risk-management-specialist – Data & Science skill for AI agents

Risk Management Specialist

ISO 14971:2019 risk management implementation throughout the medical device lifecycle.

---

Table of Contents

• [Risk Management Planning Workflow](#risk-management-planning-workflow)
• [Risk Analysis Workflow](#risk-analysis-workflow)
• [Risk Evaluation Workflow](#risk-evaluation-workflow)
• [Risk Control Workflow](#risk-control-workflow)
• [Post-Production Risk Management](#post-production-risk-management)
• [Risk Assessment Templates](#risk-assessment-templates)
• [Decision Frameworks](#decision-frameworks)
• [Tools and References](#tools-and-references)

---

Risk Management Planning Workflow

Establish risk management process per ISO 14971.

Workflow: Create Risk Management Plan

1. Define scope of risk management activities:

• Medical device identification
• Lifecycle stages covered
• Applicable standards and regulations

2. Establish risk acceptability criteria:

• Define probability categories (P1-P5)
• Define severity categories (S1-S5)
• Create risk matrix with acceptance thresholds

3. Assign responsibilities:

• Risk management lead
• Subject matter experts
• Approval authorities

4. Define verification activities:

• Methods for control verification
• Acceptance criteria

5. Plan production and post-production activities:

• Information sources
• Review triggers
• Update procedures

6. Obtain plan approval

7. Establish risk management file

8. Validation: Plan approved; acceptability criteria defined; responsibilities assigned; file established

Risk Management Plan Content

| Section | Content | Evidence |

|---------|---------|----------|

| Scope | Device and lifecycle coverage | Scope statement |

| Criteria | Risk acceptability matrix | Risk matrix document |

| Responsibilities | Roles and authorities | RACI chart |

| Verification | Methods and acceptance | Verification plan |

| Production/Post-Production | Monitoring activities | Surveillance plan |

Risk Acceptability Matrix (5x5)

| Probability \ Severity | Negligible | Minor | Serious | Critical | Catastrophic |

|------------------------|------------|-------|---------|----------|--------------|

| Frequent (P5) | Medium | High | High | Unacceptable | Unacceptable |

| Probable (P4) | Medium | Medium | High | High | Unacceptable |

| Occasional (P3) | Low | Medium | Medium | High | High |

| Remote (P2) | Low | Low | Medium | Medium | High |

| Improbable (P1) | Low | Low | Low | Medium | Medium |

Risk Level Actions

| Level | Acceptable | Action Required |

|-------|------------|-----------------|

| Low | Yes | Document and accept; still reduce as far as possible (EU MDR) |

| Medium | After reduction AFAP | Reduce as far as possible; document why further reduction is impossible |

| High | After reduction AFAP | Reduction required; demonstrate all further options exhausted |

| Unacceptable | No | Design change mandatory |

> EU MDR — AFAP, not ALARP: For CE-marked devices, risks must be reduced as far as possible (AFAP) without economic considerations (MDR Annex I, GSPR 1–4; EN ISO 14971:2019/A11:2021 Z-annexes deviation). ALARP ("as low as reasonably practicable"), which permits cost-benefit weighing in acceptability decisions, is not an acceptable criterion under the EU MDR — a notified body will flag it. ISO 14971:2019 itself removed ALARP from the normative text. ALARP may persist in some non-EU jurisdictions (e.g., the UK HSE tradition); if used outside the EU, flag the deviation from EU requirements explicitly.

---

Risk Analysis Workflow

Identify hazards and estimate risks systematically.

Workflow: Conduct Risk Analysis

1. Define intended use and reasonably foreseeable misuse:

• Medical indication
• Patient population
• User population
• Use environment

2. Select analysis method(s):

• FMEA for component/function analysis
• FTA for system-level analysis
• HAZOP for process deviations
• Use Error Analysis for user interaction

3. Identify hazards by category:

• Energy hazards (electrical, mechanical, thermal)
• Biological hazards (bioburden, biocompatibility)
• Chemical hazards (residues, leachables)
• Operational hazards (software, use errors)

