Risk Management

Risk Management Skill

When to Use

• Building or updating a risk management file for a medical device (SaMD or hardware)
• Creating hazard analysis, risk estimation, risk evaluation, or FMEA worksheets
• Generating risk acceptability matrices (5x5 severity x probability)
• Documenting risk controls and residual risk assessment
• Preparing ISO 14971-compliant documentation for regulatory submissions
• Populating risk records for design reviews or audits

When NOT to Use

• General project risk management (schedule, budget) -- this is for patient safety risk
• Cybersecurity-only risk assessment (for cybersecurity risk, use IEC 80001-1 series (network security) or AAMI TIR57; for industrial controls, reference IEC 62443)
• When you need a full Risk Management Plan (this generates the analysis, not the plan)
• Non-medical-device software where ISO 14971 does not apply

Quick Start

# Generate SpO2 AI example with all 8 sheets
python scripts/generate_risk_analysis.py --example spo2

# Generate blank template for a custom device
python scripts/generate_risk_analysis.py --device-name "Cardiac Monitor v2"

Output lands in output/risk-analysis-{device_name}.xlsx.

XLSX Structure -- 8 Sheets

1. Document_Control

2. Hazard_Identification

3. Risk_Estimation

4. Risk_Evaluation

5. Risk_Controls

6. Residual_Risk

7. Overall_Residual_Risk (ISO 14971 Clause 7)

Includes a summary formula row: "ACCEPTABLE -- Proceed to release" or "REVIEW REQUIRED -- Resolve open items"

Note: This is a process FMEA for identifying failure modes and prioritizing design improvements. RPN (Risk Priority Number) is not a valid patient risk acceptability metric per ISO 14971:2019 Annex G — ordinal scale multiplication does not yield meaningful risk levels. Patient risk acceptability is determined solely by the 5×5 severity × probability matrix on sheets 3-6. Do not use RPN values for regulatory risk acceptability decisions.

8. FMEA

Severity / Probability Quick Reference

Risk Acceptability Matrix (5×5)

Defined in regulatory/risk-management/risk-acceptability-matrix.md (document-controlled). Read that file for the current matrix. Do not hard-code criteria here — the matrix is owned by the Risk Management Plan.

Reference Files

• references/iso14971-structure.md -- ISO 14971 process phases, required documents, key definitions
• references/hazard-taxonomy.md -- Hazard categories per ISO 14971 Annex C, software-specific hazards
• references/severity-probability.md -- Full scale definitions, matrix, FMEA mapping, AFAP criteria

Verification Checklist

Before submitting a risk management file, verify:

• Every hazard has a unique ID (HAZ-nnn)
• Every hazard traces through all 6 sheets (identification -> estimation -> evaluation -> control -> residual)
• Severity and probability values use the defined scales (S1-S5, P1-P5)
• Risk Level is calculated via formula, not hardcoded
• Every Unacceptable risk has at least one risk control
• Every risk control has a verification method
• Residual risk is re-evaluated after controls
• No residual risk remains Unacceptable
• AFAP decisions include documented rationale (risk reduced as far as possible per ISO 14971:2019)
• Process FMEA: RPN is calculated via formula (=SOD), not hardcoded (process prioritization only — not for patient risk acceptability)
• Process FMEA: RPNs above threshold (typically 100-150) have action items for design improvement
• Overall residual risk benefit-risk conclusion is documented