ISO 14971 Medical Device Development & Risk Management

Apply ISO 14971 to manage risk across the medical device lifecycle, from initial conception to decommissioning, using design development, controls, traceability, and practical examples.

Explore how medical device design and development proceed from intended use through user needs, requirements, architecture, and design outputs to verification, validation, and risk management with a mug example.

Explore how ISO 14971 fits ISO 13485's quality management system, showing risk management integrated with design and development, document keeping, and change management to meet regulatory requirements through SOPs.

Explore how documentation and record keeping support ISO 14971 risk management by producing records as evidence, organized in risk management and design history files within the quality management system.

Define and craft the intended use for medical devices per ISO 14971, detailing medical indication, patient population, body interaction, user profile, use environment, and operating principles, with validation testing implications.

Examine user needs and validation to ensure products fulfill intended use, illustrate design validation with objective evidence, and establish traceability from user needs to requirements.

This lecture shows that requirements and architecture emerge iteratively from user needs and risk control measures, with verifiable tests, traceability, interfaces, and a digital thermometer example.

Explore how to define system architecture by distinguishing product, system, and item, and plan interfaces, verification testing, and risk management considerations across system, item, and unit levels.

Adapt a phase strategy for a complex programmable electromechanical medical device, aligning IEC 60601 and EMC with IEC 62304 software and ISO 14971 risk management through architecture, design, and verification.

Identify the design process and design outputs defined by 21 CFR 820, and how these outputs—the device, its packaging, labeling, and the device master record—form the finished design.

Learn how verification provides objective evidence that specified requirements are met through testing, documentation, and design reviews, with version-controlled test setups and calibrated equipment.

Apply risk management to assess the digital thermometer's safety and identify hazards. Implement risk controls and gather verification, validation, labeling, and durability evidence to ensure acceptable risk.

Explore design traceability within medical device development by linking user needs, design inputs and outputs, verification, validation, and risk controls in a diof matrix to demonstrate objective evidence against regulations.

Discover how startups build an ISO 12345 quality management system, train staff, and define design development and risk management procedures while focusing on verifiable tests over design details.

Explore risk management under ISO 14971, including risk analysis, risk evaluation, and preliminary risk assessment; identify hazards, estimate severity and probability, and plan risk control and residual risk.

Explore reasonably foreseeable misuse in medical device risk management per ISO 14971, including improper maintenance, tampering, probe misplacement, premature pulse delivery, and poor electrical connections.

Identify safety-related characteristics of medical devices, including durability and accuracy, assess hazards and risks, apply controls to reach acceptable risk, and declare the device safe.

Learn to identify hazards in medical devices through energy sources, substance characteristics, failure modes, and use-related hazards, and define hazardous situations using ISO 14971 risk analysis.

Estimate risk by assigning probability of harm and severity for each hazard, using qualitative or quantitative information from standards, data, usability tests, simulations, and expert opinion.

Estimate probability using quantitative methods when data allows, otherwise use qualitative estimates, and use five discrete levels to quantify risk in the risk management procedure.

Learn how to use qualitative, non-numerical probability estimates for medical device risk when numeric data is unavailable, focusing on risk controls to enhance safety and effectiveness while acknowledging risk's subjectivity.

Assess severity of harm with a five-level qualitative scale aligned to ISO 14971 and IEC 62304, guiding risk assessment and controls. Use examples like excessive temperature, cross-contamination, and toxic substances.

Explore real-world risk management in medical device development, linking hazards to risk controls and requirements through design traceability, while considering harms, adverse events, expert input, and training records.

Evaluate risk using a five by five risk acceptability table to classify probability and severity as low, medium, or high, and apply practicable risk controls under the risk management procedure.

Implement risk control measures in medical device design and verify their implementation and effectiveness through verification and validation testing. Use design documentation to provide evidence of verified implementation and effectiveness.

Evaluate residual risk after implementing risk control measures and conduct a risk-benefit analysis if unacceptable, citing ISO 14971 and practical examples from digital thermometer risk assessment.

Learn how to complete, verify, evaluate, and review risk management for medical devices, weigh residual risk against benefits, document risk control evidence, and prepare the risk management report.

Identify medical device hazards with a common ISO 14971 aligned list, covering energy, use, substance, and failure-mode risks. Link sources to risk assessment and controls such as labeling and training.

Examine FMEA within ISO 14971 risk management, differentiating design FMEA from process FMEA, and learn to apply risk controls and residual risk assessment in medical device development.

Recap the production and post-production phases of the medical device life cycle and apply risk controls, information collection, and actions through fmea and integrated procedures.

Implement ISO 14971 risk controls in production using inherently safe design, protective measures, and production tests like hyper testing of map barriers, calibrations, and in-process testing.

Learn how pfmea uses a flow diagram of the manufacturing process to identify failure modes and recommend actions to reduce risk, scoring severity, occurrence, and detectability to derive the rpn.

Explore how section 10 of ISO 14971 guides production and post-production risk management, detailing information collection, systems, and actions using SOPs, data, and stakeholder roles.

Review information collected for safety relevance within the RMF, updating the risk management file throughout the life cycle, including the post-market phase, to control risks.

Review section 10.4 information actions of the ISO 14971 standard: reassess risks, add controls, verify effectiveness, and decide market actions under top management oversight.

Apply a quality review to data to determine safety impact, update the risk management file, and implement risk controls. Verify results via regression testing and consider recalls or software updates.

Learn to log, investigate, and track design bugs from non-conformances or customer feedback using a risk-based bug tracking procedure, update risk management, and issue change requests with post-production verification.

Apply post-production risk management to investigate complaints of potential field failures in the electrosurgical generator, identifying a bug and initiating a change request.

Investigate Tarach 25 case: a radiation therapy linac failure (1985–1987) to reveal how hardware, software, and operator interactions affected risk management, and distill lessons for ISO 14971 medical device development.

Explore a six-incident case study of the Tarak 25 radiation therapy machine, linking design flaws, software bugs, and risk management mistakes to patient harm.

Explore the Therac-25 system design, dual mode operation and beam path, and how software-driven risk controls and hardware removal contributed to radiation overdoses.

This lecture analyzes risk management failures in the Tarach 25 design, showing how software and hardware controls, testing gaps, and usability issues enabled dangerous energy overdoses.

Explore software failures in a radiation therapy device, including a race condition in data entry and a turntable position overflow, revealing unsafe parallel tasks and inadequate risk management.

Examine AECL’s Terak 25 case to show how risk management must treat the system as a whole, include software safety, usability, and test reports using the V-model.