Risk management is an important aspect in the development of medical devices. Performing risk management is a regulatory requirement in all major markets for medical devices. The international standard ISO 14971 was developed to provide a process to assist manufacturers in identifying the hazards associated with medical devices, assessing the corresponding risks, controlling these risks where needed, and monitoring the effectiveness of the risk control measures.
What is a Risk Management File (RMF)?
Collection of records and other documents that are produced by risk management.
The Risk Management File is a living document that is maintained and updated throughout the medical device lifecycle, from design and development through production, post-market surveillance, and eventual product retirement.
Why Medical Device Manufacturers Need an RMF
The requirement of RMF mentioned in the standard is that the manufacturer establish and maintain a risk management file. It compiles all the documents created during the risk management process containing all the documents or a list referencing the results of risk analysis, evaluation and control, and the risk management report. A Risk Management File is essential because it provides documented evidence to ensure patient, and user safety.
Overview of ISO 14971 for Medical Devices
What is ISO 14971?
ISO 14971 is an international standard that establishes requirements for a process for managing risks associated with medical devices. The latest version is ISO 14971:2019. The requirements are applicable to all phases of the life cycle of a medical device.
Key Objectives of ISO 14971
The primary objectives of ISO 14971 are to:
- To establish a risk management process as part of the design and development of a medical device.
- Identification of anticipated hazards and hazardous situations in both normal and fault conditions.
- Estimate and evaluate risks using the criteria for risk acceptability
- Implement appropriate risk control measures to reduce risks as far as possible while maintaining the intended medical benefits.
- Evaluate residual risks after implementation of risk controls.
- Determine whether the overall residual risk is acceptable when weighed against the device’s intended benefits.
- Monitor and review risks using production and post-production information.
Scope of ISO 14971
ISO 14971 applies to all medical devices, including:
- Active medical devices
- Non-active medical devices
- Implantable medical devices
- Software as a Medical Device (SaMD)
- In vitro diagnostic (IVD) medical devices (when adopted by applicable regulations)
Risk Management Throughout the Device Lifecycle
The standard applies to Design and Development, Manufacturing, Packaging and labelling, Transportation and Storage, Installation, Clinical Use, Servicing and Maintenance, Decommissioning and disposal.
Regulatory Requirements for Risk Management Files
Risk Management Requirements Under EU MDR
Risk Management requirements are defined in the Annex I General requirements sections 3 and 4
Risk management is a continuous process that starts during device design and continues throughout the entire lifecycle of the device. For each device, manufacturers must prepare a risk management plan.
Manufacturers must control risks by following a hierarchy of safety measures.
- Eliminate or reduce risks through safe design and manufacturing.
- Implement appropriate protective measures, such as safety features or alarms. If risks cannot be completely eliminated,
- Provide warnings, precautions, contraindications, and user training, where appropriate.If residual risks still remain, manufacturers
In addition, manufacturers must continuously evaluate information collected from production and post-market surveillance activities, such as complaints and adverse events, to determine whether new hazards have emerged or existing risks have changed and update the risk management file and risk control measures whenever necessary.
Risk Management Expectations for FDA Submissions
ISO 14971 is an FDA-recognized consensus standard for medical device submissions and will be formally required by the Quality Management System Final Rule for ISO 13485.
ISO 13485 Requirements Related to Risk Management
The main clause that introduces risk-based approach in ISO 13485 is Clause 4.1.2(b) and Clause 7.1.
Clause 4.1.2(b)-The organization shall apply a risk based approach to the control of the appropriate processes needed for the quality management system.
Clause 7.1 – Planning of Product Realization-The organization shall document one or more processes for risk management in product realization. Records of risk management activities shall be maintained
These are the primary ISO 13485 clauses related to risk management. Clause 4.1.2(b) establishes the risk-based approach for the Quality Management System (QMS), while Clause 7.1 requires documented risk management processes for product realization, typically implemented in accordance with ISO 14971.
