Medical Device Risk Management
Medical device risk management is the systematic process of identifying hazards, estimating and evaluating risks, controlling them and monitoring the results across the whole life of a device. I3CGLOBAL is a regulatory consulting company that helps manufacturers build, review and maintain the risk management file and benefit-risk evidence needed for EU MDR, IVDR and FDA submissions.
The basics
What Is Medical Device Risk Management?
Medical device risk management covers every activity used to find and reduce the risks a device may pose to patients, users and others, from design to end of life. ISO 14971:2019 is the international standard for this work, and all activities and results are recorded in the risk management file (RMF).
It also decides whether a device can reach the market. When risks remain after every practicable control, a risk benefit analysis must show that the medical benefits outweigh them. Every legal manufacturer placing a device on the EU or US market needs medical device risk management, whatever the device class. The depth of the file should match the device, its intended purpose and the severity of possible harm.
Which Regulations Require Medical Device Risk Management?
For medical device risk management, regulators expect a documented, living system rather than a one-time report. The main requirements are summarised below.
| Source | Requirement | What It Means for You |
|---|---|---|
| EU MDR Annex I, Sections 1 to 4 and 8 | Regulation (EU) 2017/745 requires a medical device risk management system, risk reduction and acceptable risks when weighed against benefits. | Establish, implement, document and maintain the system over the device life cycle. |
| EU MDR Annex II, Section 5 | Technical documentation must include the benefit-risk analysis and risk management. | Your medical device risk management file feeds your MDR technical file. IVDR has parallel requirements for the IVDR technical documentation. |
| EN ISO 14971:2019/A11:2021 | Harmonised for EU MDR and IVDR by Implementing Decision (EU) 2022/757. | Applying it gives a presumption of conformity with the requirements listed in its Annex ZA. |
| ISO/TR 24971:2020 | Guidance on applying ISO 14971. | Useful for practical methods. It is guidance and does not add requirements. |
| US FDA | ISO 14971 is a recognised consensus standard, and risk management is expected under the FDA QMSR. | A single file can support both EU and US submissions when planned with both in mind. |
What Are the 7 Stages of Medical Device Risk Management?
These medical device risk management stages show what each activity produces in practice. For a clause-by-clause explanation of the standard, read our guide to the ISO 14971 process.
- Risk management planSet up the framework, assign a responsible person for each activity and define risk acceptability criteria.
- Risk analysisIdentify characteristics according to the intended purpose, identify known or foreseeable hazards, and estimate risks for hazardous situations.
- Risk evaluationCompare the severity and probability of each risk with the acceptability criteria.
- Risk controlIdentify and implement control measures, verify them and check for new hazards or hazardous situations caused by the controls.
- Overall residual riskCheck whether the overall residual risk is acceptable. If it is not, perform a benefit-risk analysis.
- Risk management reviewConfirm that the plan was implemented, add the conclusions and issue the risk management report.
- Production and post-productionCollect and review production and post-market information, then update the file when needed.
How Is Medical Device Risk Analysis Carried Out?
As part of medical device risk management, risk analysis uses available information to identify hazards and estimate the risk of each hazardous situation, in both normal use and fault conditions. It is carried out in three steps:
- Intended use and safety characteristics: identify the quantitative and qualitative characteristics of the device and its reasonably foreseeable misuse.
- Hazard identification: list all known and foreseeable hazards in normal use and in fault conditions.
- Risk estimation: estimate the risk for each hazardous situation. Any system can be used to estimate the probability and severity of harm, whether quantitative or qualitative.
Medical device risk management needs representatives from several functions with specialist knowledge. When required, top management can bring in external consultants or specialists for some activities. Procedures and forms are available as ready-to-edit risk analysis templates, and use-related hazards connect directly with medical device usability engineering.
What Is the Priority Order for Risk Controls?
Control measures are not interchangeable. Both ISO 14971 and EU MDR Annex I, Section 4 set an order of priority, and a reviewer will expect your file to show why each option was chosen.
1
Inherently safe design
Safe design and manufacture, such as removing a sharp edge or choosing a more suitable material.
2
Protective measures
Measures in the device or in manufacturing, such as alarms, guards or software limits.
3
Information for safety
Warnings in the instructions for use and training for users.
Warnings alone rarely justify a high risk if a design change was practicable. After each control is implemented, verify that it works, then check that it has not created a new hazard. This loop sits at the heart of medical device risk management and is often where document reviews find weak evidence.
How Do You Build a Risk Evaluation Matrix?
A risk matrix compares the probability of harm with its severity. ISO 14971 does not prescribe one format, so each manufacturer defines its own scales and acceptability criteria in the risk management plan.
| Probability / Severity | Minor | Serious | Critical |
|---|---|---|---|
| Frequent | Review | Not acceptable | Not acceptable |
| Occasional | Acceptable | Review | Not acceptable |
| Remote | Acceptable | Acceptable | Review |
Whichever medical device risk management format you use, justify the scales using data such as complaint history, literature, clinical data and comparable devices. Apply the same criteria to the initial risk and the residual risk, so that the reduction is visible and traceable.
