Why Risk Management Matters
Every medical device carries inherent risks. ISO 14971 provides the internationally recognised framework for systematically identifying, evaluating, controlling, and monitoring those risks throughout a device's entire lifecycle — from concept to decommissioning.
#1
Most-cited standard in MDR
Art. 10(2)
MDR requires ISO 14971-based risk management
Lifecycle
From design through post-market
🏥 What This Means for Your Hospital
- Risk management underpins every decision about which devices to procure, use, and monitor
- You play a vital role in post-market risk monitoring — reporting incidents feeds back into risk controls
- Understanding risk/benefit helps you explain device choices to patients and colleagues
- HSE Medical Device Governance requires facilities to maintain risk-based device inventories
1. ISO 14971 at a Glance
ISO 14971:2019 (Medical devices — Application of risk management to medical devices) is the harmonised standard that satisfies MDR Annex I General Safety & Performance Requirements (GSPRs). It was last revised in 2019, aligning with MDR/IVDR requirements.
🎯
Scope
Applies to ALL medical devices and IVDs — from tongue depressors to MRI scanners.
🔄
Lifecycle approach
Risk management is continuous — not a one-time checkbox. It runs from initial concept through post-market surveillance.
⚖️
Risk vs. Benefit
Residual risks must be weighed against clinical benefits. Zero risk is never the goal — acceptable risk is.
🔬
State of the Art
Risk acceptability is judged against current knowledge and technology — what was acceptable in 2015 may not be today.
Knowledge Check
According to ISO 14971, how is 'risk' defined?
2. The Risk Management Process
ISO 14971 defines a structured, iterative process. Think of it as a continuous loop — not a linear checklist.
Knowledge Check
What is the FIRST step in the ISO 14971 risk management process?
3. The Risk Matrix & Acceptability Criteria
The risk matrix is the core tool for risk evaluation. It plots severity of harm against probability of occurrence to classify each risk.
| Severity → Probability ↓ | Negligible | Minor | Serious | Critical | Catastrophic |
|---|---|---|---|---|---|
| Frequent | ALARP | Unacceptable | Unacceptable | Unacceptable | Unacceptable |
| Probable | Acceptable | ALARP | Unacceptable | Unacceptable | Unacceptable |
| Occasional | Acceptable | ALARP | ALARP | Unacceptable | Unacceptable |
| Remote | Negligible | Acceptable | ALARP | ALARP | Unacceptable |
| Improbable | Negligible | Acceptable | Acceptable | ALARP | ALARP |
Unacceptable
Risk MUST be reduced — cannot proceed without mitigation
ALARP
Reduce As Low As Reasonably Practicable — weigh cost/benefit of further controls
Acceptable
Risk is within acceptable limits — still reduce if practicable
Negligible
Risk is minimal — typically no further action needed
Knowledge Check
A hazard has 'Remote' probability and 'Critical' severity. Where does it fall on the risk matrix?
4. The Risk Control Hierarchy
ISO 14971 mandates a strict priority order for risk controls. Higher-priority measures are more effective and must always be considered first.
Inherent Safety by Design
Eliminate the hazard entirely through design choices
Protective Measures
Add barriers, guards, alarms, or interlocks when the hazard cannot be eliminated
Information for Safety
Provide warnings, labels, and training when residual risk remains
Knowledge Check
A manufacturer designs a new infusion pump. To prevent accidental free-flow of medication, which risk control approach has the HIGHEST priority under ISO 14971?
