3. ESTABLISH YOUR ORGANIZATION'S RISK MANAGEMENT FRAMEWORK

3.1 RISK MANAGEMENT PROCESS

• Establish a process to manage and control the risks
  associated with your organization’s medical devices.

• Document your organization’s medical
  device risk management process.

• Apply your risk management process to
  your organization’s medical devices.

• Maintain your risk management process for every
  medical device throughout its entire life-cycle.

• Check whether your risk management process complies
  with this standard by inspecting the appropriate documents.

3.2 MANAGEMENT RESPONSIBILITIES

• Make sure that top management demonstrates a
  commitment to medical device risk management.

• Make sure that top management defines and documents a policy that
  governs and controls how risk acceptability criteria are established.

• Make sure that top management reviews the suitability
  of your risk management process at planned intervals.

• Make sure that your organization complies with
  Part 3.2 by inspecting the appropriate documents.

3.3 QUALIFICATION OF PERSONNEL

• Make sure that the people who perform risk management
  tasks have the knowledge and experience they need to
  carry out the tasks that have been assigned to them.

• Make sure that records are kept that document the
  qualifications of your risk management personnel.

3.4 RISK MANAGEMENT PLAN

• Plan your organization’s risk management activities.

  • Establish a risk management plan for each
    particular medical device under consideration.

• Document your medical device risk management plan.

  • Define the scope of your risk management activities.

  • Assign risk management responsibilities and authorities.

  • Specify management review requirements.

  • Establish risk acceptability criteria for each plan.

  • Describe how verification activities will
    be done for each medical device.

  • Explain how you plan to collect and review production
    and post-production information for each medical device.

3.5 RISK MANAGEMENT FILE

• Establish a risk management file for each medical device.

• Use your risk management file to facilitate traceability.

  • Use your risk management file to record risk
    analysis results for each identified hazard.

  • Use your risk management file to record risk
    evaluation results for each identified hazard.

  • Use your risk management file to record risk control
    measures and results for each identified hazard.

  • Use your risk management file to record residual
    risk evaluation results for each identified hazard.

• Maintain a risk management file for each medical device.

  • Make sure that you will be able to assemble
    all referenced information in a timely fashion.

4. PERFORM A RISK ANALYSIS FOR EACH MEDICAL DEVICE

4.1 RISK ANALYSIS PROCESS

• Perform a risk analysis for each medical device.

  • Document your medical device’s intended use.

  • Identify your medical device’s possible hazards.

  • Estimate the risk for each hazardous situation.

• Record your risk analysis activities and results.

  • Use your risk management file to document
    your analytical activities and results.

  • Check whether your organization complies with
    Part 4.1 by inspecting your risk management file.

4.2 INTENDED USE AND SAFETY

• Use your risk management file to document
  the intended use or purpose of each particular
  medical device under consideration.

• Identify those medical device characteristics
  that could potentially affect safety.

• Check whether your organization complies with
  Part 4.2 by inspecting your risk management file.

4.3 IDENTIFICATION OF HAZARDS

• Identify the hazards that could possibly
  affect the safety of your medical device.

• Document the known and foreseeable hazards
  that could affect the safety of your medical device.

• Use your risk management file to maintain the
  documents that identify and describe the hazards
  that could affect the safety of your medical device.

4.4 RISK ESTIMATION PROCESS

• Estimate the risk for each hazardous situation.

  • Consider every reasonably foreseeable
    sequence or combination of events that
    could result in a hazardous situation.

• Use your risk management file to record the
  results of your risk estimation activities.

  • Use your risk management file to
    record each hazardous situation.

  • Use your risk management file to record the
    process or system you use to estimate risk.

• Check whether your organization complies with
  Part 4.4 by inspecting your risk management file.

5. EVALUATE RISK FOR EACH IDENTIFIED HAZARDOUS SITUATION

RISK EVALUATION PROCESS

• Study each hazardous situation and then use your risk acceptability
  criteria to decide if risk reduction is required in each and every case.

  • Skip Parts 6.2 to 6.6 whenever risk reduction is
    not required for a particular hazardous situation.

RISK EVALUATION RECORDS

• Use your risk management file to record
  the results of your risk evaluation activities.

  • Check whether your organization complies with
    Part 5 by inspecting your risk management file.

6. DEVELOP RISK CONTROLS WHENEVER RISK MUST BE REDUCED

6.1 RISK REDUCTION PROCESS

• Reduce risk whenever your risk is unacceptable.

  • Identify your risk control options (see Part 6.2).

  • Implement appropriate risk control options (see Part 6.3).

  • Evaluate your residual (remaining) risks (see Part 6.4).

  • Decide if benefits exceed residual risks (see Part 6.5).

  • Identify risks arising from risk controls (see Part 6.6).

  • Ensure that all risks were considered (see Part 6.7).

6.2 RISK CONTROL OPTION ANALYSIS

• Identify risk control measures that reduce risk to an acceptable level.

  • Consider your organization’s risk control options.

  • Determine whether or not risk reduction is practicable.

