# ISO 14971 Risk Management Worksheet with Risk Score > Source: https://netray.co/tools/iso-14971-risk-management-worksheet > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer An editable hazard analysis table that scores initial and residual risk from severity and probability and exports to Excel. ## Category quality ## Industry Medical Devices ## Audience - Quality engineer - R&D engineer - Regulatory affairs ## Tool **Kind:** worksheet **Mode:** editable **Columns:** #### Hazard **Key:** hazard **Type:** text #### Hazardous situation **Key:** situation **Type:** text #### Harm **Key:** harm **Type:** text #### Severity (1-5) **Key:** sev **Type:** number **Help:** 1 negligible, 2 minor, 3 serious, 4 critical, 5 catastrophic #### Probability (1-5) **Key:** prob **Type:** number **Help:** 1 improbable, 2 remote, 3 occasional, 4 probable, 5 frequent #### Initial risk score **Key:** score **Type:** number **Expr:** sev * prob **Format:** integer #### Risk control measure **Key:** control **Type:** text #### Residual severity **Key:** rsev **Type:** number #### Residual probability **Key:** rprob **Type:** number #### Residual risk score **Key:** rscore **Type:** number **Expr:** rsev * rprob **Format:** integer **Rows:** **Hazard:** Electrical energy **Situation:** Leakage current reaches patient during use **Harm:** Burn or shock **Sev:** 4 **Prob:** 3 **Control:** Isolation design, leakage test at 100 percent in production **Rsev:** 4 **Rprob:** 1 **Hazard:** Biological contamination **Situation:** Sterile barrier breached in transit **Harm:** Infection **Sev:** 4 **Prob:** 3 **Control:** Validated packaging and shipping test, sterile barrier inspection **Rsev:** 4 **Rprob:** 2 **Hazard:** Software fault **Situation:** Dose entry displayed incorrectly **Harm:** Overdose **Sev:** 5 **Prob:** 2 **Control:** Input range limits, second display check, software verification **Rsev:** 5 **Rprob:** 1 **Hazard:** Mechanical failure **Situation:** Screw head strips during insertion **Harm:** Delay in surgery **Sev:** 2 **Prob:** 3 **Control:** Drive geometry change, torque limit in IFU **Rsev:** 2 **Rprob:** 1 **Hazard:** Use error **Situation:** Wrong connector fitted **Harm:** Interruption of therapy **Sev:** 3 **Prob:** 3 **Control:** Keyed connector, color coding, usability validation **Rsev:** 3 **Rprob:** 1 **Totals:** #### Highest initial risk score **Key:** score **Agg:** max **Format:** integer #### Highest residual risk score **Key:** rscore **Agg:** max **Format:** integer #### Hazards analyzed **Key:** hazard **Agg:** count **Format:** integer **Notes:** Severity and probability scales here are examples. ISO 14971 requires you to define your own risk acceptability criteria in the risk management plan, so replace the scales and the acceptable score with your own before using results for decisions. ## Content **Intro:** ISO 14971 requires you to identify hazards, estimate and evaluate risk, control it and show that residual risk is acceptable. This worksheet gives you a table that calculates a risk score before and after controls, so you can see where the work is. **Sections:** #### How to use this worksheet **Body:** For each hazard, describe the hazardous situation and the harm, then score severity and probability from 1 to 5. The initial risk score is severity multiplied by probability. Add the risk control measure, then re-score the residual severity and probability. Compare the residual score with the acceptability criteria in your risk management plan. Export to Excel for review and add rows until all hazards for all life cycle stages are covered. **Bullets:** - Chain hazard, sequence of events, hazardous situation, harm - Rate probability of harm, not only of the failure - Control by design first, protective measures second, information last - Re-score after controls are verified, not when planned #### What ISO 14971 asks for **Body:** The 2019 edition of ISO 14971 requires a risk management plan, hazard identification, estimation and evaluation of risk, risk control with verification of effectiveness, evaluation of overall residual risk, a risk management review before release, and production and post-production activities. Risk control follows an order of priority: inherently safe design, protective measures in the device or process, and information for safety. The benefit-risk analysis applies when residual risk is not acceptable by the criteria but benefits may outweigh it. #### Reading the scores **Body:** A score is only meaningful against criteria you set. A common approach is a 5 by 5 matrix with an acceptable zone, a zone needing risk reduction as far as possible, and an unacceptable zone. In the example, software dose error starts at 10 and drops to 5 after controls. Severity rarely changes with controls, so most reductions come from lowering probability. If severity is 5, expect extra scrutiny whatever the probability. #### Common mistakes **Body:** Typical problems are a worksheet that stops at design and ignores production and use, controls that only add warnings to the manual, residual scores lowered with no verification evidence, and no link between complaints and the risk file. Treat the file as living: feed complaint, CAPA and field data back into the hazard analysis and review it on a schedule. **Cta:** If your complaint, nonconformance and CAPA data sit in an ERP or QMS, Netray can help surface trends that should update the risk file, with a quality engineer making the decisions. **Faq:** #### What is the difference between hazard, hazardous situation and harm? **Answer:** A hazard is a potential source of harm, such as electrical energy. A hazardous situation is circumstances where people are exposed to the hazard. Harm is the injury or damage to health that results. #### Is this the same as an FMEA? **Answer:** No, though they are related. ISO 14971 analysis is centered on hazards, harms and patient safety. FMEA looks at failure modes of components or processes and can feed the risk file as one of several methods. #### What risk matrix should I use? **Answer:** ISO 14971 does not prescribe one. Define severity and probability scales and acceptability criteria in your risk management plan, justify them, and apply them consistently across all devices of the same type. #### How often should the risk file be updated? **Answer:** Whenever design, process, use or field information changes, and on a scheduled review. Production and post-production information such as complaints and vigilance data must feed back into the file. ## Search terms ISO 14971 risk management worksheet, ISO 14971 risk assessment template excel, medical device hazard analysis template, risk management file template, severity probability risk matrix medical device, residual risk evaluation, FMEA for medical devices, ISO 14971:2019 template --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json