Medical Devices (MDR)In-Vitro Diagnostics (IVDR)

Risk Management According to EN ISO 14971 – A Framework for Decisions & Documentation Across the Product Life Cycle

Risk management file: Working hand-in-hand with the customer—practical rather than contrived. Actionable steps instead of mere formal documentation. Consistently integrated with technical documentation, V&V, usability engineering, clinical evaluation/performance evaluation, and PMS.

20+ years of EN ISO 14971 experience · 65+ hazard analyses · 75+ risk-benefit assessments + MDR/IVDR-compliant

Request a Free Initial Consultation

Frequently Asked Questions →

160+

Risk Management Files Created

15+

RM/PMS Experts

From Concept to Market Exit

Throughout the Entire Life Cycle

Rating of 1.2 based on 117 customer reviews

Over the Past 3 Years (1 = very good, 6 = insufficient)

What does risk management mean for Metecon—and why isn’t a formally complete risk management file sufficient?

Metecon’s goal is for manufacturers to use risk management as a framework for decision-making and demonstrating compliance, rather than viewing it merely as a mandatory obligation. We structure risks to cover the entire product life cycle: from development to market withdrawal. We translate the requirements of EN ISO 14971 into practical steps and empower our clients to implement them successfully. By doing this, we avoid risk management that only exists on paper and fails to function reliably in day-to-day development operations.

Risk Management as a Decision-Making Framework

Risks guide design decisions, verification and validation (V&V) activities, and changes—not from outside the development process, but directly embedded within it. This makes risk management a tool for development, not a hindrance.

Risk Management and Traceability

Every risk control measure must be verified. Traceability between the risk, the measure, and the verification ensures that the risk management file is audit-ready and meets regulatory requirements.

Risk Management Throughout the Product Life Cycle

From the concept phase through to product discontinuation: Risk management files are updated whenever changes occur, supplemented with PMS, PMCF/PMPF, and vigilance data, and consistently maintained throughout the entire product life cycle.

3 Common Challenges in Risk Management –
and how Metecon solves them

Challenge 1 · Inconsistency

The risk management file exists but is inconsistent with development results, IFU/labeling, clinical / performance evaluation, and PMS

Metecon Solution: Risk management becomes the connecting element: We ensure consistency between the risk management file, technical documentation, V&V, usability engineering, clinical / performance evaluation, and PMS—working hand in hand with your team.

Challenge 2 · A Patchwork of Changes

Changes lead to a patchwork approach—unclear validity of assessments, measures, and processes

Metecon Solution: Structured change management with traceable versioning. Every design change, every variant, and every PMS feedback triggers a defined update of the risk evaluation—without duplicate structures and without gaps.

Challenge 3 · Knowledge Gap

What are the requirements of ISO 14971—and how can they be implemented on a product-specific basis ?

Metecon’s Solution: We translate the standard into practical steps—tailored to your product, not a one-size-fits-all approach. ISO 14971, ISO/TR 24971, MDR/IVDR Annex I, and IEC 62366-1 are integrated into a robust risk management framework for your product.

Risk Management According to ISO 14971: 5 Steps to a Robust Risk Management File

Risk Management Plan

scope, methods, acceptance criteria, interfaces

Identifying Risks
hazards, situations, damage scenarios

Risk Evaluation & Measures
hierarchy: design, protection, information

Verification
traceability: risk → measure → verification

Life Cycle Maintenance
changes, PMS data, use-related risks

Risk Management File – Prepared in Close Collaboration with the Customer

We develop a risk management file in collaboration with your development team, rather than in isolation from your day-to-day development work. After all, risk management only works if the file is not only formally complete, but is also understood and utilized within the company and can be updated as changes occur. This is precisely what our support is focused on: a robust decision-making and documentation framework throughout the entire product life cycle.

Our Risk Management Services at a Glance

Risk Management Plan & File (EN ISO 14971)

Comprehensive RM plan, risk analysis, RM report, usability plan, and report: scope, methods, acceptance criteria, responsibilities, and interfaces—tailored to your specific product, developed in close collaboration with your team.

