Risk Management (ISO 14971)

ISO 14971:2019 is the foundational standard for medical device risk management, required by FDA, the EU MDR, and virtually every national regulatory framework worldwide. A compliant risk management process is not optional — it is the lens through which all other regulatory decisions are made.

At Software Quality Guru, we guide clients through the complete risk management lifecycle: Risk Management Plan, Risk Analysis (hazard identification, hazardous situation mapping, harm identification), Risk Evaluation, Risk Control, and Residual Risk determination.

We apply ISO 14971 in conjunction with IEC 62366-1 (usability), IEC 62304 (software), and IEC 80001-1 (IT network risk) where applicable to provide an integrated risk picture.

Effective hazard analysis requires structured creativity — systematically exploring all foreseeable misuse scenarios, environmental conditions, and failure modes that could lead to harm.

Our methodology draws on SFMEA (System FMEA), DFMEA (Design FMEA), Process FMEA, and Hazard and Operability (HAZOP) studies adapted for medical device contexts.

We work with your cross-functional team — clinical, engineering, regulatory, and quality — to build a comprehensive hazard catalog that reflects real-world clinical use environments.

Failure Mode and Effects Analysis (FMEA) and Fault Tree Analysis (FTA) are the two most common quantitative risk tools in the medical device industry. We conduct both bottom-up (FMEA) and top-down (FTA) analyses to triangulate failure probability estimates.

For software-intensive devices, we extend FMEA to cover software failure modes per IEC 62304 Annex B, linking software anomalies to system-level hazardous situations.

When quantitative probability data is unavailable (common for novel devices), we apply defensible qualitative severity and probability scales with documented rationale — a practice FDA reviewers accept when justified.

ISO 14971 Clause 9 requires that residual risks — both individual and aggregate — be evaluated against the clinical benefits of the device. This risk-benefit determination must be explicitly documented and defensible.

We help clients articulate the clinical value proposition in language that aligns with ISO 14971 and FDA's benefit-risk framework (21 CFR Part 860 for PMA devices), ensuring consistency across your risk management file, clinical evaluation, and regulatory submission.

For novel or high-risk devices, we can support Pre-Sub meetings with FDA to align on acceptable risk acceptance criteria before significant investment in clinical evidence generation.