What Goes in a Medical Device Risk Management File and Report?
The medical device risk management file is the set of records and other documents produced during the medical device risk management process. The documents do not have to be stored together, but each identified hazard must be traceable through its analysis, evaluation, control and residual risk evaluation.
- Risk management plan and acceptability criteria
- Intended use, foreseeable misuse and safety characteristics
- Hazard analysis, risk estimates and risk evaluation
- Risk control measures and evidence of their effectiveness
- Residual risk evaluation and any benefit-risk analysis
- Risk management report and review conclusions
- Production and post-production information and resulting updates
What Should You Check Under EU MDR and ISO 14971?
Following the medical device risk management standard does not automatically meet every EU expectation. Check the Annex ZA tables in EN ISO 14971 and align your plan with the points below.
| Topic | What to Check Under EU MDR |
|---|---|
| Risk reduction | Risks must be reduced as far as possible without adversely affecting the benefit-risk ratio (Annex I, Section 2). Do not base the case on cost. |
| Risk acceptability | Criteria must support the overall conclusion that risks are acceptable when weighed against the benefits to the patient (Annex I, Sections 1 and 8). |
| Information for safety | Users must be told about residual risks (Annex I, Section 4). Align the medical device risk management file with the instructions for use and the label. |
| Post-market link | The system must use production and post-market information to update the analysis (Annex I, Section 3). |
| Clinical link | Clinical evaluation conclusions and the risk file must agree on benefits, hazards and residual risks. |
What Gaps Should You Look For in Your File?
- Hazards copied from a generic list and not linked to the intended purpose
- Control measures with no verification or effectiveness evidence
- Use errors missing, or not linked to the usability engineering file
- Residual risks not disclosed in the instructions for use
- Risk file not updated after complaints, incidents or design changes
- No clear overall residual risk conclusion
- A benefit-risk statement with no supporting clinical data
How does the device type change the work?
Medical device risk management must reflect the technology in front of you. Software needs lifecycle controls under IEC 62304 and assessment of cybersecurity threats that could cause harm. Diagnostic devices need attention to false results and how they affect patient management. Implants need analysis of long-term exposure, materials and the difficulty of removing a device. Combination and sterile products bring further hazards related to substances and sterility.
Your quality system also matters. ISO 13485 certification expects documented risk management across product realisation, so link medical device risk management to design controls, purchasing, production and CAPA.
What Is Risk Benefit Analysis for Medical Devices?
Risk benefit analysis compares the medical benefits of a device with its residual risks to decide whether those risks are acceptable. EU MDR Article 2 defines a risk as the combination of the probability of occurrence of harm and the severity of that harm, and a benefit-risk determination as the analysis of all assessments of benefit and risk of possible relevance for the use of the device for its intended purpose.
Devices are developed for a medical purpose, yet some can cause side effects or harm. Different harms have different severities depending on the intended use, so each risk must be assessed. Many risks are reduced by design, processes and procedures. Those that remain despite all practicable measures are residual risks, and the device is only acceptable when its benefits outweigh them.
Where does benefit-risk fit in CE marking?
The analysis helps the manufacturer change a design or material, or add safety controls, during development. It is then revisited at several points in the life cycle, and the overall acceptability of the device for CE marking depends on it.
| Stage | How Benefit-Risk Is Used |
|---|---|
| Medical device risk management | All risks are reduced as far as possible without adversely affecting the benefit-risk ratio. The analysis belongs in the medical device risk management file. |
| Clinical evaluation | The clinical evaluation provides clinical evidence for the analysis, in line with MDR Article 61 and Annex XIV. MEDDEV 2.7/1 Rev 4 is also used as guidance. |
| Post-market surveillance | Data gathered during post-market surveillance updates the determination and supports its continuous reassessment. |
| PSUR | The Periodic Safety Update Report includes the conclusions of the benefit-risk determination (MDR Article 86). |
| Trend reporting | Non-serious incidents and expected undesirable side effects that could significantly affect the analysis are subject to trend reporting (MDR Article 88). |
How Do You Estimate Benefits and Clinical Risks?
To carry out the analysis, estimate, quantify and then compare both sides using a well-established method.
How are benefits estimated and quantified?
Benefits relate to the intended purpose of the device. They can be estimated from:
- Performance expected during clinical use
- Clinical outcome from that performance
- Other treatment options
- Target groups
Benefits are quantified by considering the following:
- Target patient population: how many patients experience the benefit. A large benefit may outweigh risks even in a small population. A small benefit may not, unless many patients experience it.
- Duration of effect: how long the treatment effect lasts, and the age of the patients.
How are clinical risks estimated?
The medical device risk management process identifies risks and how they were addressed. The clinical evaluation then assesses the significance of the risks that remain after mitigation. Post-market reports should also be considered, including regulatory status, actions taken in the reporting period and tabulated incidents, particularly serious adverse events and deaths. Address these factors:
- Device-related serious adverse events and incidents
- Device-related non-serious or non-reportable harmful events
- Procedure-related incidents
- Probability and duration of harmful events
- Risk from false-positive or false-negative results for diagnostic devices
- The total of all harmful events associated with the device
- Clinical data showing hazards not previously considered, with any additional mitigation required
How are clinical risks evaluated and quantified?
