Identify, evaluate and control QMS risks for medical device design, manufacture, and post-market — ISO 13485:2016 Clause 8.2.2 aligned
ISO 13485:2016 Auto-Save MDR / FDA / ISO 14971 CSV · TXT · JSON PDF Export Lifecycle Phase Tracking
New QMS Risk Entry
General Information
Risk Details
Risk Evaluation (Severity × Probability × Detectability — FMEA-style)
Risk Priority Number (RPN) = Severity × Probability × Detectability. Threshold for mandatory action: RPN ≥ 50. Per ISO 14971, any catastrophic severity (S=5) requires action regardless of RPN.
–RPN
–
Complete all three scoring dimensions above
Controls & Risk Treatment
ISO 14971 — Medical Device Risk Management Link
ISO 13485 requires implementation of risk management throughout the product lifecycle (Clause 7.1). ISO 14971:2019 is the dedicated risk management standard for medical devices and provides the detailed risk management process referenced by ISO 13485. Together these standards ensure safe, effective devices reach patients.
Hazard Identification
ISO 14971 Clause 5: Identify all hazards associated with the device, its intended use, and foreseeable misuse. Consider physical, chemical, biological, electrical, and functional hazards.
Risk Estimation
Clause 6: Estimate probability of hazardous situation occurring and severity of resulting harm. Risk = Probability × Severity. Document all assumptions and data sources.
Risk Evaluation
Clause 7: Compare estimated risk against risk acceptability criteria defined in Risk Management Plan. Is the risk acceptable? Must benefit outweigh risk for medical devices.
Risk Control
Clause 8: Apply controls in priority order — (1) Inherently safe design, (2) Protective measures in device or manufacture, (3) Information for safety/training. Verify effectiveness.
Residual Risk / Benefit-Risk
Clause 9: Evaluate overall residual risk. For medical devices, residual risk must be judged acceptable based on benefit to patient. Required for MDR Technical Documentation.
Post-Market Monitoring
Clause 10: Production & post-production information (PMS/PMCF). Review risk file in light of post-market data, complaints, vigilance reports, literature surveillance.
ISO 14971 vs ISO 13485: ISO 14971 governs product risk management (patient safety, device hazards). ISO 13485 governs QMS risk (process failures, quality system risks). This tool covers both dimensions — use the Risk Type field to distinguish product risks (ISO 14971 scope) from QMS/process risks (ISO 13485 scope). For full product risk management per ISO 14971, a dedicated Risk Management File (RMF) is required.
Medical Device Lifecycle — ISO 13485 Scope
ISO 13485 requires risk management throughout the entire medical device lifecycle. Risks must be identified and controlled at each phase, from initial concept through to decommissioning.
Risk management must be part of product realisation planning. Risk management activities must be documented and planned across the entire lifecycle per ISO 14971.
7.3 – Design Controls
Design FMEA, design verification, design validation, design reviews, risk inputs/outputs. Risk management must be integrated into all D&D activities (7.3.1–7.3.10).
7.5 – Production Controls
Process FMEA (PFMEA), process validation, sterilisation validation, contamination control, traceability. Risk drives validation requirements for special processes.
8.2.2 – Complaint Handling
All complaints must be evaluated for regulatory reportability. Risk assessment drives complaint decisions — investigate, report, or close without CAPA.
8.5 – CAPA
Risk assessment determines CA/PA priority and scope. Effectiveness of actions must be verified and documented. 8.5.2 CA, 8.5.3 PA — both risk-driven.
8.3 – Nonconforming Product
Risk assessment must be performed for all nonconforming product decisions — rework, scrap, use-as-is, or concession. Documented risk justification required.
Note: Catastrophic severity (S=5) is always Critical regardless of RPN — patient fatality or life-threatening injury cannot be accepted on probability grounds alone.
Medical Device QMS Risk Register
All QMS risks and product risks — filter, edit, export. Auto-saved in browser.
