
Starting the risk management process from the preliminary identification of hazards associated with the particular design and characteristics of the device, then estimating risk for the hazardous situations resulting from a sequence of events would provide the risks prior to any risk control measures.

Management of risk occurs in three-steps: As the common terms Probability and Severity represent very different entities with low correlation in these scenarios, care is required when applying these terms to FMEA and to risk management. It is worth mentioning that ISO 14971 defines risk as the combination of the Probability of occurrence of harm and the severity of that harm, whereas FMEA is about the Probability of occurrence of a failure and severity of the consequences of the failure. When applied in Process FMEAs for instance, Detection (of failures that may pose hazards, rather than harms) has been historically used as a significant measure in reducing the probability of the harm actually occurring, assuming the detected condition can be effectively acted upon, such as during production processes. Since ISO 14971 provides a framework for risk management of medical devices aimed at reducing risk of harm to users, unless the end-user can detect the specific risk and react effectively in real time, Detectability serves no useful purpose as a risk control measure. The reasoning is that Detectability would only influence the Probability of an event occurring and can be offset by suitable adjustment of the occurrence scale.

Under ISO 14971 risk has only two components – Probability (Occurrence) and Severity (Consequence), with no consideration for Detectability as used in FMEA. criteria for acceptability of overall residual risks andĬlause 5.4 of ISO 14971: 2019 has been rewritten to stress the requirement for consideration of risks during normal operation, rather than use of tools that only address fault conditions, such as Failure Modes & Effects Analysis (FMEA).applicability to Software as a Medical Device (SaMD) and in vitro diagnostic (IVD) devices and data security.


extension into the post-production activities.integration with the quality management system.While the basic foundation and structure of the risk management process has not changed from previous versions, the 2019 revision contains specific information on aspects such as: The definitive risk management standard for medical devices – ISO 14971: 2019 – Medical Devices – Application of Risk Management and the accompanying guidance on its application – ISO TR 24971: 2019 were revised in December 2019 to provide device manufacturers clarity on critical aspects of hazard identification, risk concepts and techniques, the importance of the risk management plan, and end-to-end traceability in ensuring risk is effectively managed across all stages of the product life-cycle.
