ISO 14971 Risk Management Worksheet with Risk Score
ISO 14971 requires you to identify hazards, estimate and evaluate risk, control it and show that residual risk is acceptable. This worksheet gives you a table that calculates a risk score before and after controls, so you can see where the work is.
| Hazard | Hazardous situation | Harm | Severity (1-5) | Probability (1-5) | Initial risk score | Risk control measure | Residual severity | Residual probability | Residual risk score | |
|---|---|---|---|---|---|---|---|---|---|---|
12 | 4 | |||||||||
12 | 8 | |||||||||
10 | 5 | |||||||||
6 | 2 | |||||||||
9 | 3 |
Severity and probability scales here are examples. ISO 14971 requires you to define your own risk acceptability criteria in the risk management plan, so replace the scales and the acceptable score with your own before using results for decisions.
Feed field data back into the risk file
Optional: a short review of linking complaint and CAPA trends in your ERP to risk file updates.
Optional. The tool and every export work without this. No spam.
How to use this worksheet
For each hazard, describe the hazardous situation and the harm, then score severity and probability from 1 to 5. The initial risk score is severity multiplied by probability. Add the risk control measure, then re-score the residual severity and probability. Compare the residual score with the acceptability criteria in your risk management plan. Export to Excel for review and add rows until all hazards for all life cycle stages are covered.
- Chain hazard, sequence of events, hazardous situation, harm
- Rate probability of harm, not only of the failure
- Control by design first, protective measures second, information last
- Re-score after controls are verified, not when planned
What ISO 14971 asks for
The 2019 edition of ISO 14971 requires a risk management plan, hazard identification, estimation and evaluation of risk, risk control with verification of effectiveness, evaluation of overall residual risk, a risk management review before release, and production and post-production activities. Risk control follows an order of priority: inherently safe design, protective measures in the device or process, and information for safety. The benefit-risk analysis applies when residual risk is not acceptable by the criteria but benefits may outweigh it.
Reading the scores
A score is only meaningful against criteria you set. A common approach is a 5 by 5 matrix with an acceptable zone, a zone needing risk reduction as far as possible, and an unacceptable zone. In the example, software dose error starts at 10 and drops to 5 after controls. Severity rarely changes with controls, so most reductions come from lowering probability. If severity is 5, expect extra scrutiny whatever the probability.
Common mistakes
Typical problems are a worksheet that stops at design and ignores production and use, controls that only add warnings to the manual, residual scores lowered with no verification evidence, and no link between complaints and the risk file. Treat the file as living: feed complaint, CAPA and field data back into the hazard analysis and review it on a schedule.
Frequently Asked Questions
What is the difference between hazard, hazardous situation and harm?
A hazard is a potential source of harm, such as electrical energy. A hazardous situation is circumstances where people are exposed to the hazard. Harm is the injury or damage to health that results.
Is this the same as an FMEA?
No, though they are related. ISO 14971 analysis is centered on hazards, harms and patient safety. FMEA looks at failure modes of components or processes and can feed the risk file as one of several methods.
What risk matrix should I use?
ISO 14971 does not prescribe one. Define severity and probability scales and acceptability criteria in your risk management plan, justify them, and apply them consistently across all devices of the same type.
How often should the risk file be updated?
Whenever design, process, use or field information changes, and on a scheduled review. Production and post-production information such as complaints and vigilance data must feed back into the file.
If your complaint, nonconformance and CAPA data sit in an ERP or QMS, Netray can help surface trends that should update the risk file, with a quality engineer making the decisions.
Related Tools
Design History File Index Template
An editable index of the records that make up a medical device design history file, with status, owner and review date for each document.
Quality & InspectionMedical Device Complaint Handling Form Template
A complaint intake and investigation form for medical devices, covering product details, event description, reportability assessment and closure.
Quality & InspectionProcess Validation IQ OQ PQ Template
Fill in process, equipment and acceptance details and export an IQ OQ PQ protocol outline with test tables and approval signatures.
Quality & InspectionISO 13485 Internal Audit Checklist
A clause-organized checklist for auditing a medical device quality management system against ISO 13485:2016, with critical items flagged.
More Quality & Inspection tools
See all- CAPA Corrective and Preventive Action Form Template
- Device History Record (DHR) Template
- Sterilization Load Record Template
- Medical Device Design Verification Protocol Template
- Medical Device Supplier Evaluation Scoring Worksheet
- Medical Device Cleanroom Environmental Monitoring Log
- Medical Device Accelerated Aging Calculator (ASTM F1980)
- Medical Device Success Run Validation Sample Size Calculator
- Sterilization D-Value and SAL Log Reduction Calculator