ISO 14971 Risk Management: How to Estimate and Accept Risk

ISO 14971:2019 is the current international standard for medical device risk management, according to the International Organization for Standardization. It requires a defined process to analyse and evaluate risks, implement controls, and assess residual risk; effective ISO 14971 risk management for medical devices also depends on objective criteria for deciding whether risks are acceptable. The standard doesn’t set one acceptable risk level for every device.

That distinction matters: estimating risk means assessing the probability and severity of harm, while accepting risk means applying criteria established by the manufacturer. A sound process also needs to be integrated into the quality management system, with assigned responsibilities, adequate resources, documented decisions, and ongoing review.

This guide explains what ISO 14971:2019 requires, how its risk-management process connects with ISO 13485, and how risk estimation, acceptability decisions, controls, and production and post-production monitoring fit together. You’ll see how these elements support consistent decisions across a device’s life cycle and what to consider when maintaining a risk-management system in practice.

What is ISO 14971:2019?

According to the International Organization for Standardization, ISO 14971:2019 is the current edition of the international standard for medical device risk management. It sets out a lifecycle process for identifying hazards, estimating and evaluating risks, applying controls, and reviewing residual risk.

Risk Analysis, Evaluation, and Control

Risk analysis uses available information to identify hazards and estimate the risks they may create. Evaluation compares those estimates with the manufacturer’s established acceptability criteria; control then reduces risks where required. Together, these activities give design and quality teams a documented basis for decisions instead of relying on informal judgment.

To estimate and evaluate a medical-device risk, identify the hazardous situation and possible harm, then assess the probability and severity of that harm. Compare the estimate with documented acceptance criteria, and record the rationale and any control decisions.

ISO 14971 specifies the risk-management process, while ISO 13485 specifies quality management system requirements. IEC 62304 addresses medical-device software lifecycle processes, so software-related hazards can be assessed within the broader risk process.

In the United States, the FDA uses risk-based decisions in areas including device classification, submissions, inspections, recalls, and enforcement. ISO 14971:2019 is identified as an FDA-recognized consensus standard, while 21 CFR 820 is a regulatory reference for medical-device risk management.

Hazard Analysis Methods

Hazard-analysis methods structure the search for potential failure paths and resulting harm. Failure mode and effects analysis (FMEA) examines how individual components or process steps could fail and considers the effects. Fault tree analysis starts with an undesired event and maps the contributing failures or combinations of events.

For example, an infusion-pump FMEA could examine a flow-control failure and its possible effect on delivery. A fault tree could start with unintended delivery and trace its contributing causes. These methods support systematic analysis; teams should select an approach suited to the device, its use, and the available evidence.

Residual Risk and Benefit-Risk Analysis

Residual risk is the risk remaining after risk-control measures are implemented. Teams reassess it using the same documented criteria applied during evaluation, then record whether it is acceptable and whether further controls are practicable.

If residual risk remains unacceptable, the analysis must inform additional controls or a decision not to proceed. If it is acceptable, benefit-risk analysis considers whether the device’s expected benefits outweigh the remaining risk. Record the rationale in the risk management file, alongside evidence that implemented controls were evaluated.

A gap analysis can compare existing procedures, responsibilities, and records against ISO 14971’s process elements. For example, a manufacturer may identify that hazard analyses exist but production feedback does not trigger review. An implementation plan can assign owners, define document updates, and establish how new information reaches the risk team.

Common implementation weaknesses include incomplete hazard identification, inconsistent acceptance criteria, unsupported risk estimates, and missing links between controls and verification evidence. An audit can also reveal outdated risk files or production information that has not prompted reassessment. Clear records and traceable decisions help teams show how each identified risk was addressed.

Integration with an ISO 13485 quality management system

ISO 13485 and ISO 14971 address connected but distinct parts of medical-device quality. ISO 13485 specifies quality management system requirements, while ISO 14971 specifies the risk-management process. Integration places risk-related decisions within established procedures, responsibilities, and records rather than treating them as a separate exercise.

Connect risk activities to QMS processes

ISO 13485:2016 makes reference to risk management, and its quality system can incorporate the ISO 14971 process. Map each risk activity to an existing procedure: design reviews, document control, corrective action, and management review are practical points of connection. This helps teams define who records an associated hazard, who evaluates it, and how decisions reach relevant functions.