Structure of a Risk Management File
Risk Management Plan
Risk management activities shall be planned. For the particular medical device being considered, the manufacturer shall establish and document a risk management plan in accordance with the risk management process. The risk management plan shall be part of the risk management file.
This plan shall include at least the following:
a) The scope of the planned risk management activities, identifying and describing the medical device and the life cycle phases for which each element of the plan is applicable.
b) Assignment of responsibilities and authorities.
c) Requirements for review of risk management activities.
d) Criteria for risk acceptability, based on the manufacturer’s policy for determining acceptable risk, including criteria for accepting risks when the probability of occurrence of harm cannot be estimated.
Note: For each risk management plan, the manufacturer needs to establish risk acceptability criteria that are appropriate for the medical device.
e) A method to evaluate the overall residual risk, and criteria for acceptability of the overall residual risk based on the manufacturer’s policy for determining acceptable risk.
Note: The method to evaluate the overall residual risk can include gathering and reviewing data and literature for the medical device being considered and similar medical devices on the market and can involve judgment by a cross-functional team of experts with application knowledge and clinical expertise.
f) Activities for verification of the implementation and effectiveness of risk control measures.
g) Activities related to collection and review of relevant production and post-production information.
Risk Analysis Documentation
The manufacturer shall perform risk analysis for the particular medical device as described below. If a risk analysis or other relevant information is available for a similar medical device, that analysis or information can be used as a starting point for the new risk analysis.
Intended use and reasonably foreseeable misuse
The manufacturer shall document the intended use of the particular medical device being considered. The intended use should take into account information such as the intended medical indication, patient population, part of the body or type of tissue interacted with, user profile, use environment, and operating principle.
Identification of characteristics related to safety
The manufacturer shall identify and document those qualitative and quantitative characteristics that could affect the safety of the medical device. Where appropriate, the manufacturer shall define limits of those characteristics.
Identification of hazards and hazardous situations
The manufacturer shall identify and document known and foreseeable hazards associated with the medical device based on the intended use, reasonably foreseeable misuse and the characteristics related to safety in both normal and fault conditions.
For each identified hazard, the manufacturer shall consider the reasonably foreseeable sequences or combinations of events that can result in a hazardous situation, and shall identify and document the resulting hazardous situations.
Risk Evaluation Records
For each identified hazardous situation, the manufacturer shall evaluate the estimated risks and determine if the risk is acceptable or not, using the criteria for risk acceptability defined in the risk management plan.
If the risk is acceptable, it is not required to apply the requirements of risk control to this hazardous situation and the estimated risk shall be treated as residual risk.
If the risk is not acceptable, then the manufacturer shall perform risk control activities
The results of this risk evaluation shall be recorded in the risk management file.
Risk Control Documentation
The manufacturer shall determine risk control measures that are appropriate for reducing the risks to an acceptable level.
The manufacturer shall use one or more of the following risk control options in the priority order listed:
a) Inherently safe design and manufacture.
b) Protective measures in the medical device itself or in the manufacturing process.
c) Information for safety and, where appropriate, training to users.
Implementation of each risk control measure shall be verified. This verification shall be recorded in the risk management file.
Residual Risk Evaluation
After the risk control measures are implemented, the manufacturer shall evaluate the residual risk using the criteria for risk acceptability defined in the risk management plan. The results of this evaluation shall be recorded in the risk management file.
If a residual risk is not judged acceptable using these criteria, further risk control measures shall be considered.
Benefit-Risk Analysis
If a residual risk is not judged acceptable using the criteria established in the risk management plan and further risk control is not practicable, the manufacturer may gather and review data and literature to determine if the benefits of the intended use outweigh the residual risk.
If this evidence does not support the conclusion that the benefits outweigh this residual risk, then the manufacturer may consider modifying the medical device or its intended use. Otherwise, this risk remains unacceptable.
Risk Management Report
Prior to release for commercial distribution of the medical device, the manufacturer shall review the execution of the risk management plan. This review shall at least ensure that:
- The risk management plan has been appropriately implemented;
- The overall residual risk is acceptable; and
- Appropriate methods are in place to collect and review information in the production and post-production phases.