Risk Analysis & Risk Assessment

Systematic risk analysis of foreseeable sequences of events: hazards, hazard situations, and harm scenarios are identified on a product-specific basis and evaluated according to acceptance criteria—throughout the entire product life cycle.

Use-Related Risks (IEC 62366-1)

Integration of use-related risks from the usability assessment according to IEC 62366-1 into the ISO 14971 risk management file—ensuring consistency between the usabilty and the risk management file.

Verification & Traceability

Traceability between risks, risk control measures, and verification activities: Activities and evidence are traceably derived from risks—in a manner that is audit-ready and meets regulatory requirements.

Change Management

Structured updates to the risk management file in response to design changes and other life cycle events: traceable versioning, clear validity of evaluations and measures—no patchwork.

PMS & Vigilance Traceability

Structured feedback of PMS data, vigilance reports, and CAPA findings into the RM file—with clear interfaces, responsibilities, and escalation paths throughout the entire product life cycle.

Product complexity and risk class: Medical devices classes I through III; IVDs classes A through D
Existing documentation base: Creation of a new risk management file vs. revision of an existing file
Level of integration: Integration with technical documentation, V&V, usability, clinical evaluation, and PMS
Change and variant management: Scope of regular updates and product variants
Level of support: Consulting, collaborative development, or full-service support from Metecon

Following a free initial consultation, Metecon will provide a transparent cost estimate.

MDR Annex I + EN ISO 13485 + EN ISO 14971: Risk Management as the Basis for Compliance with Safety and Performance Requirements

MDR Annex I requires every manufacturer to establish, implement, document, and maintain a risk management system. The quality management standard EN ISO 13485, which is harmonized with the MDR, incorporates this requirement and refers to the equally harmonized standard EN ISO 14971 for its practical implementation. Risk management should be understood as an iterative process through which the documents in the risk management file are kept up to date from product development right through to the end of the product’s life cycle. Metecon translates these regulatory requirements into product-specific, practical steps—working hand-in-hand with your development team.

1. Risk Management Plan (ISO 14971, Clause 4)

The plan defines the scope of work, the life cycle phases to be considered, responsibilities, methods, acceptance criteria, and interfaces. It serves as the binding steering document—not created retrospectively, but established as early as the concept phase. Metecon develops the risk management plan in collaboration with your development team so that it can be used immediately as a basis for decision-making.

2. Risk Analysis: Identifying Hazards (Clause 5)

Systematic identification of all (potential) relevant hazards across the entire product life cycle: known and foreseeable hazards, including misuse, hazardous situations, and damage scenarios. Methods such as FMEA, fault tree analysis (FTA), and hazard lists are selected on a product-specific basis. Metecon ensures that the risk analysis fully covers the characteristics of your product—including use-related risks from the usability assessment.

3. Risk Assessment with Product-Specific Acceptance Criteria (Clause 6)

Each identified risk is evaluated against the acceptance criteria specified in the plan. Important: The acceptance criteria must be justified on a product-specific basis—generic evaluation matrices often do not stand up to scrutiny in audits. Metecon supports you and works with you to develop acceptance criteria that are appropriate for the product class, clinical evidence, and state of the art.

4. Risk Control: Hierarchy of Measures (Clause 7)

ISO 14971 stipulates a clear hierarchy of risk-mitigation measures: (1) inherently safe design and safe manufacture, (2) protective measures in the medical device itself or in the manufacturing process, (3) safety information (IFU, warnings) and, where appropriate, training to the user. Information alone is rarely sufficient—measures at the first level of the hierarchy are preferred from a regulatory standpoint. Metecon provides support in risk mitigation.

5. Verification & Validation of Measures (Clause 7.3 + Clause 9)

Every risk-control measure must be verified. Verification of its effectiveness can be carried out as part of the V&V activities; traceability between the risk, the measure and the verification is mandatory. Metecon assists with the implementation of the necessary processes and documentation – ensuring everything is audit-ready.