0
Total Risks
0
Critical
0
High
0
Medium
0
Low
0
Open
0
CAPA Raised
ID
Date
Type
Lifecycle Phase
Category
Description
S
P
D
RPN
Risk Level
Decision
Regulation
Res.RPN
Status
Owner
Target
Actions
No QMS risks recorded yet
Add your first medical device risk using the Tool tab above
Medical Device Risk Matrix
Severity × Probability — ISO 14971-aligned 5×5 risk evaluation matrix
5×5 Risk Matrix (Severity × Probability)
S × P matrix (without detectability) for quick visual risk evaluation. For full FMEA scoring use RPN = S × P × D. Detectability does not reduce regulatory reportability obligations.
Risk is acceptable. Maintain current controls. Document in risk register. Review at scheduled intervals or on design/process change. No regulatory reporting required.
Low (S×P: 5–8)
Risk is acceptable with controls. Verify controls are effective. Consider whether additional preventive actions would be beneficial. Monitor via post-market surveillance data.
Unacceptable. Immediate risk reduction required. Consider production hold or device recall if in-market. Mandatory regulatory reporting evaluation. Senior management escalation. CAPA required. Stop activities if S=5 (catastrophic).
Regulatory Framework Reference
Key regulations and standards applicable to medical device QMS risk management
ISO 13485:2016
Quality management system standard specifically for medical device manufacturers and suppliers. Recognised globally and referenced by EU MDR, MHRA, Health Canada and others.
EU Medical Devices Regulation — mandatory for CE marking of medical devices in European market. Significantly stronger requirements than previous MDD/AIMD.
FDA Quality System Regulation for medical device manufacturers selling in the US. Now harmonised with ISO 13485 through FDA QMSR (2024).
Key Requirements: • Design Controls (§820.30) — design FMEA • Process Validation (§820.75) • CAPA (§820.100) — risk-based prioritisation • Complaint Handling (§820.198) • MDR Reporting (21 CFR 803) — 30-day/5-day • Device Master Record & History Record • 510(k) or PMA pre-market submission • FDA QMSR (March 2024) aligns with ISO 13485
ISO 14971:2019 — Risk Management
The dedicated medical device risk management standard. Required by ISO 13485, EU MDR, FDA, and all major regulatory frameworks. Mandatory for CE marking and 510(k)/PMA.
Key Process: • Risk Management Plan (RMP) • Hazard identification & hazardous situations • Risk estimation (Probability × Severity) • Risk evaluation vs acceptability criteria • Risk control measures (3-step hierarchy) • Benefit-risk analysis • Residual risk evaluation & acceptance • Risk Management Report (RMR) • Production & post-production information
IEC 62304 — Medical Device Software
Software lifecycle requirements for medical device software (MDSW) and Software as a Medical Device (SaMD). Mandatory for devices with software components.
Software Safety Classes: • Class A — No injury or damage • Class B — Non-serious injury possible • Class C — Serious injury or death possible Key Requirements: • Software development planning • Software requirements analysis • Software architecture design • Software unit implementation & testing • Software integration & system testing • Maintenance & change management
IEC 62366 — Usability Engineering
Usability engineering (human factors) for medical devices. Required by EU MDR Annex I, FDA guidance. Critical for risk reduction from use errors.
Key Activities: • Intended use & user groups definition • Use-related risk analysis (URRA) • Formative usability studies • Summative validation testing • Usability engineering file • Known use errors & misuse scenarios • User interface design requirements • Human factors engineering report
Note: This tool is designed to support ISO 13485 QMS risk management activities. For full medical device risk management per ISO 14971, a comprehensive Risk Management File (RMF) must be maintained separately. This tool does not replace legal or regulatory advice — always consult qualified regulatory affairs professionals and verify compliance with applicable regulations in your target markets.
Contact ISO Xpert
Your ISO certification experts — London-based, globally trusted
⚕ Ready to achieve ISO 13485 Certification?
Our expert medical device QMS consultants guide you through every step of certification and regulatory compliance.
