled as far as possible, and communicated in labeling.
Regulatory Expectations at a Glance
- EU MDR/IVDR: Manufacturers must apply a comprehensive, lifecycle risk management process and demonstrate conformity with General Safety & Performance Requirements (MDR Annex I §3; IVDR Annex I §3). QMS obligations are set out in Article 10; information on residual risk appears in Annex I §23.
- US FDA: Risk management is integral to design controls and premarket submissions; maintain traceable risk analyses and verification/validation under quality system requirements (21 CFR Part 820).
- ISO 14971:2019: Global standard detailing the risk management process; complementary to ISO 13485.
ISO 14971 Process — Step by Step
- Plan: Create a Risk Management Plan (scope, responsibilities, criteria for risk acceptability, methods, PMS inputs).
- Identify hazards: Energy, biological/chemical, software/algorithmic, cybersecurity, usability, data integrity, environment.
- Define sequences → hazardous situations: Foreseeable events leading to exposure.
- Define harms & rate severity: Clinical outcomes aligned with medical significance.
- Estimate probability of harm: Evidence-based likelihood considering protection layers and detectability.
- Evaluate risk: Compare to predefined acceptability criteria.
- Control risk (hierarchy 1→2→3): (1) Inherent safety by design; (2) Protective measures; (3) Information for safety.
- Assess residual risk & benefit–risk: Justify, disclose, or further control.
- Verify effectiveness: Objective tests show controls work; re-estimate risk.
- Report & maintain: Risk Management Report; keep the file current with PMS/complaints/field data.
PRRC Oversight — Making It Stick
- PRRC approves the Risk Management Plan and acceptability criteria before analysis.
- PRRC verifies traceability from hazard → control → verification → IFU warnings.
- PRRC can block release if controls or effectiveness checks are incomplete.
Evidence & Records You Need
| Record | Purpose | Owner | Audit-Ready Proof |
|---|---|---|---|
| Risk Management Plan | Defines scope, criteria, methods, roles, PMS inputs | RA/QA | Approved plan with version control |
| Risk Analysis | Hazards, sequences, hazardous situations, harms, estimates | RA/Engineering | Approved tables with rationale for ratings |
| Risk Evaluation | Acceptability decisions against criteria | RA/Clinical | Signed evaluation entries |
| Risk Control Log | Selected controls, hierarchy, implementation status | Engineering/QA | Design specs, test protocols/reports |
| Verification of Effectiveness | Objective evidence controls work | QA/Test | Pass/fail with acceptance criteria met |
| Residual Risk Evaluation | Benefit–risk, disclosures, user information | RA/PRRC | Documented justification; IFU alignment |
| Risk Management Report | Lifecycle summary and release recommendation | QA/PRRC | Signed RMR linked to release |
Practical Examples
SaMD — Diagnostic Decision Support
- Hazard: Algorithmic misclassification; stale input data.
- Sequence: Data mapping error → incorrect risk score → clinician action.
- Harm: Delayed or inappropriate therapy.
- Controls: Input validation, model V&V with clinical datasets, confidence indicators, human-in-the-loop gating, usability testing, cybersecurity controls.
- Effectiveness: Sensitivity/specificity targets met; usability success rate ≥ X%; pen-test issues closed.
Electro-Mechanical Device
- Hazard: Electrical energy; pinch points.
- Sequence: Insulation defect → user contact; hand in motion path.
- Harm: Shock; crush injury.
- Controls: Double insulation, interlocks/guards, leakage current limits, warning labels.
- Effectiveness: Type testing passed; guard verification; labeling matches residual risks.
Copy/Paste Templates
Risk Acceptability Criteria (extract):
• S1 Minor — no clinical intervention; S2 Moderate — requires non-invasive intervention; S3 Serious — invasive intervention; S4 Critical — life-threatening/irreversible; S5 Catastrophic — death.
• P1 Rare … P5 Frequent — define using observed rates or justified estimates.
Decision rule: Risks in red cells require additional controls unless not technically possible; amber require justification and disclosure; green acceptable with monitoring.
• S1 Minor — no clinical intervention; S2 Moderate — requires non-invasive intervention; S3 Serious — invasive intervention; S4 Critical — life-threatening/irreversible; S5 Catastrophic — death.
• P1 Rare … P5 Frequent — define using observed rates or justified estimates.
Decision rule: Risks in red cells require additional controls unless not technically possible; amber require justification and disclosure; green acceptable with monitoring.
Release Gate (PRRC):
“I confirm that risk controls for version [X.Y.Z] are implemented and verified, residual risks are acceptable per criteria, and labeling reflects residual risks.” — Name, Title, Date.
“I confirm that risk controls for version [X.Y.Z] are implemented and verified, residual risks are acceptable per criteria, and labeling reflects residual risks.” — Name, Title, Date.
Post-Market Surveillance Interface
- Feed complaints, adverse events, service data, and literature into risk files.
- Trend harms and near-misses; adjust probability estimates and controls.
- Trigger CAPA and design changes when signals exceed thresholds.
Common Pitfalls (and How to Avoid Them)
- Unclear definitions: Mixing hazard, hazardous situation, and harm—train teams and standardize terms.
- No acceptability criteria upfront: Decide criteria before scoring to avoid bias.
- Controls without verification: Always add objective tests for effectiveness.
- Weak traceability: Ensure every hazard maps to controls, tests, and labeling.
- Static files: Risk documents must update with field data and software versions.
Audit-Ready Checklist
- Approved Risk Management Plan and criteria in place.
- Complete hazard inventory (hardware, software, usability, cybersecurity).
- End-to-end traceability matrix maintained and reviewed.
- Objective evidence for control effectiveness attached.
- Residual risks justified and reflected in IFU/warnings.
- PRRC release sign-off recorded; PMS feedback loop active.
Bottom Line
Risk management connects design reality to clinical safety. Use ISO 14971 rigor, enforce PRRC gates, and keep files living with PMS inputs. That’s how you build safer devices, pass audits, and protect patients.
Legal References — Risk Management
ISO 14971 ISO 13485 MDR 2017/745 IVDR 2017/746 21 CFR Part 820
ISO 14971:2019 — Application of Risk Management to Medical Devices
- Clause 3 Definitions (hazard, harm, hazardous situation, risk, sequence of events).
- Clauses 4–9 Process: plan, analysis, evaluation, control, report, production/post-production information.
ISO 13485:2016 — Quality Management Systems
- 7.1 Risk management in product realization.
- 7.3 Design and development (risk-based controls, verification/validation).
EU MDR 2017/745
- Article 10(2) & 10(9) Manufacturer obligations and QMS (risk management across lifecycle).
- Annex I §3 Risk management requirements; reduce risks as far as possible.
- Annex I §23 Information supplied by the manufacturer (warnings for residual risks).
- Annex II/III Technical documentation, including risk management evidence and PMS inputs.
EU IVDR 2017/746
- Article 10 Manufacturer obligations and QMS.
- Annex I §3 Risk management for IVDs; Annex II/III technical documentation and PMS.
United States — FDA (Title 21 CFR)
- Part 820 Quality System requirements (design controls, verification/validation, risk documentation).
- Part 803 Medical Device Reporting (post-market vigilance interface to risk files).
- Part 806 Corrections and removals (risk-based field actions).
This list is provided without hyperlinks for audit-friendly documentation and does not constitute legal advice.