6. Residual Risk Evaluation, Benefit-Risk Analysis, Completeness of Risk Control (Clause 7.3 - Clause 7.6)

Once the measures have been implemented, residual risks are assessed against the pre-defined acceptance criteria. In a benefit-risk analysis, the benefits of the intended purpose are weighed against the respective residual risk that does not meet the acceptance criteria. Furthermore, it must be reviewed whether the risk control measures taken have possibly introduced new hazards or hazardous situations, and whether other risks have been affected by them. The completion of these activities involves verifying whether risks arising from all identified hazard situations have been considered and whether all measures have been finalized – the results of the checks must be consistent. Metecon ensures the consistency between the various verification steps and activities.

7. Assessment of the Overall Residual Risk (Clause 8)

The overall residual risk posed by the medical device is assessed in relation to the benefits of its intended purpose and documented once all risk control measures have been implemented and verified. Information on acceptable residual risks must be disclosed in the accompanying documentation (instructions for use, IFU). The evaluation result must comply with the criteria set out in the risk management plan and be consistent with the assessment of the individual residual risks. Metecon ensures that all evaluation results are consistent and documented.

8. Risk Management Report (Clause 9)

Prior to the product’s market authorization, it is verified that the requirements of the risk management plan have been fully implemented, that the overall residual risk is acceptable, and that suitable methods have been put in place to collect and verify the information required by the regulatory authorities regarding the product’s safety and performance, both during and after manufacture – process monitoring and PMS. The results of this assessment are documented in a risk management report, which is part not only of the risk management file but also of the technical documentation. Metecon shows how the two files are linked.

9. Product Life Cycle: Production and Post-Production Information (Clause 10)

EN ISO 14971 requires that findings from production and post-market activities (PMS, PMCF/PMPF) are systematically fed back into the risk management process. Process interfaces and evaluation criteria must be defined for this purpose. Metecon links the risk management process and process monitoring activities with post-market surveillance (PMS) activities.

10. ISO/TR 24971:2020: Guidance on the Application of EN ISO 14971

The ISO/TR 24971 guidance elaborates on many aspects of EN ISO 14971 with examples, methods and recommendations, particularly regarding acceptance criteria, the selection of methods and interfaces with other processes. Metecon uses both the standard and the guidance to ensure efficient risk management.

Use-Related Risks: Integration of IEC 62366-1 into the ISO 14971 Risk Management Dossier

The Interface Between Usability Engineering and Risk Management: How Do You Prevent These Two Disciplines from Drifting Apart?

Use-related risks identified in the usability evaluation according to IEC 62366-1 must be assessed as part of the risk management process in accordance with ISO 17971 – whilst ensuring traceability. Both processes are closely interlinked.

Specifically, this means that identified user interfaces must be assessed in the risk management process with regard to product safety, whilst known or foreseeable hazards relating to use are also incorporated into the risk analysis. Conversely, the risk analysis identifies hazard-related use scenarios, which can then be specifically addressed during the development process to implement risk-mitigating measures. Metecon identifies these interfaces in collaboration with your usability and risk management teams, ensuring that usability and risk management files are consistent and meet the requirements of the Notified Body.

Integrating Risk Management with Verification & Validation: Guaranteed Traceability

Traceability: Risk → Measure → V&V Activities: The Foundation of a Successful conformity assessment

Every risk-mitigating measure must be verified. The risk ID, measure ID, verification result, V&V activity and the respective test result must be traceable – without any gaps.

Why this is crucial: During QM audits and when reviewing the Technical Documentation, Notified Bodies specifically check whether every risk control measure has been verified. As these directly influence the design and development process, there is also a link between the risk management process and V&V activities. Gaps in the traceability of processes are frequently found by Notified Bodies. Metecon links processes and process steps in such a way as to ensure seamless traceability – right through to V&V activities.

