Risk Management

ISO 14971 “Medical devices – Application of risk management to medical devices” is the internationally recognized standard for medical device risk management. It describes a process for applying risk management to help medical device manufacturers identify the hazards and hazardous situations associated with the medical device, assess and evaluate the associated risks, control these risks, and monitor the effectiveness of risk control measures. This process must be implemented and documented by the manufacturer and includes the following key elements: risk analysis, risk assessment, risk control, and activities during manufacturing and downstream phases of manufacturing. The risk management process should be carefully coordinated within the company and incorporated into the clinical evaluation of the medical device. Both elements should be closely linked and regularly updated. The MDR requires that the acceptance of risk is always based on the risk-benefit ratio. A medical device is sufficiently safe if the benefits outweigh the risks. Risks must therefore be reduced as far as possible without negatively affecting the benefit-risk ratio.

Medical device manufacturers must create and maintain a risk management file for each medical device. This is part of the technical documentation and documents that all necessary activities have been carried out. All important documents created as part of the risk management process are included here. The risk management file provides traceability for each identified hazard, to the following: Risk analysis, risk assessment, implementation and verification of risk control measures, assessment of the acceptability of each residual risk. All risk management activities must be planned in the risk management plan. The plan includes a description of the medical device, assignment of responsibilities and authorities, requirements for reviewing risk management activities, criteria for acceptance of risks based on the manufacturer’s policy, activities of verification, and activities related to collection and review of relevant information from the manufacturing and post-manufacturing phases of the device. The summary of the review of the results of the risk management process, including assessment of the overall residual risk, is provided in the final risk management report. The risk management report should confirm that the risk management plan has been appropriately implemented, the overall residual risk is acceptable, and appropriate procedures are in place to obtain relevant information from manufacturing and production downstream phases. The risk management plan and risk management report are parts of the risk management file.

We support you in implementing the requirements of the MDR and help you to create an ISO 14971 compliant risk management file.