3. Establish your risk management framework

Part 3 of ISO 14971 introduces the standard and discusses general
risk management requirements. These general requirements are
discussed in greater detail in Parts 4 to 9. It asks you to establish
a process that you can use to manage and control the risks
associated with your organization’s medical devices.

Part 3 also asks you to assign responsibility for risk management
and to ensure that all risk management personnel are competent. In
addition, it asks you to define a policy that governs and controls how
risk acceptability criteria are established and then asks you to use this
policy to establish risk acceptability criteria for each medical device.
Finally, it asks you to establish a risk management plan and to
maintain a risk management file for each medical device.

4. Perform a risk analysis for each medical device

Part 4 expects you to use your risk management file to document
the intended use of your medical device and to identify the product
characteristics that could affect safety. It then expects you to carry
out a risk analysis for each medical device by identifying hazards
and by estimating the risk for each hazardous situation.

5. Evaluate risk for each identified hazardous situation

Part 5 then wants you to evaluate risk for each hazardous situation.
It wants you to use your risk acceptability criteria to decide if risk
reduction is required.

6. Develop risk control measures when risk must be reduced

Part 6 then expects you to identify control measures that can reduce
your risk to an acceptable level and then to implement these measures
and to verify that they were in fact implemented. Once you’ve done this,
Part 6 wants you to use your risk acceptability criteria to evaluate
whether or not your residual risk is acceptable.

Whenever your residual risk is unacceptable and further risk control is
impractical, it wants you to determine whether or not the medical benefits
outweigh the residual risk (it wants you to do a risk-benefit analysis).
Part 6 also wants you to review your risk control measures to see if they
inadvertently introduce new hazards. It wants you to make sure that all
hazards and all identified hazardous situations have been considered.

7. Evaluate the overall residual risk posed by each device

Now that you’ve implemented and verified all risk control measures,
Part 7 expects you to evaluate the acceptability of your medical device’s
overall residual risk. If your overall residual risk is unacceptable, Part 7
expects you to use evidence to decide whether or not the medical benefits
actually outweigh the overall residual risks. If your overall residual risk is
unacceptable and if your overall residual risk outweighs the medical
benefits, then your medical device is not ready for the marketplace.

8. Review risk management process and prepare report

Part 8 asks you to carry out a risk management review and to
prepare a risk management report before you release your medical
device for commercial distribution. Part 8 wants you to review your risk
management plan, your overall residual risk, and both your production
and post-production information gathering methods and plans.

9. Monitor device during production and post-production

Lastly, Part 9 wants you to establish a system that you can use to
monitor your medical devices during production and post-production
phases. It then wants you to use your system to monitor your own
devices and all similar devices.