Change Management: How to Avoid a Patchwork Approach in Your Risk Management File

Design changes trigger an update to the risk management file
Every design change—whether small or large—must be assessed in terms of product risks: Are existing risks still valid? Are new hazards emerging? Do risk control measures remain effective? Metecon defines clear steps in the Change Control Process to ensure that there is a link to the risk management process.
Variant Management: One Plan, Multiple Products
When dealing with product variants, it must be clear: Which risks are general, and which are variant-specific? Which measures apply to which variants? Metecon structures risk management files for product categories or groups in such a way that variants are clearly delineated and no inconsistencies arise.
Versioning and Traceable Validity
Which assessment is currently valid? Which risk control measure was defined or updated when and by which decision? Metecon creates a version control system that provides clear answers during BS audits and regulatory inquiries—with clear traceability of the different versions of the risk management file.
IEC 62304: Risk Management for Medical Device Software—as an Integrated Part of the EN ISO 14971 Risk Management File
Software introduces its own hazard categories: malfunctions, cybersecurity risks, and performance issues. IEC 62304 requires a software safety classification and development documentation tailored to it. Important: Software risk management is an integral part of the EN ISO 14971 risk management process—not a separate, parallel process. Metecon integrates IEC 62304 and EN ISO 14971 for medical device software into a single, logical and consistent risk management file.

From the Market Back to the Risk Management File: Trigger Points, Interfaces, and Escalation Paths

PMS data, complaints and results from the CAPA process must be fed back into the risk management process in a structured manner. The interfaces between these processes and responsibilities must be clearly defined: What triggers an update to the risk management file? Who is responsible for which data and for which decisions? What escalation pathways are in place? When must regulatory authorities / Notified Bodies be informed? Metecon defines these interfaces and ensures the required feedback—in collaboration with your PMS, complaints and CAPA teams—so that processes are not isolated but form logical and interconnected workflows.

What regulatory frameworks are relevant for risk management?

EN ISO 14971:2019 – Application of Risk Management to Medical Devices (Core Standard)
ISO/TR 24971:2020 – Guidance on the Application of ISO 14971 (Methodology Package)
MDR (EU) 2017/745 Annex I – General Safety and Performance Requirements (GSPR)
MDR Article 10(2) + Article 61 – Manufacturer Obligations: Risk Management and Clinical Evaluation
IEC 62366-1:2015+A1:2020 – Application of Usability Engineering (Use-Related Risks)
IEC 62304:2006+A1:2015 – Software Life Cycle Processes for Medical Devices
ISO 13485:2016 – Integration of Risk Management into the QMS (clause 7.1)
MDCG 2019-16 – Guidance on Cybersecurity (Cybersecurity Risks)
MDCG 2020-1 – Guidance on Clinical Evaluation / Performance Evaluation (Interface with Risk Management)
MDR Article 83 / IVDR Article 78 – Post-Market Surveillance (PMS–Risk Management Interface)
MDR Articles 87–92 – Vigilance and Field Safety Corrective Actions (Feedback into Risk Management)

Hand-in-Hand: The Risk Management File in Collaboration with the Development Team

Metecon is not an external document creator—we work hand-in-hand with your development team. The risk management file is created as part of day-to-day development, not separately from it. That’s what sets our collaboration apart.

Interface Consistency: TechDoc, V&V, Usability, Clinical Evidence, PMS

Metecon ensures that risk management, technical documentation, V&V, usability engineering, clinical evaluation / performance evaluation, and PMS/PMCF/PMPF are consistent in content—no isolated documents, no contradictions.

Life Cycle Maintenance: Risk Management File Remains Reliable Throughout the Product's Lifespan

Design changes, PMS data, vigilance events: all data feed back into risk management. Your risk management file remains robust—no patchwork.

IVDR Annex I + EN ISO 14971: Risk Management Framework for In-Vitro Diagnostic Medical Devices

IVDR Annex I (General Safety and Performance Requirements) requires a documented risk management system in accordance with the state of the art—based on EN ISO 14971 as the harmonized standard. For IVDs, additional hazards must be considered which may arise from : analytical performance, clinical performance, specificity/sensitivity, cross-reactivity, and interferences. Metecon integrates these IVD-specific risks into the risk management process.

