This document summarizes ISO 14971, the international standard for medical device risk management. It outlines the key aspects of ISO 14971, including the purpose to help manufacturers identify hazards, estimate risks, and implement risk controls. The summary explains the main clauses of ISO 14971 and the overall risk management process of identifying hazards, estimating risks, evaluating and controlling risks, and monitoring risk controls.

1. Presented by:
Atul S. Bhombe
M. Pharmacy ⅠⅠ Sem. ( Drug Regulatory Affairs)
Savitribai Phule Pune University, Pune
Sanjivani college of Pharmacy Education & Research,
Kopargaon, Dist Ahmadnagar, MH

3.  The purpose of Risk Management is to achieve is to achieve safety.
 In technical term : Identification, Assessment, and Prioritization of
Risks.
 ISO 14971 was developed because no standard existed at the time
and because regulators throughout the world wanted manufacturers
to apply risk management to their medical devices.
 ISO 14971:2019 provides internationally recognized methods to
reduce risk for all stakeholders. Adopting this standard early in the
planning process will support you in ensuring that your medical
device is compliant with EU Regulations and in bringing your
medical device to the global market efficiently and safely.

4.  The purpose of ISO 14971 is to help manufacturers to establish a
medical device risk management process that can be used to
identify hazards, to estimate and evaluate risks, and to implement
and monitor the effectiveness of risk control measures.
IDENTIFY
ESTIMATE &
EVALUATE
CONTROL
MONITOR

5. 2000
1st
Edition
2007
2nd
Edition
2012
EU
Harmonized
2019
3rd
Edition

6. Clause ISO 14971:2019
1. Scope
2. Normative References
3. Terms and definitions
4. General requirements for risk management
5. Risk analysis
6. Risk evaluation
7. Risk control
8. Evaluation of overall residual risk
9. Risk management review
10. Production and post-production activities

8.  This document specifies terminology, principles and
a process for risk management of medical devices, including
software as a medical device and in vitro diagnostic medical
devices.
 The process described in this document intends to
assist manufacturers of medical devices to identify
the hazards associated with the medical device, to estimate and
evaluate the associated risks, to control these risks, and to
monitor the effectiveness of the controls.

9.  Risk is the combination of the probability of
occurrence of harm and the severity of that harm.
 Harm: injury or damage to the health of people, or
damage to property or the environment
 Hazard is a potential source of harm.
 Hazardous situation is a circumstance that exposes
people, property or environment to one or more
hazards.
 Severity (damage) as a "measure of the potential
impact of a hazard".

10.  Risk management process
 Competence of personnel (Qualified of personnel )
 Risk management plan
 Risk management file ( Record)
 Any medical device’s risk management process starts with
planning the activities to be carried out. This document serves
as a roadmap for risk activities. It also includes the criteria for
risk acceptability, which will help the evaluation of risks later
on in the process.
 This risk management plan should be reviewed at the final
stages of design & development before the product is
commercially distributed

12.  Systematic use of available information to
identify hazards and to estimate the risk.
 Risk Analysis Process-

13.  Intended use and reasonably foreseeable misuse
 Identification of characteristics related to safety
 Identification of hazards and hazardous situations
 Risk estimation

14.  Using the criteria for risk acceptability defined in the risk
management plan, the manufacturer or developer must
evaluate the estimated risks and determine if the risk is
acceptable or not.
 There are some common tools that can be used to evaluate
risks, including (but not limited to) Failure Mode and Effects
Analysis, Fault Tree Analysis, and Hazard Analysis.

16.  Once the manufacturer and developer have identified the risks,
analyzed their severity, and assessed their likelihood to occur,
the risk control activity must be conducted to confront the
questions including:
Can we reduce the risk?
What is the best way to do it?
Did the risk control work?
Is the residual risk acceptable?

17.  Residual risk is the risk left over after you’ve taken risk control
measures.
 Once the individual risks are identified and controlled to an
acceptable level, the manufacturer/developer must evaluate the
overall residual risk acceptability of the medical device as whole
using the same risk evaluation criteria.
 If it is determined that the residual risk is not acceptable, benefit-
risk analysis should be conducted and identify whether or not the
medical benefits of the medical device outweighs the residual
risks.

18.  In this edition, overall residual risk evaluation is a one-step
process that takes into account all individual risks, and the
overall risk level is evaluated against the medical device’s
intended use. Naturally, the entire evaluation process (including
the method and the criteria for acceptability, as well as the
overall residual risk) will need to be documented thoroughly.

19.  Before entering the product in the market for use, the results of
all the risk management process must be reviewed by the
executive management for its completeness. This report
should also include the plan for evaluation of risks in
production and post-production.
 The output of this step is a risk management report. This
report documents that the risk management plan was executed,
and verifies that its objectives were achieved (including
production and post-production activities

20.  Medical device manufacturers and developers must have a
process for documenting all the production and post-production
related activities and events.
 They should be continuously observing the product in the
market, analyzing hazards, and updating the risk acceptance
criteria. Various aspects that are required to be tied into the risk
management includes complaints, customer feedback, non-
conformance and CAPAs.
 You will need to review all the information that’s deemed
relevant to the safety of your medical device for correctness and
take action if necessary. Specifically, you will need to review the
risk management file to determine whether new risks need to be
taken into account, or whether the reassessment of previously
identified risks is warranted.

21.  ISO 14971 is widely recognized as the official standard for medical
device risk management.
 It has been officially recognized by the U.S. FDA and by Health
Canada.
 In addition, the European Union has adopted it as a harmonized
standard and Australia and Japan have accepted it as the official
standard for medical device risk management.
 Medical device risk management is now mandatory in most countries
and regions of the world. Every regulated medical device manufacturer
now needs to be able to prove to regulators that they use risk
management methods to control risk and to ensure that their products
are safe.

22.  ISO 14971 does not expect medical device manufacturers to
become certified. You can simply use the standard to manage risk
and then declare that you are in compliance
 However, regulators may require certification and your
customers may be more impressed if an independent registrar
(certification body) has confirmed that you use the standard to
manage risk and that you actually are in compliance.
 While ISO 14971 does not expect you to become certified,
several major registrars now offer certification services. Some of
these include BSI, Underwriters Laboratories,
INTERINTERTEK, and SGS

23. 1) https://www.bsigroup.com/globalassets/meddev/localfiles/it-
it/webinars/bsi-md-risk-management-for-medical-devices-
webinar-131119-uk-en.pdf
2) https://www.iso.org/obp/ui/#iso:std:iso:14971:ed-3:v1:en
3) https://content.intland.com/blog/medical-device-risk-
management-updates-what-is-new-in-iso-149712019
4) https://simbex.com/iso14971/