Risk Management Teams in Medical-device Development

The risk-management team’s role

Risk specialists provide process expertise, facilitation, challenge and coherence. They help multidisciplinary teams reason from hazards through sequences of events to hazardous situations, harms and controls. They do not own every risk or replace the technical and clinical experts who understand the product.

Establish governance before scoring risks

The risk-management plan should define scope, responsibilities, competent participants, review points, acceptability criteria, verification arrangements, overall residual-risk evaluation and methods for collecting production and post-production information. Criteria must reflect the manufacturer’s policy and applicable regulations; a project team should not adjust thresholds to make an uncomfortable result acceptable.

Use MTL-114 — Medical-device Risk Management and MTL-311 — ISO 14971 Risk Management as the process foundations.

Analyse how harm can occur

Start with intended purpose, reasonably foreseeable misuse, characteristics related to safety, known hazards and clinical context. Develop credible sequences of events that lead to hazardous situations and harms. Estimate risk using available evidence and explicit assumptions. Techniques such as preliminary hazard analysis, FMEA, fault trees, use-related analysis and threat modelling are complementary views—not substitutes for the complete risk process.

Keep system-level reasoning connected to MTL-105 — Systems Engineering, Architecture and Interfaces.

Drive controls into the design

• Prefer inherent safety by design where practicable.
• Use protective measures in the device or manufacturing process next.
• Use information for safety for residual risk that cannot be adequately controlled otherwise.
• Define each selected measure as a testable requirement.
• Verify implementation and effectiveness.
• Assess whether the control introduces new hazards or changes existing risk.
• Re-evaluate residual risk using the approved criteria.

A warning is not a convenient replacement for feasible design control. Risk specialists should challenge weak control choices and record the rationale for decisions.

Maintain a connected risk-control chain

The chain should link into approved design inputs, outputs, verification and residual-risk conclusions. A risk file full of cross-references is useful only when those references resolve to controlled evidence.

Integrate specialist risk analyses

Electrical, mechanical, software, usability, biological, clinical, privacy and cybersecurity specialists may use different methods and terminology. The central risk process must integrate their safety conclusions, dependencies and controls. Avoid isolated “risk files” that never reconcile at system level.

In particular, connect safety and security through MTL-109 — Medical-device Cybersecurity and user interaction through MTL-110 — Usability and Human Factors.

Review risk at decision points

Risk review should ask whether the analysis reflects the current design and intended use, controls are implemented and effective, residual risks meet criteria, new risks have been assessed, and unresolved evidence could change the conclusion. Conduct reviews before architecture commitment, formal verification, transfer, release and significant lifecycle change—not only when the risk report needs approval.

Use benefit–risk analysis carefully

Benefit–risk analysis is not permission to avoid practicable controls. Use it when required after risk-control options have been applied, drawing on credible clinical benefit and residual-risk evidence. State the affected population, magnitude and probability of benefit, nature of harm, uncertainty, alternatives and supporting information. Overall residual-risk evaluation then considers the device as a whole.

Make the risk file learn from production and use

Define sources such as nonconformities, supplier issues, process trends, complaints, vigilance, service records, cybersecurity vulnerabilities, literature and comparable devices. Assess relevance, emerging hazards, changed probability or severity, control effectiveness and benefit–risk conclusions. Feed actions into CAPA, change control, labelling, field action and future design.

Connect this loop to MTL-127 — Post-market Support.

Communicate risk so people can make decisions

Use concise system views, clear assumptions and decision-focused summaries alongside detailed analyses. Escalate unacceptable risk, missing controls and material uncertainty plainly. Avoid presenting a single risk number without the hazardous sequence, harm, evidence and control context needed to interpret it.

Common misconceptions