  • Select the most appropriate risk control measures.

• Use your risk management file to record the risk
  control measures you have chosen to implement.

  • Check whether your organization complies with
    Part 6.2 by inspecting your risk management file.

6.3 RISK CONTROL IMPLEMENTATION

• Implement all of your risk control measures.

• Verify that each risk control was actually implemented.

• Use your risk management file to record the
  results of your risk control verification activities.

• Check whether your organization complies with
  Part 6.3 by inspecting your risk management file.

6.4 RESIDUAL RISK EVALUATION

• Evaluate your residual risk (the risk left over after
  you’ve implemented your risk control measures).

  • Use your risk acceptability criteria to evaluate
    whether or not your residual risk is acceptable.

  • Use your risk management file to record
    the results of your residual risk evaluation.

• Check whether your organization complies with
  Part 6.4 by inspecting your risk management file and
  the accompanying residual risk disclosure documents.

6.5 RISK-BENEFIT ANALYSIS

• Conduct a risk-benefit analysis of your residual
  risk whenever your residual risk is unacceptable
  and further risk control is impractical.

• Use your risk management file to record
  the results of your risk-benefit analysis.

• Check whether your organization complies with
  Part 6.5 by inspecting your risk management file.

6.6 RISKS CREATED BY CONTROLS

• Review your risk control measures to see
  if they generate unintended consequences.

• Manage and control all new or modified risks whenever
  your risk profile changes (see Parts 4.4 to 6.5, above).

• Use your risk management file to record the
  results of your risk control review.

• Check whether your organization complies with
  Part 6.6 by inspecting your risk management file.

6.7 COMPLETENESS OF RISK CONTROL

• Make sure that all hazards and all identified
  hazardous situations have been considered.

• Use your risk management file to record the results
  of your hazard and risk control completeness review.

• Check whether your organization complies with
  Part 6.7 by inspecting your risk management file.

7. EVALUATE THE OVERALL RESIDUAL RISK POSED BY EACH DEVICE

OVERALL RESIDUAL RISK EVALUATION

• Evaluate the acceptability of your medical device’s
  overall residual risk (the risk left over after you’ve
  implemented and verified all risk controls).

  • Use your risk acceptability criteria to decide if your
    medical device’s overall residual risk is acceptable.

OVERALL RESIDUAL RISK RECORDS

• Use your risk management file to record the results
  of your overall residual risk acceptability evaluation.

• Check whether your organization complies with
  Part 7 by inspecting your risk management file and
  the medical device’s accompanying documents.

8. REVIEW RISK MANAGEMENT PROCESS AND PREPARE REPORT

RISK MANAGEMENT REVIEW

• Make sure that responsibility for carrying out
  risk management reviews has been assigned.

  • Make sure that your risk management plan
    indicates who is responsible for reviews.

• Carry out a risk management review before you
  release your medical device for commercial distribution.

  • Review your risk management process.

RISK MANAGEMENT REPORT

• Prepare a risk management report before you
  release your medical device for commercial distribution.

  • Use your report to record the results
    of your risk management review.

• Check whether your organization complies with
  Part 8 by inspecting your risk management file.

9. MONITOR DEVICE DURING PRODUCTION AND POST-PRODUCTION

MEDICAL DEVICE MONITORING

• Establish a system to monitor medical devices
  during production and post-production phases.

  • Develop your medical device monitoring system.

  • Use your medical device monitoring system.

  • Document your medical device monitoring system.

  • Maintain your medical device monitoring system.

MONITORING YOUR MONITORING

• Check whether your organization complies with Part 9 by inspecting
  your risk management file and other appropriate documents.

This page summarizes the ISO 14971 2007 standard.
It highlights the main points. It does not present detail.

If you need a detailed and complete interpretation
of ISO 14971 2007, please consider purchasing our
Title 48: ISO 14971 Translated into Plain English.

Check our Title 48 Table of Contents
Check our Prices. Place an Order
Check our License Agreement

 Our Title 48 provides a detailed, accurate, and complete
interpretation of ISO 14971 2007. It uses language that is
clear, precise, and easy to understand. We guarantee it! 

Title 48 can be delivered to you on CD or as an email attachment.
Title 48 is 60 pages long and comes in pdf and MS doc file formats.

OTHER ISO 14971 PAGES

Introduction to ISO 14971 Risk Management

Plain English Medical Device Risk Management Definitions

Overview of ISO 14971 Medical Device Risk Management Standard

ISO 14971 2007 in Plain English Table of Contents

Our Plain English Approach

RELATED LIBRARIES

ISO 31000 2009 Risk Management Library

ISO 13485 Medical Device Quality Management Library

Home Page

Our Libraries

A to Z Index

Our Customers

How to Order

Our Products

Our Prices

Our Guarantee

PRAXIOM RESEARCH GROUP LIMITED
9619 - 100A Street, Edmonton, Alberta, T5K 0V7, Canada
Telephone: 780-461-4514 - Email: info@praxiom.comm

Updated on January 2, 2012. First published on February 28, 2011.