Risk Management Services

Why Risk Management Matters

Risk management is the backbone of every medical device quality management system. It is not a standalone activity — it is a process integrated into design, manufacturing, supplier management, post-market surveillance, and every decision that affects patient safety. It also remains one of the most frequently cited areas of nonconformity across regulatory frameworks.

Common Regulatory Nonconformities

• ISO 14971 Clause 4.4 requires the Risk Management Plan to define scope, responsibilities, review requirements, acceptability criteria, and verification activities — many plans lack one or more of these mandatory elements.
• ISO 14971 Clause 5 requires systematic risk analysis, including hazard identification for both normal and fault conditions — analyses frequently omit foreseeable misuse scenarios and use-environment hazards.
• ISO 14971 Clause 4.4 requires documented risk acceptability criteria, applied during evaluation under Clause 6 — severity and probability scales are often undefined or inconsistent across product families.
• ISO 14971 Clause 8 requires evaluation of overall residual risk — this mandatory step is missing in a significant number of risk management files.
• ISO 14971 Clause 10 requires production and post-production information to feed back into the risk management file — complaint data and PMS reports are routinely disconnected from it.
• EU MDR Annex I GSPR 1–9 requires risk reduction as far as possible — risk management files frequently lack documented rationale for residual risk acceptability.
• IEC 62304 requires software risk management integrated with ISO 14971 — SOUP risk assessment and software hazard analysis are commonly absent.
• IEC 62366-1 requires use-error risk analysis linked to ISO 14971 — usability engineering outputs are frequently not traced to the risk management file.

Regulatory Landscape

ISO 14971:2019. Clauses 4–10 mandate the complete risk management process: risk management plan (4.4), risk analysis including hazard identification (5), risk evaluation (6), risk control with priority order per Clause 7.1 (7), evaluation of overall residual risk (8), risk management review (9), and production/post-production monitoring (10). Requires documented risk acceptability criteria and traceability throughout.

ISO/TR 24971:2020. Guidance on implementing ISO 14971. Covers benefit-risk analysis methodology, risk management for IVDs, cybersecurity risks, biological hazards, and QMS integration.

FDA QMSR (21 CFR 820, as amended, effective February 2, 2026). Incorporates ISO 13485:2016 by reference. ISO 13485 integrates risk-based requirements throughout the QMS — product realization, design and development, purchasing, production, monitoring, nonconforming product, and improvement. ISO 14971 remains the internationally recognized framework for medical-device product risk management, and enters the QMS through ISO 13485's risk-based requirements rather than by direct incorporation into QMSR.

EU MDR 2017/745, Annex I (GSPR). GSPR 1–9 mandate risk management throughout the device lifecycle. Requires risk-benefit analysis per Annex I §1. Annex II requires a risk management file in technical documentation. Annex XIV Part B requires PMCF data to feed the risk management file.

MDSAP (5 jurisdictions). MDSAP evaluates risk-management activities across its applicable audit processes, including Management, Design and Development, Production and Service Controls, Purchasing, and Measurement, Analysis and Improvement. Within the Design and Development process, risk-management activities are specifically reviewed as part of design controls, across all five participating authorities (FDA, Health Canada, TGA, ANVISA, MHLW/PMDA).

UK MDR 2002 (UKCA). Schedule 1 Essential Requirements mandate risk-benefit analysis consistent with EU MDR principles. MHRA requires risk management integrated with conformity assessment.

Our Services

Risk Management System Development

• Complete risk management procedure (SOP) harmonized to ISO 14971:2019, FDA QMSR, EU MDR, MDSAP, and UK MDR
• Risk Management Plan templates addressing all mandatory elements per ISO 14971 Clause 4.4
• Risk acceptability criteria and matrix development per ISO 14971 Clause 4.4 and Clause 6
• Hazard identification methodology aligned to ISO 14971 Clause 5 and ISO/TR 24971 Annex C
• QMS integration mapping per ISO 13485 Clause 7.1: design controls, CAPA, complaints, supplier management, production

Risk Management File Review & Remediation

• Gap analysis of existing risk management files against ISO 14971:2019 clause-by-clause requirements
• Remediation of FMEA, FTA, and hazard analysis worksheets per ISO 14971 Clauses 5 and 6
• Overall residual risk assessment per ISO 14971 Clause 8
• Benefit-risk analysis documentation meeting EU MDR Annex I GSPR 1–9
• Risk management review facilitation per ISO 14971 Clause 9

Risk-Based Process Integration

• Design control risk integration — ensuring inputs, outputs, verification, and validation address identified risks
• CAPA process risk linkage — risk-based prioritization tied to risk reduction effectiveness
• Supplier management risk assessment — risk-based supplier classification and monitoring
• Post-market surveillance risk feedback loops — complaints, vigilance, and PMCF to the risk file
• Production risk controls — process risk assessment tied to risk analysis outputs

Training & Competency Development

• ISO 14971:2019 comprehensive training — clause-by-clause with practical application
• Cross-functional risk management training for R&D, manufacturing, quality, regulatory, clinical
• FMEA, FTA, and hazard analysis workshops using your actual products and processes
• Regulatory-specific training: FDA QMSR, EU MDR Annex I, MDSAP Chapter 5, UKCA

Complete Document Package — 14 Deliverables

Every engagement produces audit-ready documentation satisfying requirements across all applicable regulatory markets.

