Device Risk Management Files for Medical Device Manufacturers
Pubrica writes ISO 14971 risk management files for medical device manufacturers. ISO 14971 describes a risk management process that runs throughout the product lifecycle and uses production and post-production information, and the file is the record of that process. Our device risk management writers prepare the risk management plan, hazard analysis, risk control and residual risk evaluation, connect the file to your clinical and post-market evidence, and document the overall residual risk judgement explicitly.
- To ISO 14971:2019 with Amendment 1:2021, read alongside ISO/TR 24971:2020, which provides most of the practical guidance
- Hazards traced to harms, and controls traced to verification, so that every control in the file has evidence of its effectiveness
- The overall residual risk evaluated as a separate judgement, not as a summary of the individual risks, which is the step most often omitted
- Production and post-production information fed back into the file, from complaints, vigilance, PMS and PMCF, with the file updated when the data indicate a change
- Consistent with the CER, the GSPR checklist and the SSCP, because an assessor reads them together and the benefit-risk conclusion must be consistent across all of them
Risk management plan and file structureIncluded
Hazard analysis traced to harmsIncluded
Control verification tracedIncluded
Overall residual risk evaluationIncluded
Lowering risk scores to reach acceptabilityNot offered
Hazards → estimated → controlled → verified → overall residual
- ISO 14971:2019+A1 with TR 24971
- Hazards traced through to harm
- Controls traced to verification evidence
- Overall residual risk judged separately
- Post-production information fed back
Deliverables
Four Core Elements of Every Device Risk Management File
ISO 14971 describes a process, and auditors test whether the file records that process or was produced only to appear compliant.
From the traceability matrixA control listed without a verification reference is the most common audit finding in a risk file. It is a documentation failure rather than a safety failure, and it can be avoided entirely.
From the fileAll individual residual risks have been evaluated as acceptable. Overall residual risk is therefore acceptable.Individual risks are each acceptable. Considered together, the combination of the migration risk and the delayed-detection risk in the elderly subgroup raises the overall position, which is evaluated against the clinical benefit established in the CER and judged acceptable on the following grounds.
From the reviewThe 2019 revision emphasised this feedback process. A file whose risk estimates have not changed despite years of complaint data has not been updated with that information.
From the cross-readA risk that is accepted in the risk file, missing from the SSCP and described differently in the CER shows that three documents were written by three people without comparison.
All samples are illustrative and anonymised. Hover over a sample to replay it.
Compliance and Standards
Four Governing Standards and Guidelines for Device Risk Management Files
ISO 14971 and its technical report, read alongside the EU MDR.
Risk management for devices (with ISO/TR 24971:2020)
Defines risk management as a lifecycle process: hazard identification, risk estimation and control, overall residual risk acceptability, and the feedback of production and post-production information into the file.
Medical Device Regulation (the regulation itself)
Article 32 for the SSCP, Articles 83 to 86 for post-market surveillance, Annex I for the general safety and performance requirements, Annex II for technical documentation and Annex XIV for clinical evaluation and PMCF.
Clinical evaluation guidance (June 2016)
The structure that Notified Bodies still assess against, read alongside MDCG 2020-13, which is the assessment template that assessors use.
Quality management (cert. H3CR9TCU20251212INDQM10N)
Governs how each project is run, recorded and released.
Responsible Use of AI
Responsible Use of AI in Regulatory Writing
Regulatory reviewers trace each decision back to evidence and to a responsible individual. Our specialists therefore treat source traceability as more important than speed, and every statement in a document must be supported by a traceable source.
Why We Do Not Publish AI Accuracy Figures
Accuracy figures for AI tools are usually reported by the companies that sell them.
For this reason, Pubrica does not quote an accuracy figure of its own, as it would carry the same conflict of interest. We tell you which tool was used on your project, at which stage, and what a specialist changed afterwards.
Methodology
How Our Device Risk Management File Process Works
We prepare the risk management plan first, defining the acceptability criteria before any risk is estimated.
Risk management plan
We define the scope, responsibilities, acceptability criteria and verification approach before the analysis starts.
Analysis and estimation
We establish the intended use and device characteristics, identify hazards, trace hazardous situations and harms, and estimate each risk against the criteria.
Control and verification
Controls are selected in the order the standard requires, residual risk is re-estimated, and each control is traced to evidence that it was implemented and is effective.
