ISO 13485 from zero, episode three: risk management that runs through every process.

Why is risk more than a register?

This is episode three of ISO 13485 from zero. With the scope and the documents in place, we turn to risk management. In a medical device company, risk is not a register you update once a year. It runs through every process, and auditors expect to see it there.

What are the two kinds of risk?

ISO 13485 asks for a risk-based approach to controlling the processes of the quality system, such as how tightly you control a supplier or how much validation a piece of software needs. Separately, product risk management, under ISO 14971, deals with the risks the device itself poses to patients, users and others. Many companies blur the two and end up with a business risk register that says nothing about device safety. You need both, and they should be clearly distinct.

How do you plan product risk management?

Begin with a risk management plan for each device or family. It sets the scope, the lifecycle stages covered, who is responsible, how risks will be estimated and evaluated, and the criteria for deciding whether a risk is acceptable. Those criteria must come from your policy for risk acceptability, approved by top management. Without written criteria, every decision about acceptable risk becomes an argument.

How do you work from hazards to harms?

Identify the characteristics of the device that could affect safety, and the hazards that follow. Then think through the sequences of events that could lead from each hazard to a hazardous situation and then to harm. Estimate the probability and the severity of each harm, using real information where you have it: complaints about similar devices, published data, your own test results.

Template for this step: the risk management plan, hazard register and report templates are in the ISO 14971 Risk Management File Kit ($129).

How do you control and verify risk?

Where a risk is not acceptable, reduce it in a fixed order of priority: first inherently safe design, then protective measures in the device or the manufacturing process, then information for safety such as warnings and instructions. Labelling alone is the last resort, not the first. Verify that each control was implemented and that it works, evaluate the residual risk, and finally the overall residual risk against the benefits of the device.

How do you put risk into the other processes?

Design inputs should include risk controls. Supplier control should be proportionate to the risk a supplier's product carries. Process validation should focus on the processes where failure creates harm. Complaints and corrective actions should check whether they reveal new hazards or a higher frequency of harm. When every procedure asks whether it affects the risk file, the file stays alive.

The ISO 14971 Risk Management File Kit takes you from plan to report, with linked registers and workbooks. Previously: the quality manual and document control. Next episode: design controls.