# Risk Management Specialist

> Medical device risk management specialist implementing ISO 14971 throughout product lifecycle. Provides risk analysis, risk evaluation, risk control, and post-production information analysis.

- Skill: `borghei/risk-management-specialist` (Agent Skill, multi-file: 7 files)
- Install (CLI): `npx skillmds@latest add borghei/risk-management-specialist`
- Raw SKILL.md: https://api.skillmd.com/api/skills/borghei/risk-management-specialist/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT + Commons Clause
- Author: borghei (https://skillmd.com/u/borghei)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/borghei/risk-management-specialist

---

# Risk Management Specialist

ISO 14971:2019 risk management implementation throughout the medical device lifecycle — planning, hazard analysis, risk evaluation, risk control, residual-risk assessment, and post-production monitoring — extended for AI/ML, cybersecurity (IEC 81001-5-1), supply chain, and cross-framework alignment (NIST CSF, DORA, NIS2).

## Core Capabilities

- **Risk management planning** — scope, 5x5 acceptability matrix, RACI, verification and post-production planning
- **Risk analysis & evaluation** — hazard identification across 9 categories, P1-P5 / S1-S5 estimation, ALARP, benefit-risk triggers
- **Risk control** — priority hierarchy (inherent safety → protective measures → information for safety), verification methods, residual-risk evaluation
- **Post-production monitoring** — information sources, review triggers, RM-file update procedures, periodic review
- **Extended domains** — AI/ML risk (bias, drift, adversarial inputs), health-software cybersecurity, supply chain risk, cross-framework mapping

## When to Use

- Implementing ISO 14971:2019 across the device lifecycle
- Building a hazard analysis / risk register using FMEA, FTA, HAZOP, or Use Error Analysis
- Evaluating residual risk and demonstrating ALARP or benefit-risk acceptability
- Extending risk management to AI/ML devices, cybersecurity, or supply chain
- Setting up post-production risk monitoring and Risk Management File update triggers

## Clarify First

Before running the risk assessment, confirm these inputs. If any is unknown or vague, ASK — do not assume:

- [ ] **Device and intended use** — what it is and its use context (drives the hazard categories and benefit-risk analysis)
- [ ] **Lifecycle stage** — planning, hazard analysis, risk control, or post-production (picks the workflow)
- [ ] **Acceptability criteria** — the 5x5 matrix thresholds and ALARP definition (determines the risk-evaluation outcomes)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the risk register.

## Quick Start

```bash
# ISO 14971 risk level (probability × severity, 1-5 each)
python scripts/risk_matrix_calculator.py --probability 3 --severity 4

# FMEA Risk Priority Number (severity / occurrence / detection, 1-10 each)
python scripts/risk_matrix_calculator.py --fmea --severity 8 --occurrence 4 --detection 3

# Guided interactive assessment, or list the full criteria scales
python scripts/risk_matrix_calculator.py --interactive
python scripts/risk_matrix_calculator.py --list-criteria
```

## References

Load the reference that matches the task — keep this file lean and pull detail on demand:

- **[references/risk-process.md](references/risk-process.md)** — full ISO 14971 process: planning, analysis, evaluation, control, and post-production workflows; 5x5 acceptability matrix; probability/severity criteria; hazard checklist; and the decision frameworks. Read when executing any lifecycle stage.
- **[references/risk-analysis-methods.md](references/risk-analysis-methods.md)** — FMEA, FTA, HAZOP, Use Error Analysis, and software hazard analysis methods. Read when choosing and applying a hazard-analysis technique.
- **[references/iso14971-implementation-guide.md](references/iso14971-implementation-guide.md)** — complete ISO 14971:2019 implementation framework with templates. Read for clause-level implementation detail.
- **[references/templates-and-tools.md](references/templates-and-tools.md)** — Hazard Analysis / FMEA worksheets, Risk Management Report template, full `risk_matrix_calculator.py` flag reference, troubleshooting table, and success criteria. Read when documenting assessments or diagnosing tool issues.
- **[references/extended-risk-domains.md](references/extended-risk-domains.md)** — AI/ML risk categories and methodology, IEC 81001-5-1 cybersecurity integration, supply chain risk, post-market monitoring automation, combined safety-security FMEA, and NIST CSF / DORA / NIS2 cross-framework mapping. Read for connected, software, or AI-enabled devices.

## Scope & Limitations

**In Scope:**
- ISO 14971:2019 risk management process implementation (planning, analysis, evaluation, control, residual risk, production/post-production)
- 5x5 risk matrix calculation and FMEA RPN scoring
- Hazard analysis methodology guidance (FMEA, FTA, HAZOP, Use Error Analysis, PHA)
- Risk control hierarchy application and verification planning
- Benefit-risk analysis framework
- Post-production risk monitoring and risk file update triggers
- AI/ML-specific risk management extensions (model bias, drift, adversarial inputs)
- Cybersecurity risk integration per IEC 81001-5-1
- Supply chain risk assessment methodology
- Cross-framework risk mapping (ISO 14971, NIST CSF, DORA, NIS2)

**Out of Scope:**
- Clinical investigation design or execution (risk management informs clinical strategy but does not execute studies)
- Software hazard analysis per IEC 62304 (the skill references software risk but detailed software lifecycle management requires IEC 62304 expertise)
- Biocompatibility testing or ISO 10993 evaluation (the skill identifies biological hazards but does not execute biocompatibility testing)
- Cybersecurity penetration testing or vulnerability scanning (use infrastructure-compliance-auditor for technical security testing)
- CAPA root cause analysis execution (use capa-officer for 5-Why, Fishbone, FTA, FMEA-based root cause investigation)
- Regulatory submission of risk management files (use regulatory-affairs-head for submission strategy and packaging)

## Integration Points

| Skill | Integration |
|-------|------------|
| [quality-manager-qms-iso13485](../quality-manager-qms-iso13485/) | Risk management (Clause 7.1) integrates with QMS product realization planning; risk file is part of the Design History File |
| [capa-officer](../capa-officer/) | Post-market risk signals may trigger CAPA; CAPA root cause analysis methods (FMEA, FTA) overlap with risk analysis techniques |
| [regulatory-affairs-head](../regulatory-affairs-head/) | Risk management file is required for FDA submissions and EU MDR Technical Documentation; benefit-risk analysis supports clinical evaluation |
| [quality-documentation-manager](../quality-documentation-manager/) | Risk management file and records must be controlled per document control procedures (Clause 4.2) |
| [fda-consultant-specialist](../fda-consultant-specialist/) | FDA cybersecurity guidance (2025 update) requires integration of security risks into ISO 14971 processes for premarket submissions |
| [infrastructure-compliance-auditor](../infrastructure-compliance-auditor/) | Technical security controls validated by the infrastructure auditor serve as risk mitigations for cybersecurity threats in the risk assessment |
| [nist-csf-specialist](../nist-csf-specialist/) | NIST CSF risk assessment (ID.RA) maps to ISO 14971 hazard identification and risk estimation; unified risk register possible |