Evaluate each risk by its intensity, whether it is life-threatening, and the medical necessity of the device. Then quantify it by the recurrence of adverse events, any other harmful effects and the patient population affected.
When are residual risks accepted?
Residual risks are accepted only if the benefits outweigh them. The manufacturer should give the reviewing body sufficient clinical data, and the reviewers make the final decision. The main inputs are:
- Biocompatibility data and benchmark test reports
- Clinical data from similar devices
- Post-market surveillance data
What does a benefit-risk conclusion look like?
Consider a hypothetical monitoring device. Its benefit is earlier detection of a worsening condition, supported by clinical data on outcomes for the target group. A residual risk is a false alarm causing unnecessary investigation. The analysis would describe the size and duration of the benefit, the probability and severity of the harm, the available alternatives, and the reason the residual risk is justified. This example only shows the reasoning and does not reflect any specific device.
How Do I3CGLOBAL Medical Device Risk Management Consultants Help?
For medical device risk management, a third-party consultant adds independent review and up-to-date regulatory knowledge. Our medical device consultants support your team in these areas:
Procedure development
Prepare the risk analysis procedure in line with the latest harmonised standard.
Gap assessment
Review existing documents, then identify and fill gaps in hazards, risks and mitigations.
Hazard identification
Identify new hazards and hazardous situations.
File documentation
Document medical device risk management planning, assessments, the effectiveness of controls and post-market activities.
Risk benefit analysis
Use manufacturer information and literature searches to assess whether the medical benefit outweighs the residual risk, with justification and advice on design changes if needed.
Reports and maintenance
Prepare conclusions and reports, and keep the medical device risk management file up to date.
How Do You Start a Medical Device Risk Management Project?
A good start to medical device risk management saves rework later. To scope support accurately, prepare the following before the first review:
- Device description, intended purpose and target patient population
- Device class and target markets
- Existing risk management plan, hazard analysis and report, if available
- Design and development records, including verification and validation
- Usability, biocompatibility and clinical evaluation documents
- Complaints, vigilance and post-market data for marketed devices
Medical device risk management works best when it starts at the design stage, but existing devices can also be brought up to date through a structured gap assessment and a planned remediation of the file.
Work with I3CGLOBAL
Get Your Medical Device Risk Management File Reviewed
Our regulatory team can prepare your file from scratch or close the gaps in existing documents before a Notified Body or FDA review.
- Risk management plan, analysis and report
- Gap assessment and remediation support
- Risk benefit analysis with supporting evidence
- Updates from post-market information
Request your proposal
Tell us about your device and target market, and we will recommend the right scope of support.
FAQs
Medical Device Risk Management: Frequently Asked Questions
What is medical device risk management?
Medical device risk management is the systematic process of identifying hazards, estimating and evaluating risks, controlling them and monitoring how well the controls work throughout the life of a device. ISO 14971 describes the process, and all activities and results are recorded in the risk management file.
What is a risk benefit analysis for a medical device?
It is a documented comparison of the medical benefits of a device against its residual risks. It shows whether the benefits outweigh the risks that remain after risk controls, for the intended purpose and target patient population.
When is a benefit-risk analysis required?
ISO 14971 calls for it when a residual risk is not judged acceptable using the criteria in the risk management plan and further control is not practicable. Under EU MDR and IVDR, a benefit-risk determination is also part of the technical documentation, clinical or performance evaluation and post-market reporting.
What is the medical device risk management review?
A review of the risk management process is carried out before commercial release. It confirms that the plan has been implemented appropriately, the overall residual risk is acceptable, and methods are in place to collect production and post-production information. The results are recorded as the risk management report and kept in the file.
What are the contents of a risk management report?
The report reviews the whole process. It covers whether the risk management plan was implemented appropriately, whether the overall residual risk is acceptable, whether control measures were applied appropriately, whether methods exist to obtain production and post-production information, and the conclusions.
What risks can arise from risk control measures?
A control measure can introduce new hazards or hazardous situations. It can also affect the estimated risks of hazardous situations identified earlier. Both effects must be reviewed and recorded.
How is the residual risk of a medical device evaluated?
After controls are applied, residual risk is evaluated with the same method and acceptability criteria as the initial risk, as defined in the risk management plan, and the result is recorded in the file. If it is not acceptable, a benefit-risk analysis may be performed if further control is not practicable. For acceptable residual risks, the manufacturer decides which to disclose and what information to include in the accompanying documents.
Is ISO 14971 mandatory for CE marking?
ISO 14971 is a voluntary standard, but the risk management system required by EU MDR Annex I is mandatory. EN ISO 14971:2019/A11:2021 is a harmonised standard, so applying it gives a presumption of conformity with the requirements it covers, as set out in its Annex ZA.
What is the difference between risk analysis and risk management?
Risk analysis is one stage: it identifies hazards and estimates the risk of each hazardous situation. Risk management is the whole system, which also includes planning, evaluation, control, overall residual risk evaluation, review and post-production monitoring.