• SOP-RM-001, Risk Management Procedure. Master procedure harmonized to ISO 14971:2019, FDA QMSR, EU MDR Annex I, MDSAP Ch. 5, UK MDR.
• FRM-RM-001, Risk Management Plan Template. All mandatory plan elements per ISO 14971 Clause 4.4, with regulatory cross-reference matrix.
• FRM-RM-002, Hazard Identification Worksheet. Structured per ISO 14971 Clause 5.4 and ISO/TR 24971 Annex C hazard categories.
• FRM-RM-003A, Product Risk Assessment (dFMEA). Design FMEA per ISO 14971 Clause 5 for device design, software, and usability hazards.
• FRM-RM-003B, Process Risk Assessment (pFMEA). Process FMEA per ISO 14971 and ISO 13485 Cl. 7.5 for manufacturing and production hazards.
• FRM-RM-004, Fault Tree Analysis Template. Top-down FTA per ISO 14971 Clause 5 for systematic root-cause hazard analysis.
• FRM-RM-005, Risk Evaluation & Acceptability Matrix. Customizable matrix per ISO 14971 Clause 6 with defined acceptability regions.
• FRM-RM-006, Risk Control Verification Form. Verification per ISO 14971 Clause 7 for implementation and effectiveness.
• FRM-RM-007, Residual Risk Evaluation Form. Individual and overall residual risk per ISO 14971 Clauses 7 and 8, with EU MDR benefit-risk section.
• FRM-RM-008, Risk Management Review Checklist. Complete review per ISO 14971 Clause 9, verifying all mandatory process steps.
• FRM-RM-009, Risk Management Report Template. Summary report per ISO 14971 Clause 8, with product/process risk-assessment statistics and regulatory status.
• FRM-RM-010, Post-Production Monitoring Log. Tracking per ISO 14971 Clause 10 for production/post-production information feedback.
• FRM-RM-011, Product Realization Risk Assessment. Risk integration at each realization phase per ISO 13485 Cl. 7.1 and FDA QMSR §820.30.
• REF-RM-001, Regulatory Cross-Reference Matrix. Clause-by-clause mapping: ISO 14971 ↔ FDA QMSR ↔ EU MDR ↔ MDSAP (all 5) ↔ UK MDR.

Engagement Models

• Document Package Only. The complete Risk Management Document Package (all 14 templates and forms) for independent implementation. Ideal for organizations with experienced RM staff.
• Gap Assessment + Remediation. Clause-by-clause review of existing risk management files, gap identification, a prioritized remediation roadmap, and hands-on documentation fixes.
• Full System Development. End-to-end risk management system build-out from procedure development through implementation, including documentation, training, and QMS integration mapping.
• Training & Workshops. Customized programs from half-day sessions to multi-day workshops covering ISO 14971, FMEA/FTA techniques, and auditor preparation, on-site or virtual.

Why SA Quality Solutions

• Regulatory expertise across ISO 14971, FDA QMSR, EU MDR, MDSAP (all 5 jurisdictions), and UKCA — every deliverable built directly from the standards and regulations.
• 20+ years in medical device quality and regulatory affairs spanning R&D, manufacturing, Notified Body operations, and regulatory consulting.
• Certified across ISO 13485, MDSAP, and EU MDR/MDD — one resource covering your regulatory footprint.
• Process-based methodology — your risk management system satisfies the intent of ISO 14971, not just the paperwork requirements.
• Experience supporting requirements across all five MDSAP jurisdictions, with documentation built to meet each jurisdiction's specifics.
• Implementation-focused — we develop the procedures, build the templates, create the regulatory cross-references, and train your team to maintain the system independently.

Experience and Methodology

SAQMS services are developed and delivered based on applicable medical-device regulatory requirements, recognized international standards, audit practices, and practical quality-system implementation experience.

Our approach is grounded in:

• ISO 13485 quality management system requirements
• FDA Quality Management System Regulation requirements
• MDSAP audit-model expectations
• EU MDR and applicable conformity-assessment requirements
• ISO 14971 medical-device risk-management principles
• Applicable sterilization, validation, clinical investigation, supplier-control, and post-market requirements
• Risk-based auditing and objective-evidence evaluation

Each engagement is structured around the client's products, processes, intended markets, regulatory obligations, quality-system maturity, and identified compliance risks.

SAQMS provides independent consulting, internal audits, supplier audits, readiness assessments, remediation support, documentation development, and implementation guidance. Services are performed against defined criteria and documented evidence, with findings and recommendations linked to applicable requirements.

SAQMS does not issue accredited certifications, regulatory approvals, or guarantees of audit or submission outcomes. Certification, regulatory decisions, laboratory testing, and conformity-assessment determinations remain the responsibility of the applicable authorized organizations and regulatory authorities.

Our Commitment

SAQMS delivers technically rigorous, objective, and practical support designed to help medical-device organizations:

• Understand applicable requirements
• Identify compliance gaps
• Establish sustainable quality-system controls
• Strengthen audit and inspection readiness
• Improve traceability and objective evidence
• Address root causes and reduce repeat findings
• Support safe and effective medical-device manufacturing and distribution

All services are conducted with appropriate confidentiality, independence, professional judgment, and conflict-of-interest controls.