ISO 13485 · Expert · 15 min lesson
Auditing the ISO 14971 risk management file
ISO 14971:2019 clauses 4 to 10, ISO/TR 24971:2020, ISO 13485:2016 clauses 4.1.2, 7.1 and 8.2, MDR Annex I section 3
What you will learn
- Audit the risk management plan, hazard analysis, risk control and benefit-risk evaluation against ISO 14971:2019.
- Audit the production and post-production information loops that keep the risk file alive.
- Use ISO/TR 24971:2020 guidance to judge whether a method is adequate without treating the guidance as a requirement.
Key takeaways
- ISO 14971:2019 clause 4.4 requires a risk management plan covering all life cycle phases, with criteria for risk acceptability.
- Hazard analysis under clause 5 starts from intended use and reasonably foreseeable misuse and links hazards to hazardous situations and harms.
- Risk control under clause 7 needs verified implementation and effectiveness, residual risk evaluation and a check for new risks created by controls.
- Clause 8 requires an overall residual risk evaluation and clause 9 a review before release; clause 10 keeps the file alive after release.
- ISO/TR 24971:2020 is guidance, not a requirement; auditors use it to judge adequacy, not to raise findings on its wording.
Free practice question
Marlowe's plan RMP-01 says 'applies during design and development'. The pump has been on sale for two years.
What is the finding?
No finding, because design is the key phase.
Not quite. Clause 4.4 requires a plan that covers life cycle phases beyond design, including clause 10 activities.
The plan does not cover all life cycle phases or the production and post-production activities that clause 4.4 requires.
Correct. A marketed device needs a plan that continues after design. This reading follows the clause structure of ISO 14971:2019 and the guidance in ISO/TR 24971:2020.
A finding against the design lead only.
Not quite. The finding is on the plan content under clause 4.4, not on a person.
No finding, because the plan is approved.
Not quite. Approval does not fix missing content required by clause 4.4. This reading follows the clause structure of ISO 14971:2019 and the guidance in ISO/TR 24971:2020.
Key terms
- risk management file: The set of records and other documents produced by risk management, required by clause 4.5 of ISO 14971:2019.
- hazardous situation: A circumstance in which people, property or the environment are exposed to one or more hazards.
- residual risk: The risk remaining after risk control measures have been implemented.
- risk acceptability criteria: The manufacturer's defined criteria, set in the plan, for deciding whether a risk is acceptable.
- benefit-risk analysis: A comparison of the medical benefits of the intended use with the residual risk, used when a risk is not acceptable by the criteria.
- post-production information: Information gathered after design from production, users, the supply chain and the market, reviewed under clause 10.
Official sources
- ISO - ISO 14971:2019 Medical devices, Application of risk management to medical devices
- ISO - ISO/TR 24971:2020 Medical devices, Guidance on the application of ISO 14971
- FDA - Quality Management System Regulation (QMSR) overview
- Regulation (EU) 2017/745 on medical devices (MDR), EUR-Lex
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.