ISO 14971 describes the internationally established process for applying risk management to medical devices. The standard requires a systematic approach to identifying hazards, evaluating associated risks, implementing risk control measures and continuously monitoring residual risks across the entire product lifecycle.
In the context of usability engineering, ISO 14971 is the primary reference for analyzing and controlling use-related risks. Information from the usability engineering process, in particular on use errors, hazardous situations and hazard-related use scenarios, serves as input for the risk-related activities.
Risk management as a lifecycle process
ISO 14971 does not regard risk management as a one-off development activity but as a continuous process across the entire product lifecycle. Risks must be considered already in the concept phase and subsequently reviewed continuously on the basis of development, production, market and vigilance data. Information from complaint management, CAPA, post-market surveillance and post-market clinical follow-up can make adjustments to the risk assessment necessary.
Relationship with usability engineering
Risks related to medical devices can arise not only from technical defects but also from user interactions, ergonomic features, the use environment or foreseeable misuse. IEC 62366-1 therefore requires the identification of hazard-related use scenarios, while ISO 14971 governs the assessment and control of the resulting risks. Typical interfaces are use scenarios, hazard-related use scenarios, use errors and the resulting risk management activities.
Hazard, hazardous situation and harm
In practice, these terms are often mixed up. ISO 14971 distinguishes between the hazard as a potential source of harm, the foreseeable sequence of events that can lead from the hazard to a hazardous situation, the situation in which people, property or the environment are exposed to the hazard, and the actual harm. This differentiation is particularly important for use-related risks because use errors are often merely triggering events within this sequence of events and are not themselves already the hazardous situation.
Risk control measures and prioritization
The standard prefers a hierarchy of risk control measures: Inherently safe design takes precedence, followed by protective measures and finally information for safety or training. In the usability context this means, for example, that a use error should be prevented by design changes where possible before warnings or training measures are used. This prioritization plays a central role in assessments by notified bodies (the EU conformity assessment bodies) and FDA reviewers.
Benefit-risk consideration and residual risk
Not every risk can be eliminated completely. If a remaining individual risk is not acceptable and further risk control is not practicable, it is examined whether the benefit of the intended use outweighs this risk. Not every residual risk automatically requires a benefit-risk analysis of its own. Independently of this, after completion of risk control the overall residual risk of the product must also be evaluated because several individually acceptable risks can nevertheless be problematic as a whole. Especially for innovative or life-supporting products, the benefit-risk consideration is an essential part of the regulatory argument.
Typical weaknesses in audits and assessments
Frequent findings concern missing links between usability activities and the risk management file, insufficiently documented risk control measures or the missing feedback of summative test results into the risk analysis. Also viewed critically are blanket probability ratings without a comprehensible data basis and the exclusive use of warnings as a risk control measure.
Regulatory reference
ISO 14971 describes terminology, principles and process requirements for the risk management of medical devices across the entire lifecycle and explicitly includes the collection and evaluation of information from production and the market phase to update the risk assessment. IEC 62366-1 requires that use-related hazards and use errors be integrated into the manufacturer's risk management activities. The EU MDR requires in Annex I that risks be reduced as far as possible without adversely affecting the benefit-risk ratio, that both the remaining individual risk and the overall residual risk be assessed and that the risk control hierarchy be observed; Article 10(2) obliges manufacturers to establish and maintain a corresponding risk management system. In its human factors guidance, the FDA requires that critical tasks and serious use errors be identified on a risk basis and assessed in the summative evaluation (human factors validation testing).
ISO 14971 is the framework in which usability engineering unfolds its effect: Use-related hazards from IEC 62366-1 are assessed, controlled and tracked across the product lifecycle only through the risk management file according to ISO 14971.
Frequently asked questions (FAQ)
Is the use-related risk analysis identical to the ISO 14971 risk analysis?
No. The use-related risk analysis focuses on hazards that arise from user interactions. A use-related risk analysis (URRA) used in practice often serves as input for the overarching risk management file according to ISO 14971.
Is an FMEA sufficient to meet ISO 14971?
No. FMEA is merely a method for risk analysis. ISO 14971 requires a complete risk management process including risk evaluation, risk control, residual risk evaluation and post-market monitoring.
Do all identified risks have to be eliminated completely?
No. The standard acknowledges that residual risks can remain. These must, however, be assessed, documented and, where applicable, justified by a benefit-risk analysis.
When do results from summative usability tests have to be fed back into the risk management file?
Whenever new insights arise about use errors, residual risks or the effectiveness of risk control measures. The summative evaluation also serves as evidence for the effectiveness of usability-related risk controls.
Do you want to identify use-related risks systematically and integrate them into your risk management file according to ISO 14971? We support you throughout the usability engineering process according to IEC 62366-1.
More about our usability engineeringSources
- IEC 62366-1:2015+AMD1:2020, Medical devices, Part 1: Application of usability engineering to medical devices
- ISO 14971:2019, Medical devices, Application of risk management to medical devices
- Regulation (EU) 2017/745 on medical devices (MDR)