These Terms govern use of the website and digital tools provided by ISO Xpert Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
1. Acceptance
By using this tool, you confirm you are at least 18 years of age and agree to these Terms.
2. Intellectual Property
All content — including the ISO 13485 Risk Assessment Tool, text, graphics, logos and software — is the exclusive property of ISO Xpert Ltd, protected by UK copyright law and international treaties. ISO Xpert™ and the ISO Xpert logo are proprietary trademarks. Reproduction without prior written permission is prohibited.
3. Important Medical Device Disclaimer
This tool is a practical QMS support aid only. It does not constitute professional regulatory, medical, clinical, legal or certification advice. Medical device risk assessments must be performed by qualified regulatory affairs professionals, qualified persons responsible for regulatory compliance (PRRC), and other competent experts as required by applicable regulations. This tool does not replace ISO 14971 Risk Management Files, Design Files, Technical Documentation, or any other regulatory submissions. Organisations are solely responsible for ensuring their devices and QMS comply with all applicable regulations in their target markets (EU MDR, FDA, MHRA, etc.).
4. Limitation of Liability
ISO Xpert Ltd shall not be liable for any regulatory, clinical, patient safety, or commercial consequences arising from use of this tool. Use of this tool does not constitute regulatory advice or warranty of regulatory compliance.
5. Governing Law
Laws of England and Wales. Disputes subject to exclusive jurisdiction of courts of England and Wales.
ISO 13485 Medical Device — Frequently Asked Questions
Quick answers about the ISO 13485 Medical Device gap analysis tool, data privacy, audit preparation, and ISO Xpert consulting.
What is the ISO 13485 Medical Device gap analysis tool and how does it work?
The ISO 13485 Medical Device gap analysis tool is a free browser-based checklist that compares your current management system against the clauses of ISO 13485 Medical Device. You answer clause-by-clause questions and rate each requirement as Compliant, Partial or Non-compliant. The tool calculates a live compliance score, highlights gaps on a heat-map, captures evidence and corrective-action notes, and exports the full assessment as JSON, CSV, TXT or print-ready PDF for management review and Stage 1 / Stage 2 audit preparation.
Is the ISO 13485 Medical Device gap analysis tool really free to use?
Yes — the ISO 13485 Medical Device tool is 100% free with no sign-up, no email capture, no credit card, no watermarks, and no usage limits. It runs entirely in your browser; nothing is transmitted to ISO Xpert servers. You can clear or export your data at any time.
Where is my ISO 13485 Medical Device assessment data stored?
All ISO 13485 Medical Device assessment data is stored locally in your browser’s storage. Nothing is uploaded to our servers. This makes the tool GDPR-friendly and suitable for confidential audit data classified up to Restricted. Export anytime as JSON (re-importable), CSV (Excel-pivotable), TXT (executive summary) or PDF (audit-trail evidence).
Can I use this tool to prepare for ISO 13485 Medical Device certification or surveillance audits?
Yes. The ISO 13485 Medical Device gap analysis is designed to support preparation for certification by UKAS-, IAS- or ANAB-accredited bodies. Use the exported report as evidence of internal audit, feed it into management review, and prioritise high-severity non-conformities ahead of Stage 1 / Stage 2 visits. ISO Xpert consultants can assist with documented information, internal audits and full implementation if required.
How long does a ISO 13485 Medical Device gap analysis typically take?
Most users complete an initial ISO 13485 Medical Device gap analysis in 60 to 120 minutes for a single site, depending on system maturity and clause depth. The tool auto-saves continuously, so you can pause, switch devices via JSON export/import, and resume at any time. Re-assessments after corrective action usually take 20 to 40 minutes.
Does ISO Xpert offer ISO 13485 Medical Device consulting or training?
Yes. ISO Xpert Ltd (London, UK) provides ISO 13485 Medical Device gap analysis consulting, internal audits, Stage 1 and Stage 2 certification preparation, lead auditor / internal auditor training, and full management-system implementation. Contact info@iso-xpert.com or WhatsApp +44 7853 109840.