For example, a design change can trigger a review of affected hazards and controls. The design team records the change, risk personnel assess whether existing estimates remain valid, and quality staff maintain the controlled records. Defined handoffs reduce the chance of separating a product decision from its risk rationale.

Link risk management with design controls

During design and development, risk analysis can inform requirements, design choices, and verification planning. Start with intended use and foreseeable use scenarios, then identify hazards associated with each function. A team developing a monitoring device, for instance, could assess whether an unclear display might contribute to an incorrect user response.

Risk controls should be traceable to design outputs and verification evidence. If a display change is intended to reduce a use-related risk, the design record should show the control, how it was implemented, and how the team evaluated its effectiveness. A later design revision should prompt an assessment of affected hazards, assumptions, and residual risks.

Maintain traceability across records

A connected system links each identified hazard to its risk estimate, acceptability decision, selected controls, and supporting evidence. The risk management file can reference controlled design documents rather than duplicate every record. Document identifiers and revision status help reviewers find current evidence and understand which product configuration was assessed.

Change control provides a practical link between the QMS and the risk file. When a supplier, material, software function, or manufacturing process changes, assess whether the change affects a hazard or control. Record why the analysis was updated, or why existing risk records remain applicable.

Use integration to expose process gaps

A gap analysis can compare current QMS procedures with the risk activities they need to support. Look for unclear ownership, disconnected design records, or corrective actions that do not feed into risk evaluation. Assign responsibilities and document how new information moves between design, quality, and risk-management roles.

Organizations preparing for assessment can review the scope of management system certification alongside their documented processes.

Production and post-production information

Risk management continues across a medical device’s life cycle, from design and manufacturing through postmarket use. ISO 14971 requires organizations to monitor production and post-production information to help ensure device safety. This feedback can reveal whether assumptions made during design still reflect actual manufacturing conditions and user experience. A monitoring process should therefore define what information is collected, who evaluates it, and how findings reach risk-management records.

Connect production information to risk records

Production data can reveal changes that affect previously assessed hazards. For example, a recurring manufacturing deviation may point to a process condition affecting device performance. The responsible team can record the deviation, identify affected products or processes, and assess whether existing risk estimates and controls remain appropriate.

Supplier changes, inspection results, nonconforming outputs, and process changes can also provide relevant signals. Each source needs a route into review rather than remaining isolated within a department. A defined handoff helps the risk team assess the information and document its decision, including why existing controls remain suitable or need revision.

Review post-production signals

After release, complaints, service records, returned devices, and user feedback can reveal hazards that were not apparent during development. Consider a device with repeated reports of an unclear instruction: the team can assess whether use-related risks call for new controls, revised information, or further evaluation. The review should consider the nature and context of each signal, not just its presence.

ISO 14971 risk management should connect these findings to the risk management file. Record the information source, assessment, decision, and any follow-up action. If evidence suggests an existing hazard has changed, reassess its probability or severity using the organization’s established method. This creates traceability between field experience and decisions about device safety.

Use a defined monitoring and escalation process

A practical process assigns responsibility for collecting, screening, escalating, and reviewing information. It should also specify how urgent signals are handled and how trends are assessed over time. A single complaint may warrant review because of its potential severity, while a pattern across separate records may reveal a broader issue. The method should support objective decisions without treating every report as proof of a new risk.

• Collect relevant production and post-production information, including manufacturing deviations and user feedback.
• Screen each signal for potential links to known hazards, hazardous situations, or controls.
• Document the assessment and route findings for risk-file updates or further action.

Postmarket surveillance expectations are associated with the Medical Devices Regulation MDR 2017/745 and the In Vitro Diagnostic Devices Regulation IVDR 2017/746. For manufacturers working across markets, the monitoring process should keep relevant information connected to device risk records and applicable regulatory processes. Reviewing these links helps show how production and field evidence informs ongoing risk decisions throughout the life cycle.

Risk estimation and acceptability

ISO 14971 requires manufacturers to establish a policy and objective criteria for risk acceptability. The standard does not prescribe one acceptable risk level for every device. A documented approach to ISO 14971 risk management for medical devices therefore relies on criteria suited to the device and its intended use.