IVD-Specific Risks: Analytical and Clinical Performance

Analytical Performance Risks

Sensitivity, specificity, precision, trueness, linearity, measurement range, cross-reactivities, and interferences are IVD-specific and may lead to hazardous situations. Every incorrect results may harm the patient – every incorrect result is therefore a risk that must be assessed in the risk analysis according to EN ISO 14971. Metecon integrates analytical performance risks into the risk management process.
Clinical Performance Risks

Clinical sensitivity, clinical specificity, positive and negative predictive values—these clinical performance parameters must be consistently evaluated in both the clinical performance evaluation and in risk management. Metecon ensures this consistency between risk management and performance evaluation.
Use-Related Risks in IVDs: Sample Handling and Result Interpretation

Errors in sample collection, sample preparation, test performance or result interpretation are common use-related risks for IVDs. In addition, there are specific risks associated with tests for self-testing by laypeople and with near-patient tests (point of care), which must also be taken into account in usability engineering in accordance with IEC 62366-1. Metecon incorporates the specific risks arising from user errors into the IVDR risk management file.
Software and Algorithm Risks in IVDs

For IVDs with software or AI-based algorithms, software risks must be integrated into the risk assessment in accordance with IEC 62304. Examples are: algorithm bias, training data representativeness, performance drift, and cybersecurity. Metecon integrates IEC 62304 and EN ISO 14971 requirements for IVD software into a consistent risk management process.

IVD Risk Classes A–D:
How the depth of risk management varies by risk class

Class A

Low individual and public risk

Examples: Buffer solutions, sample collection vessels. Risk management file available, but with reduced scope. Metecon creates streamlined risk management files that are compliant with the standard.

Class B / C

Moderate to high risk

Examples: Electrolyte assays, certain antibody tests, controls, blood gas analyzers, calibrators.Clinical chemistry, tumor markers, companion diagnostics. A comprehensive risk management file covering performance risks, use-related risks, and post -market surveillance feedback—Metecon’s standard scope.

Class D

Highest risk

Examples: HIV tests, hepatitis screening, certain tests used for blood grouping. Maximum depth of risk management—including performance studies, lot release controls, and cybersecurity (for networked systems). Metecon has experience with Class D risk management files.

PMPF Integration into the IVD Risk Management File

Post-Market Performance Follow-up (PMPF) is the IVD equivalent of PMCF: Ongoing post-market surveillance of product performance. PMPF data must be fed back into the risk management file in a structured manner – a structured evaluation with clearly defined process interfaces between PMPF – risk management – usability – development.

Metecon develops PMPF plans and risk management jointly—consistently integrated.

Standards & Guidelines: Risk Management Under the IVDR

ISO 14971:2019 – Application of Risk Management (Core Standard)
ISO/TR 24971:2020 – Guidance on the Application of ISO 14971 (Methodology Package)
IVDR (EU) 2017/746 Annex I – General Safety and Performance Requirements
IVDR Annexes II and III – Technical Documentation and Risk Management Report
IEC 62366-1 – Application of Usability (particularly important for self-test and near-patient tests)
IEC 62304 – Software Lifecycle Processes (also applicable to IVDs)
ISO 13485 – Integration of Risk Management into the QMS (also applies to IVD manufacturers)
MDCG 2022-2 – Guidance on General Principles of Clinical Evidence for IVDs (Performance/Risk Management Interface)
IVDR Articles 78–81 – Post-Market Surveillance (PMS) and Vigilance

IVD-Specific Risk Management File: Performance Risks Integrated

Metecon integrates IVD-specific risks, hazards and hazardous situations into your risk management process – not as a separate, parallel structure, but as part of the whole.

Interface Between Risk Management File and Performance Evaluation

Metecon ensures consistency between the risk management file and the performance evaluation—PMPF data is fed back into the risk assessment in a structured manner.

Working Hand in Hand with IVD Development Teams

The same applies to IVD: Create the risk management file together with your team—working hand in hand, not having it imposed from the outside.

Stefan Kemmann

Team Lead, Regulatory Affairs & Technical Documentation · Metecon GmbH

Stefan Kemmann leads the Regulatory Affairs & Technical Documentation team at Metecon, which also includes our experts in risk management according to EN 14971. With their in-depth expertise, they create a robust and sustainable risk management framework and provide reliable support during implementation. They also ensure that all interfaces with other areas of your technical documentation are consistently addressed.

Meet an expert

“We develop a risk management file in collaboration with the customer and never in isolation from their day-to-day development work. Only in this way does it become what it’s meant to be: a robust framework for decision-making and documentation throughout the entire product life cycle.”