Overall evaluation and feedback
We evaluate the overall residual risk as a separate judgement and set up the production and post-production review process so that the file is kept up to date.
Our Experts
Our Medical Device Regulatory Writing Team
The same named team of regulatory specialists works on your project from scoping to delivery, and your project coordinator introduces each member before work begins.
Writes the document against the governing template and regulatory guidance, keeps every statement traceable to its source data, and maintains the version history and comment log through each review round.
Reviews the clinical and scientific content for accuracy and confirms that each conclusion is supported by the data. The expert is matched to your therapeutic or device area.
Checks that statistical methods, tables and conclusions are consistent with the analysis plan, and reviews how the data are presented before the document reaches regulatory review.
Performs an independent check of the final document against source data, the template and the applicable regulatory checklist. Findings are logged and resolved before delivery.
Packages
Three Device Risk Management File Service Packages
Cost depends on device class, the number of hazards in the analysis and the state of any existing file.
Risk management file
A new device or a rebuild
Quoted per projectOn class and hazard count
Delivery By scope
- ✓Risk management plan with criteria
- ✓Hazard analysis traced to harms
- ✓Risk estimation against the criteria
- ✓Controls with verification traceability
- ✓Overall residual risk evaluation
- ✓Post-production feedback route
Where possible, we prepare the file alongside the clinical evaluation, because the benefit-risk conclusions must agree across both documents.
Deliverables Request a quoteFile remediation
An existing file with gaps
Quoted per projectOn file state and findings
Delivery By scope
- ✓Current file assessed against 14971:2019+A1
- ✓Traceability gaps identified
- ✓Missing verification evidence listed
- ✓Overall residual risk evaluation added where absent
- ✓Consistency with CER and GSPR restored
The most common finding is a file built to the 2012 version, with no overall residual risk evaluation and incomplete traceability to verification evidence.
Deliverables Request a quotePeriodic review
Keeping the file up to date
Quoted per projectOn review frequency
Delivery Scheduled
- ✓Complaint, vigilance and PMS data reviewed
- ✓Risk estimates compared to real-world frequency
- ✓New hazards assessed
- ✓File updated with rationale
- ✓Downstream documents flagged for update
The standard places the greatest emphasis on this review process, and it is the one most often missing.
Deliverables Request a quoteSend us your risk management file and we will test its traceability on a sample free of charge, from hazard to control to verification evidence. This is the first thing an auditor checks.
FAQs
Device Risk Management File FAQs
If your question is not answered here, ask an expert. No quote is required.
No. The names are often confused. The EU RMP is a pharmacovigilance document for medicinal products under GVP Module V.
The device risk management file is an ISO 14971 engineering and safety record, with a different regulation, different content and different reviewers.
ISO 14971:2019 with Amendment 1:2021, read alongside ISO/TR 24971:2020, which carries most of the practical guidance the standard itself does not.
Files still built to the 2012 structure can usually be identified by a missing or incomplete overall residual risk evaluation.
It assesses whether the device’s total residual risk is acceptable in relation to its benefit, which is a separate judgement from concluding that each individual risk is acceptable.
Risks that are individually acceptable can combine into an overall position that is not, particularly in a subgroup. Omission of this step is the most common gap we find.
Production and post-production information feeds the file. Complaint rates, vigilance data, PMS and PMCF findings are compared against the frequencies the analysis assumed.
Where real-world data differ, the estimates change and the controls may change too. A file that has not changed despite years of data has not been updated with that information.
Related Services
Related Medical Device Regulatory Writing Services
The benefit-risk conclusion appears in four documents and must be consistent in all of them.
1CLINICAL DOCUMENTSmust be consistent
Clinical evaluation reportWhere benefit is established. Clinical evaluation planWhere the criteria are set.2POST-MARKET DOCUMENTSinform the risk file
PMS and device PSURProduction and post-production data. PMCF plan and reportAddressing evidence gaps.3TECHNICAL DOCUMENTATIONalongside
GSPR checklistAnnex I evidence for each requirement. Technical file and 510(k)EU and US in parallel.Request a Free Traceability Check of Your Risk Management File
An auditor first checks the traceability from hazard to control to verification evidence, and a sample check quickly shows whether it is complete.