ISO 14971 Risk Management Worksheet with Risk Score
ISO 14971 requires you to identify hazards, estimate and evaluate risk, control it and show that residual risk is acceptable. This worksheet gives you a table that calculates a risk score before and after controls, so you can see where the work is.
| Hazard | Hazardous situation | Harm | Severity (1-5) | Probability (1-5) | Initial risk score | Risk control measure | Residual severity | Residual probability | Residual risk score | |
|---|---|---|---|---|---|---|---|---|---|---|
12 | 4 | |||||||||
12 | 8 | |||||||||
10 | 5 | |||||||||
6 | 2 | |||||||||
9 | 3 |
Severity and probability scales here are examples. ISO 14971 requires you to define your own risk acceptability criteria in the risk management plan, so replace the scales and the acceptable score with your own before using results for decisions.
Feed field data back into the risk file
Optional: a short review of linking complaint and CAPA trends in your ERP to risk file updates.
Optional. The tool and every export work without this. No spam.
How to use this worksheet
For each hazard, describe the hazardous situation and the harm, then score severity and probability from 1 to 5. The initial risk score is severity multiplied by probability. Add the risk control measure, then re-score the residual severity and probability. Compare the residual score with the acceptability criteria in your risk management plan. Export to Excel for review and add rows until all hazards for all life cycle stages are covered.
- Chain hazard, sequence of events, hazardous situation, harm
- Rate probability of harm, not only of the failure
- Control by design first, protective measures second, information last
- Re-score after controls are verified, not when planned
What ISO 14971 asks for
The 2019 edition of ISO 14971 requires a risk management plan, hazard identification, estimation and evaluation of risk, risk control with verification of effectiveness, evaluation of overall residual risk, a risk management review before release, and production and post-production activities. Risk control follows an order of priority: inherently safe design, protective measures in the device or process, and information for safety. The benefit-risk analysis applies when residual risk is not acceptable by the criteria but benefits may outweigh it.
Reading the scores
A score is only meaningful against criteria you set. A common approach is a 5 by 5 matrix with an acceptable zone, a zone needing risk reduction as far as possible, and an unacceptable zone. In the example, software dose error starts at 10 and drops to 5 after controls. Severity rarely changes with controls, so most reductions come from lowering probability. If severity is 5, expect extra scrutiny whatever the probability.
Common mistakes
Typical problems are a worksheet that stops at design and ignores production and use, controls that only add warnings to the manual, residual scores lowered with no verification evidence, and no link between complaints and the risk file. Treat the file as living: feed complaint, CAPA and field data back into the hazard analysis and review it on a schedule.
Frequently Asked Questions
What is the difference between hazard, hazardous situation and harm?
A hazard is a potential source of harm, such as electrical energy. A hazardous situation is circumstances where people are exposed to the hazard. Harm is the injury or damage to health that results.
Is this the same as an FMEA?
No, though they are related. ISO 14971 analysis is centered on hazards, harms and patient safety. FMEA looks at failure modes of components or processes and can feed the risk file as one of several methods.
What risk matrix should I use?
ISO 14971 does not prescribe one. Define severity and probability scales and acceptability criteria in your risk management plan, justify them, and apply them consistently across all devices of the same type.
How often should the risk file be updated?
Whenever design, process, use or field information changes, and on a scheduled review. Production and post-production information such as complaints and vigilance data must feed back into the file.
If your complaint, nonconformance and CAPA data sit in an ERP or QMS, Netray can help surface trends that should update the risk file, with a quality engineer making the decisions.
Related Tools
Design History File Index Template
An editable index of the records that make up a medical device design history file, with status, owner and review date for each document.
Quality & InspectionMedical Device Complaint Handling Form Template
A complaint intake and investigation form for medical devices, covering product details, event description, reportability assessment and closure.
Quality & InspectionProcess Validation IQ OQ PQ Template
Fill in process, equipment and acceptance details and export an IQ OQ PQ protocol outline with test tables and approval signatures.
Quality & InspectionISO 13485 Internal Audit Checklist
A clause-organized checklist for auditing a medical device quality management system against ISO 13485:2016, with critical items flagged.
More Quality & Inspection tools
See all- CAPA Corrective and Preventive Action Form Template
- Device History Record (DHR) Template
- Sterilization Load Record Template
- Medical Device Design Verification Protocol Template
- Medical Device Supplier Evaluation Scoring Worksheet
- Medical Device Cleanroom Environmental Monitoring Log
- Medical Device Accelerated Aging Calculator (ASTM F1980)
- Medical Device Success Run Validation Sample Size Calculator
- Sterilization D-Value and SAL Log Reduction Calculator
Keep exploring
Free tools
- ISO 13485 Gap Analysis TemplateEditable clause-by-clause ISO 13485:2016 gap analysis worksheet that shows how each clause compares with ISO 9001 and scores your gap.
- ERP Implementation Risk Register WorksheetAn editable risk register for ERP projects that scores each risk as probability times impact and exports to Excel.
- ISO 13485 Approved Supplier List Risk Ranking and Audit Plan WorksheetScores suppliers with a risk priority number, sets audit intervals, and totals audits per year and audit cost so your supplier control is proportional to risk.
Guides
- ISO 13485 ERP Requirements for Medical Device Contract ManufacturersWhat ISO 13485 and FDA QMSR actually require of an ERP at a medical device contract manufacturer: records, traceability, change control and software validation.
- How to Set Up ISO 9001 Workflows in SyteLineComplete guide to configuring ISO 9001:2015 quality management workflows in Infor SyteLine. Set up management review, internal audit, risk assessment, continual improvement, and process performance monitoring.
- Supplier Risk Management for Discrete ManufacturersSupplier risk management for manufacturers: scoring financial, geographic, and single-source risk, monitoring tiers, and building qualified alternates.
AI on your ERP
- AI on Your ERP for Medical Device Manufacturing Under QMSR and ISO 13485Private AI on your ERP for medical device makers: DHR assembly, UDI, complaints, CAPA and supplier controls under FDA QMSR and ISO 13485, kept on your own infrastructure.
- AI on Infor SyteLine for Medical Device Manufacturers: Genealogy, DHR and Audit EvidencePrivate AI on Infor SyteLine for medical device makers: lot and serial genealogy, DHR assembly, UDI and QMSR evidence, with human approval on every write.
Manufacturing hubs
- Medical Device Manufacturing in Minneapolis-St. PaulMedical device manufacturing in Minneapolis-St. Paul: ecosystem, FDA and ISO 13485 requirements, and ERP, quoting and document problems contract makers face.
- MDMA, AdvaMed and medical device manufacturing: regulation, ERP and AI realitiesMDMA and AdvaMed medical device manufacturing: FDA QMSR, ISO 13485, UDI and EU MDR, plus the ERP, traceability and private AI issues device makers face.