– Stefan Kemmann, Team Lead, Regulatory Affairs & Technical Documentation, Metecon

Frequently Asked Questions About Risk Management According to ISO 14971

At what point in the product life cycle should risk management begin?

Risk management must be initiated during the early concept and development phase, as the results of the risk analysis yield design inputs that can be crucial for the selection of materials, methodology, and intended use. Starting the risk assessment too late runs the risk of making incorrect decisions during product development—potentially leading to delayed market entry and high development costs. Implementing risk management early on paves the way for sound, robust decisions throughout the entire product life cycle. Metecon supports manufacturers every step of the way, starting from the concept phase – hand in hand with your team.

How can we ensure that risk management is used as a basis for decision-making in development and during changes?

To ensure that risk management does not operate as an isolated process, interfaces with other processes must be established: Risk management must be linked to processes such as design and development, post-market surveillance, complaint handling, CAPA, clinical/performance evaluation, and change control. Metecon implements the risk management process in a way that creates a dynamic process landscape where various teams work hand in hand, ensuring that risk management is not merely a documentation tool.

How can you tell whether risk management is merely documented for form’s sake or actually functions as a robust framework for decision-making

Three indicators demonstrate this: (1) The results of the risk analysis are incorporated into design decisions. (2) Every risk control measure has been verified – with clear traceability back to the risk. (3) PMS data, vigilance events, and CAPA results are systematically fed back into the risk management process. If even one of these points is not robust, the risk management file often exists only on paper—and this quickly becomes apparent during an audit. Metecon offers a risk management gap analysis that assesses precisely this robustness.

How can use-related risks be integrated into the risk management file without causing usability evidence and risk assessments to diverge?

Potential use errors identified during the usability assessment in accordance with IEC 62366-1 must be considered in the risk management process in accordance with ISO 14971 – with a clear interface between the usability process and risk management. In practical terms, this means that identified user errors are incorporated into the risk management file and risk control measures are consistently documented. Metecon develops this interface in collaboration with the client’s risk management and usability teams to ensure that both disciplines are taken into account. Find out more on the usability engineering services page.

How should PMS, vigilance, and CAPA be integrated back into risk management so that changes remain consistent and traceable?

PMS data, vigilance reports, and CAPA findings are fed back into the risk assessment in a structured manner—via clear interfaces and lines of responsibility: What triggers an update to the risk management file? Who is responsible for which data and for which decisions? What escalation procedures are in place? When must regulatory authorities / Notified Bodies be informed? Metecon defines these interfaces and ensures the required feedback and traceability for product changes. Find out more on the PMS Services page.

Why is a formally complete risk dossier often insufficient to consistently manage changes, reviews, and regulatory decisions?

A formally complete risk management file complies with the standard, but is not a living dossier that is continuously updated throughout the product life cycle. A lack of integration of risk management into the processes of development, V&V, usability engineering, clinical/performance evaluation leads to inconsistencies in the documentation and risks regarding the product’s safety. Audits and design changes reveal whether risk management was merely a formality or actually functions as a basis for decision-making and evidence. Typical symptoms include: assessments contradicting development decisions, measures not being verified, and PMS data failing to find its way back into the risk management file. Metecon therefore develops the risk management process hand-in-hand with the client – not merely as a mandatory requirement, but as an integral part of the process landscape.

Which factors typically influence the effort required for risk management activities?

The effort required for risk management projects depends on five factors: (1) product complexity and risk class (I, IIa, IIb, III for medical devices / A–D for IVDs), (2) existing documentation base (building from scratch vs. revising an existing file), (3) level of integration with technical documentation, V&V, usability, clinical evaluation, and PMS, (4) the scope of change and variant management, (5) the desired level of support (consulting, co-creation, or full service). Following a free initial consultation, Metecon will provide a transparent cost estimate.

Ready for robust risk management in accordance with EN ISO 14971?

Start with a free initial consultation and receive a clear initial assessment of your risk management plan, risk management file, use-related risks, and interface consistency with V&V, clinical evaluation/performance evaluation, and the PMS.