ISO 14971 Risk Management for Medical Devices

ISO 14971 defines the risk management process required for medical devices throughout their lifecycle — from concept to post-market surveillance. It is mandated by FDA (21 CFR 820), EU MDR, and most global medical device regulations.

Key definitions

Term	ISO 14971 definition
Hazard	Potential source of harm
Harm	Physical injury or damage to health or property
Hazardous situation	Circumstances where people, property, or the environment are exposed to a hazard
Risk	Combination of probability of harm and severity of that harm
Residual risk	Risk remaining after risk control measures are implemented

Risk management process

Risk analysis: identify intended use, foreseeable misuse, hazards, and hazardous situations
Risk evaluation: compare each risk against acceptance criteria (ALARP — As Low As Reasonably Practicable)
Risk control: inherently safe design → protective measures → information for safety (in that priority order)
Residual risk evaluation: assess each residual risk and the combined residual risk
Risk/benefit analysis: if residual risk is too high, is the medical benefit greater than the risk?
Production and post-production: monitor field events and update the risk file

CQE exam tips

Risk control priority: design first, protective devices second, labeling third — labeling alone is the weakest control.
The risk management file must be maintained throughout the device lifecycle (not just at launch).
ISO 14971 applies to hardware, software (IEC 62304 references it), and combination products.

Take the Free Quiz →

More: 5 Whys · 8D problem solving · AOQ & AOQL · APQP & PPAP · AQL sampling plans · Attribute agreement & kappa · Attribute control charts · Availability & maintainability · Benchmarking types · Binomial vs Poisson · Blocking & randomization · Calibration & traceability · Capability: non-normal · Chi-square test · Confidence intervals · Control chart selection · Control plan · CA effectiveness · Cost of quality · Cp vs Cpk vs Cpm · Cpk vs Ppk · CQE exam day tips · CQE study plan · CQE vs CQA vs CSSBB · Is the CQE worth it? · CUSUM & EWMA · Design reviews · Design V&V · Destructive testing · DFMEA vs PFMEA · Document control · Fault tree analysis · First article inspection · Fishbone diagram · FMEA: RPN vs AP · Full vs fractional factorial · Gage R&R · GD&T basics · Hazard vs risk vs harm · Hypothesis test selection · I-MR chart · Interaction plots · ISO 14971 · ISO 9001 clauses · Kaizen event planning · Kano model · Lean wastes (TIMWOODS) · Linear regression · Management review · MRB dispositions · MSA: bias, linearity & stability · NCR, CAPA & PA · Nonparametric tests · Normal distribution & z-table · One-way ANOVA · p-value explained · Pareto chart · PDCA vs DMAIC · Poka-yoke · QFD / House of Quality · Quality audits · Quality mgmt principles · Quality manual vs procedures · Quality plan vs control plan · Redundancy: parallel & standby · Reliability allocation · Bathtub curve & MTBF · Response surface methods · Risk-based thinking · Risk matrix vs FMEA · 7 mgmt & planning tools · Short-run SPC · Six Sigma certifications · Sigma level & DPMO · Six Sigma DMAIC · Supplier quality scorecards · Switching rules (sampling) · Taguchi loss function · Theory of constraints · Tolerance stackup · Traceability & lot control · Type I vs II error · Value stream mapping · Variables vs attributes · Weibull analysis · Western Electric rules · X-bar R vs X-bar S · CQE calculators · Study planner · Section quiz