Estimating Risk

Risk estimation evaluates the probability and severity of harm. It gives teams a consistent basis for comparing hazards and deciding which require controls.

Begin with the intended use and hazardous situation, then identify the possible harm. For a patient-monitoring device, an inaccurate reading could contribute to a delayed response. For an in vitro diagnostic device, an incorrect result could affect a clinical decision. The risk estimate should reflect the specific device, its users, and its conditions of use.

Evidence may come from design analysis, testing, production records, or post-production information. Record the evidence used and the assumptions behind the estimate. If data is limited, document how that uncertainty affects the assessment instead of presenting an unsupported estimate as precise. Consistent definitions help reviewers interpret probability and severity in the same way.

Applying Acceptability Criteria

Acceptability criteria are documented rules for deciding whether an estimated risk can be accepted or needs further action. They help ensure risk decisions are consistent across hazards, teams, and device changes.

The manufacturer’s policy should explain how estimates are compared with the criteria. A matrix may classify combinations of probability and severity, while written rules clarify how teams handle borderline cases. ISO 14971 leaves acceptable levels to the manufacturer, so the criteria should be justified for the device and its intended use. In ISO 14971 risk management for medical devices, this policy gives reviewers a consistent basis for evaluating decisions across the risk file.

Apply the criteria to each estimated risk, record the outcome, and identify any required controls. If a risk falls outside the acceptance policy, the decision should lead to further risk reduction or, where residual risk remains, a documented benefit-risk analysis. In the risk management file, link the rationale to the estimate, evidence, criteria, and conclusion.

Criteria also need to work in practice. If two teams assess the same hazardous situation differently, compare their assumptions, severity definitions, and evidence. Differences may reveal unclear policy wording or inconsistent use of the method. Review criteria when device design, intended use, users, or available evidence changes, and document the effect of the review on previous decisions.

For each risk, a clear record answers three questions: what harm was considered, how the estimate was reached, and why the risk was accepted or further action was taken. This traceable reasoning supports review of patient-safety decisions and helps teams apply the same policy throughout the device life cycle.

ISO 14971 risk-management system requirements

ISO 14971 requires an organizational framework that supports risk activities throughout a medical device’s life cycle. Its effectiveness depends on more than individual hazard records: responsibilities, resources, management review, and documentation must work as a systematic process.

To create a risk management plan, define its scope, responsibilities, methods, acceptability policy, and review arrangements for the device. Then maintain a risk management file that contains or references the analyses, decisions, controls, and review records.

Assign responsibility and provide resources

Organizations must provide adequate resources and assign qualified personnel to risk-management activities. In practice, the plan should identify the functions involved and clarify who owns each activity. For example, design personnel may assess a design hazard, while quality personnel maintain controlled records and route relevant information for review.

Qualifications should match the assigned work. Anyone estimating risks needs the competence to understand the device, its intended use, and the evidence being assessed. Cross-functional input can help when decisions involve design, manufacturing, clinical use, or production feedback. Clear responsibilities prevent important records from being left without an owner.

Make management review meaningful

ISO 14971 requires management reviews of the risk-management system. Review should examine whether the process remains suitable and whether assigned resources support its activities. Useful inputs include unresolved decisions, changes to procedures, and issues affecting the completeness or effectiveness of risk records.

For example, if production information repeatedly reaches the quality team but not risk reviewers, management can examine the handoff and assign corrective actions. Record the review decisions, responsible owners, and follow-up. This makes review a form of system oversight, not a general discussion disconnected from risk work.

Maintain a usable risk management file

The risk management file documents the process and preserves traceability. It can contain records directly or reference controlled documents, provided reviewers can find the relevant evidence and understand its status. Link each identified risk to its analysis, evaluation, control decisions, and any reassessment.

• Use consistent device and document identifiers across linked records.
• Record the rationale for decisions, including the evidence considered.
• Update references when changes affect a risk assessment or control.

A file that only stores completed forms may hide missing links. Reviewers should be able to follow how a hazard led to an assessment, what decision followed, and how control effectiveness was evaluated. Version control also helps distinguish current records from superseded evidence.