The results of this review shall be recorded and maintained as the risk management report and shall be included in the risk management file.
Post-Market Risk Management Records
The manufacturer shall establish, document and maintain a system to actively collect and review information relevant to the medical device in the production and post-production phases. When establishing this system, the manufacturer shall consider appropriate methods for the collection and processing of information.
Risk Management Process Under ISO 14971 (Step by step)
Post-Market Risk Management Activities
Manufacturers must establish, document, and maintain a system to actively collect information relevant to the medical device during production and after it is on the market (post-production phase).
Information is gathered from multiple sources, including:
- Production process monitoring
- User feedback and complaints
- Data from those responsible for installation, use, and maintenance
- Supply chain partners
- Publicly available information
All collected information must be systematically reviewed for its relevance to safety.
The outcomes of post-production review and actions are used to improve both the device and the risk management process itself.
This iterative process ensures continuous improvement and adaptation to new risks or regulatory expectations.
Key Steps in Post-Production and Market Surveillance
| Step | Description | Example |
| Information Collection | Gather data from production, users, supply chain, public sources |
Collecting user complaints and service records
|
| Information Review | Assess data for new hazards or unacceptable risks |
Identifying a trend in device malfunctions
|
| Actions | Update risk management, implement controls, notify users |
Issuing a recall or software update
|
| Feedback | Improve device and risk management process |
Revising risk analysis methods
|
Risk Management Documentation Required in an RMF
The documentation required in a Risk Management File (RMF) according to ISO 14971 is
| Document |
Description / Content
|
| Risk Management Plan |
Scope, responsibilities, risk acceptability criteria, methods for overall residual risk evaluation, verification, post-production activities, and record of changes.
|
| Risk Analysis Documentation |
Device description, intended use, foreseeable misuse, safety characteristics, hazards, hazardous situations, risk estimation, persons/organizations involved, scope and date.
|
| Risk Evaluation Records |
Evaluation of each risk against acceptability criteria and decisions made.
|
| Risk Control Documentation |
Risk control option analysis, implementation and verification of controls, effectiveness, new/increased risks, completeness check.
|
| Residual Risk Evaluation & Benefit-Risk Analysis |
Evaluation of residual risks after controls, benefit-risk analysis if residual risks are not acceptable.
|
| Evaluation of Overall Residual Risk |
Assessment of combined residual risks versus device benefits, using defined method and criteria.
|
| Risk Management Review (Risk Management Report) |
Documented review before commercial release, confirming plan execution, overall residual risk acceptability, and post-market surveillance.
|
| Production and Post-Production Information |
Data collection during production and post-market, review for safety relevance, actions taken, updates to RMF.
|
| Traceability |
Traceability from each identified hazard to risk analysis, evaluation, risk controls, and residual risk evaluation.
|
How To Maintain an ISO 14971-Compliant RMF
- Establish and Update a Risk Management Plan
- Perform and Document Risk Analysis
- Implement and Verify Risk Control Measures
- Evaluate and Document Residual Risks
- Conduct Risk Management Review Before Release
- Collect, Review, and Act on Production and Post-Production Data
How Artixio Supports Medical Device Risk Management Compliance
Artixio provides regulatory consulting services to help medical device manufacturers maintain risk management compliance with ISO 14971 and applicable global regulations. Our experts review risk management documentation, conduct compliance gap assessments, assess the impact of design and regulatory changes, and ensure alignment between the Risk Management File, and Post-Market Surveillance activities. Contact us at info@artixio.com. To discuss how we can support your regulatory compliance needs.
Conclusion
ISO 14971 provides framework for the systematic application of risk management to medical devices throughout their entire life cycle. The standard requires manufacturers to identify hazards, estimate and evaluate associated risks, implement and verify risk control measures, and continuously monitor the effectiveness of these controls through production and post-production activities. By emphasizing the balance between residual risks and anticipated benefits, and requiring ongoing review and adaptation based on real-world data, ISO 14971 ensures that medical device safety is proactively managed and continuously improved, ultimately supporting patient, user, and public health protection.