4. Determine hazardous situations:

• Sequence of events
• Foreseeable misuse scenarios
• Single fault conditions

5. Estimate probability of harm (P1-P5)

6. Estimate severity of harm (S1-S5)

7. Document in hazard analysis worksheet

8. Validation: All hazard categories addressed; all hazards documented; probability and severity assigned

Hazard Categories Checklist

| Category | Examples | Analyzed |

|----------|----------|----------|

| Electrical | Shock, burns, interference | ☐ |

| Mechanical | Crushing, cutting, entrapment | ☐ |

| Thermal | Burns, tissue damage | ☐ |

| Radiation | Ionizing, non-ionizing | ☐ |

| Biological | Infection, biocompatibility | ☐ |

| Chemical | Toxicity, irritation | ☐ |

| Software | Incorrect output, timing | ☐ |

| Use Error | Misuse, perception, cognition | ☐ |

| Environment | EMC, mechanical stress | ☐ |

Analysis Method Selection

| Situation | Recommended Method |

|-----------|-------------------|

| Component failures | FMEA |

| System-level failure | FTA |

| Process deviations | HAZOP |

| User interaction | Use Error Analysis |

| Software behavior | Software FMEA |

| Early design phase | PHA |

Probability Criteria

| Level | Name | Description | Frequency |

|-------|------|-------------|-----------|

| P5 | Frequent | Expected to occur | >10⁻³ |

| P4 | Probable | Likely to occur | 10⁻³ to 10⁻⁴ |

| P3 | Occasional | May occur | 10⁻⁴ to 10⁻⁵ |

| P2 | Remote | Unlikely | 10⁻⁵ to 10⁻⁶ |

| P1 | Improbable | Very unlikely | <10⁻⁶ |

Severity Criteria

| Level | Name | Description | Harm |

|-------|------|-------------|------|

| S5 | Catastrophic | Death | Death |

| S4 | Critical | Permanent impairment | Irreversible injury |

| S3 | Serious | Injury requiring intervention | Reversible injury |

| S2 | Minor | Temporary discomfort | No treatment needed |

| S1 | Negligible | Inconvenience | No injury |

See: [references/risk-analysis-methods.md](references/risk-analysis-methods.md)

---

Risk Evaluation Workflow

Evaluate risks against acceptability criteria.

Workflow: Evaluate Identified Risks

1. Calculate initial risk level from probability × severity

2. Compare to risk acceptability criteria

3. For each risk, determine:

• Acceptable: Document and accept (EU MDR: still reduce as far as possible)
• Reduction required (AFAP): Proceed to risk control
• Unacceptable: Mandatory risk control

4. Document evaluation rationale

5. Identify risks requiring benefit-risk analysis

6. Complete benefit-risk analysis if applicable

7. Compile risk evaluation summary

8. Validation: All risks evaluated; acceptability determined; rationale documented

Risk Evaluation Decision Tree

Risk Estimated
      │
      ▼
Apply Acceptability Criteria
      │
      ├── Low Risk ──────────► Accept and document
      │
      ├── Medium Risk ───────► Reduce as far as possible (AFAP)
      │   │                    Document why further reduction impossible
      │   ▼
      │   Further reduction possible?
      │   │
      │   Yes──► Implement control
      │   No───► Document AFAP rationale (no economic considerations)
      │
      ├── High Risk ─────────► Risk reduction required
      │   │                    Must demonstrate reduction AFAP
      │   ▼
      │   Implement control
      │   Verify residual risk
      │
      └── Unacceptable ──────► Design change mandatory
                               Cannot proceed without control

AFAP Demonstration Requirements (EU MDR)

| Criterion | Evidence Required |

|-----------|-------------------|

| All control options considered | Analysis of every feasible control per the hierarchy (design, protective measures, information) |

| Further reduction impossible | Evidence each remaining option is technically infeasible or does not further reduce risk |

| State of the art | Comparison to similar devices and current standards |

| Stakeholder input | Clinical/user perspectives |

> Economic considerations (cost of further risk reduction) must not enter the EU acceptability decision (MDR Annex I GSPR 2; EN ISO 14971:2019/A11:2021). Cost may inform business decisions about whether to market the device — never whether a risk is acceptable.

Benefit-Risk Analysis Triggers

| Situation | Benefit-Risk Required |

|-----------|----------------------|

| Residual risk remains high | Yes |

| No feasible risk reduction | Yes |

| Novel device | Yes |

| Unacceptable risk with clinical benefit | Yes |

| All risks low | No |

---

Risk Control Workflow

Implement and verify risk control measures.

Workflow: Implement Risk Controls

1. Identify risk control options:

• Inherent safety by design (Priority 1)
• Protective measures in device (Priority 2)
• I

… (full content is in the download package)