Organizations aligning documented processes with broader management-system requirements can explore management system certification as a separate assessment pathway.

International Associates Limited: Social Accountability Audits

International Associates Limited provides ISO 13485 Medical Devices Certification for organizations seeking independent assessment of their medical-device quality management systems. This is a relevant next step when you need certification assessment against ISO 13485; it is distinct from implementing or managing your ISO 14971 risk process.

Social Accountability Audits address a different organizational need, while ISO 9001 Quality Management System Certification, ISO 14001 Environmental Management System Certification, and ISO 45001 Occupational Health and Safety relate to other management system requirements. Select the assessment that matches your organization’s intended certification scope.

For information about the appropriate certification pathway, contact International Associates Limited or visit ia-uk.com.

Put your next compliance decision into action

Use your current assessment to identify the next decision that needs ownership, evidence, or management attention. A focused review can help keep ISO 14971 risk management for medical devices aligned with the organization’s priorities as work progresses.

For independent assessment of a separate certification need, International Associates Limited can help identify the relevant next step for your organization. Contact International Associates Limited for support.

Clear priorities give your team a practical starting point for continued progress.

Frequently Asked Questions

Is ISO 14971:2012 the most recent version of the standard?

No. The International Organization for Standardization identifies ISO 14971:2019 as the current international edition. EN ISO 14971:2012 is an older European designation, not the current international edition. This distinction matters when reviewing legacy technical files, contracts, or procedures: identify the exact edition and regional designation each document references before deciding whether its risk records need review.

What does ISO 14971 require?

It requires manufacturers to establish and maintain a systematic risk-management process for medical devices. Beyond technical analysis, the process needs an organizational policy, qualified personnel, adequate resources, management review, and documented records. A practical way to test implementation is to trace a risk decision from its supporting evidence to the responsible role and controlled record. That trace can reveal gaps between written procedures and actual practice.

What is ISO 14971 and what medical devices does it apply to?

ISO 14971 is an international standard for medical-device risk management, and it can be applied alongside standards addressing particular device characteristics. For example, ISO 10993-1:2025 addresses biological evaluation within a risk-management process; IEC 60601 relates to medical electrical equipment, and IEC 62366 addresses usability. Software development also has relevant standards, including IEC 62304. These standards address different technical concerns, while risk management connects their implications.

What are the current editions of ISO 14971 and its US adoption?

The current international edition is ISO 14971:2019. The U.S. designation identified as an FDA-recognized consensus standard is ANSI/AAMI ISO 14971:2007/(R)2010. The edition and adoption identifier should be recorded precisely in regulatory documentation, since they are not the same designation. For organizations working across markets, maintaining a standards register can help distinguish international editions from national adoptions and related regulatory references.

What are the main requirements of ISO 14971 risk management?

Key requirements include a risk-management plan, documented risk decisions, organizational oversight, and continued consideration of relevant device information. In Europe, EN ISO 14971:2019 was amended by A11:2021, which added Annex Z tables mapping the standard to EU MDR and IVDR requirements. That mapping provides regulatory context; manufacturers still need records that connect their device-specific assessments with applicable obligations.

What are the steps in the ISO 14971 risk management process?

The process moves from planning through analysis, evaluation, risk control, and residual-risk assessment, with production and post-production information feeding ongoing review. The sequence can loop: new evidence may change an earlier assumption or assessment. For instance, a manufacturing change can prompt review of a related risk record, even when the device’s intended use remains unchanged.

How does ISO 14971 define hazard, hazardous situation, harm, and risk?

A hazard is a potential source of harm; a hazardous situation is a circumstance that exposes someone or something to that hazard. Harm is the resulting injury or damage, while risk combines the probability of harm with its severity. Consider a sharp edge: the edge is the hazard, contact with it is the hazardous situation, and a cut is possible harm. Risk describes the likelihood and seriousness of that outcome.

What does ISO 14971 require for risk control and verification?

Risk controls are prioritized in this order: inherent safety by design, protective measures, then information for safety. Verification records should show that a selected measure was implemented; evaluation considers whether it reduces the relevant risk. For example, if a protective measure is added to a design, retain evidence linking it to the design output and its evaluation. This distinction helps prevent evidence of implementation from being mistaken for proof of effectiveness.