5. ISO 14971 & MDR/IVDR — How They Connect
MDR explicitly requires manufacturers to establish and maintain a risk management system conforming to ISO 14971. Here are the key linkage points:
| MDR Reference | Requirement | ISO 14971 Link |
|---|---|---|
| Article 10(2) | Manufacturer must establish risk management system | Entire ISO 14971 process |
| Annex I, Ch. I (GSPRs) | Devices must be safe; risks reduced AFAP | Risk evaluation & control (Clauses 7-8) |
| Annex I, §1 | Residual risks acceptable when weighed against benefits | Benefit-risk analysis (Clause 9) |
| Annex I, §4 | Risk controls follow the hierarchy | Risk control options (Clause 7.1) |
| Annex II | Technical documentation must include risk management | Risk Management File (Clause 4.5) |
| Annex III | DoC references GSPR compliance | Risk Management Report (Clause 10) |
| Article 83-86 | Post-market surveillance feeds risk management | Production/post-production (Clause 10) |
| Annex XIV Part A | Clinical evaluation considers risks vs. benefits | Benefit-risk (Clause 9) |
⚖️ The Benefit-Risk Balance
MDR Annex I, Section 1 states: "Devices shall achieve the performance intended by their manufacturer, and shall be designed and manufactured in such a way that, during normal conditions of use, they are suitable for their intended purpose. They shall be safe and effective and shall not compromise the clinical condition or the safety of patients [...] any risks [...] shall constitute acceptable risks when weighed against the benefits to the patient."
✅ Benefits may include
- • Clinical: improved diagnosis, treatment, survival
- • Patient management: easier monitoring, faster recovery
- • Public health: disease prevention, screening
⚠️ Risks may include
- • Direct harm: infection, injury, adverse reactions
- • Indirect harm: delayed diagnosis, incorrect reading
- • User risks: ergonomic strain, exposure to radiation
6. Common Risk Analysis Techniques
ISO 14971 does not mandate a specific analysis method. Manufacturers choose from established techniques depending on the device complexity:
FMEA
Failure Mode & Effects Analysis
Bottom-up: analyses individual component failures and their effects on the system. Most commonly used for medical devices.
FTA
Fault Tree Analysis
Top-down: starts with an undesired event and works backward to find root causes using logic gates (AND/OR).
HAZOP
Hazard & Operability Study
Systematic examination using guide words (e.g., 'more', 'less', 'reverse') to identify deviations from intended operation.
PHA
Preliminary Hazard Analysis
High-level early-stage analysis to identify potential hazards before detailed design. Often the first step.
Knowledge Check
Which risk analysis technique works 'top-down', starting from an undesired event and tracing back to root causes?
7. The Risk Management File
All risk management activities must be documented in a Risk Management File (RMF). This is a living document that evolves throughout the device lifecycle and forms part of the Technical Documentation required under MDR Annex II.
📁 Contents of a Risk Management File
8. Irish & HSE Context
🇮🇪 HPRA & Risk-Based Market Surveillance
The HPRA uses a risk-based approach to market surveillance — devices with higher inherent risk (Class III, Class D IVDs) receive more scrutiny. When you report an incident to the HPRA, they evaluate it using risk management principles similar to ISO 14971.
The HPRA's vigilance system directly feeds into the manufacturer's post-market risk management process, potentially triggering Field Safety Corrective Actions (FSCAs).
🏥 HSE Medical Device Governance
The HSE Medical Device Governance Policy requires each healthcare facility to maintain risk-based approaches to medical device management, including:
- Risk-based device inventories and prioritised maintenance schedules
- Risk assessment before introducing new devices or changing procedures
- Incident reporting aligned with national vigilance requirements
- Local Risk Committees reviewing device-related events
🎯 Key Takeaways
Knowledge Check
8 questions · 80% required to pass
Q1.What international standard defines the risk management process for medical devices?
Q2.According to ISO 14971, how is "risk" defined?
Q3.What is the FIRST step in the ISO 14971 risk management process?
Q4.A risk is classified as "ALARP" on the risk matrix. What does this mean?
Q5.Under the ISO 14971 risk control hierarchy, which measure has the HIGHEST priority?
Q6.Your ward receives a Field Safety Notice (FSN) about a patient monitor. The FSN was triggered because post-market surveillance identified a new hazard. Which step of the ISO 14971 process does this represent?
Q7.Which risk analysis technique works "top-down", starting from an undesired event and tracing back to root causes using logic gates?
Q8.MDR Annex I, Section 1 states that devices shall be safe and effective, and that residual risks shall be acceptable when weighed against what?
0/8 answered
Print-Friendly Summary
One-page PDF for ward reference & quick revision
Was this module useful?