1 

Risk Basics for Medical Devices

Slide 1

Hello, my name is Joseph Tartal, and I am the Deputy Director in the Division of Industry and Consumer 

Education or D.I.C.E. I will be presenting risk basics for medical devices. Risk is a term we hear a lot 

about, and I will provide the foundational knowledge in understanding risk. During my career I have 

spent time making risk-based decision, performing risk analysis, and doing risk management as well as 

teaching and presenting on the topic of medical device risk. I think it is important to understand this 

foundation before moving on to more advanced risk concepts.

Slide 2

While preparing for this learning module I read through dozens of quotes on risk and looked at lot of 

pictures to try and visualize risk. I also spoke to a few risk management experts on where is the best 

place to begin. Eventually I came upon this picture and thought, the first step in a journey is being able 

to acknowledge that something exists. When I look at this picture, I see risk. I see individual medical 

device risk, electromagnetic environment risk, software integration risk, use risk and the list goes on and 

on. Now as someone who is also a patient, my anxiety is relieved knowing that medical device 

manufacturers have also acknowledged and identified this and the importance of risk.

Simply put, all medical devices have risk. You as the manufacturer are responsible for determining the 

risk of your medical device and if that is risk is acceptable. 

Slide 3

In this module we are going to cover the basics of risk by reviewing each of the following learning 

objectives. First, we will look at some definitions to help understand basic terms. Then I will provide a 

generic example of how events and their relationships are used to start determining risk. Next, we will 

learn about risk-based decisions and risk analysis techniques. Last, I will note the concept of risk 

management and mention the international standard for the application of medical device risk 

management, ISO14971. For these last two bullet, they will be introductions to these topics only, and 

we will delve deeper and provide more detail about them in follow up CDRH Learn modules.

Slide 4 

To begin, we will look at some important definitions. 

Slide 5

Understanding these basic terms becomes important as it will help to ensure that everyone is talking 

about the same thing during risk discussions. These definitions come mostly from the 2019 International 

Organization for Standardization, or ISO, 14971 standard, medical devices – applications of risk 

management to medical devices. 

Please note that risk and risk related terms are used by FDA. They are specifically used in several 

different FDA guidance documents that were written at different times and with different intents. 

When looking at these and risk make sure to understand the context and nuance as it relates to that 

specific document.

Slide 6

This first set of definitions I like to call the three Hs. These move in a sequential order from one to 

another. Let us start with hazard. A hazard is a potential source of harm. Next is a hazardous situation.
2 

These are circumstances in which people, property or the environment are exposed to one or more 

hazards. Then there is harm. Harm is injury or damage to the health of people, or damage to property or 

the environment. In an upcoming generic example, we will look at how each of these moves from one to 

another in this order. 

Slide 7

The next set of definitions have to do with calculating risk. First, we have probability of occurrence. As 

there is no formal definition for probability, I pulled this definition from the Merriam/Webster online 

dictionary. Probability is the chance that a given event will occur or the likelihood something will 

happen. What are the odds? For example, what are the odds I will be in a car accident today? That will 

depend on several factors. First, do I plan to drive. Where do I plan to drive? What car will I be driving; 

did I get enough rest last night? As you get further into the risk management process you will see 

probability of occurrence is where you have the greatest chance to control risk through risk mitigation.

Then there is Severity. Severity is the measure of the possible consequences of a hazard. You generally 

see this as severity of harm. Using my car accident example again, if I were in a car accident what are the 

potential outcomes, the worst-case severity is I could die. Or I could break a bone or just have my car 

damaged by being dented. Determining both are important as it helps with my next definition, risk, and 

determining risk.

Slide 8

The Center for Devices and Radiological Health has no formal, across the board definition for risk. That is 

why I noted earlier when you see the term “Risk” used, please understand the context it is being used in 

as the term is in several regulations and guidance documents written at different times over the years 

with different intents.

My starting point, and again these are my thoughts and is not a formal definition, risk is looking at the 

harm a medical device can cause to patients, end users and their environment, which includes the harm 

if the medical device were to fail and not operate as intended in both normal and fault conditions. Also 

understand we are not talking about financial risk. While I realize financial risk is important to 

manufacturers for the purpose of this discussion and module, we will stay focused only on the risk of the 

medical device.

Last, we have the formal definition as defined in the International Organization for Standardization (ISO) 

14971:2019 medical devices – applications of risk management to medical devices, section 3.18 and that 

is the combination of the probability of occurrence of harm and the severity of that harm. Both of which 

we defined earlier. This is how you will determine the risk of your medical device.

Again, all medical devices have risk.

Slide 9

However, right now we will define something new that was added to the ISO14971:2019 standard, and 

that is a definition of benefit. Benefit is the positive impact or desirable outcome of the use of a medical 

device on the health of an individual, or a positive impact on patient management or public health. As 

with risk, CDRH has no formal definition for the term “benefit.” 
3 

Slide 10

For our last definition in this risk basics module, let’s look at a couple of different sources to define risk 

analysis. The 1996 Quality System preamble mentions a few things to include in risk analysis. These are 

the identification of possible hazards, including user error. Note I have put user in brackets as the most 

current term today in use error. Risk calculation or estimation in normal and fault conditions. Risk 

acceptability determination. If not at an acceptable level, reducing risk to an acceptable level and 

evaluating changes to ensure you are not introducing new hazards. Use this as a starting guide to 

understand what is needed for risk analysis.

Slide 11

According to ISO 14971 3.19, risk analysis is the systematic use of available information to identify 

hazards and to estimate the risk. Please be aware there are many risk analysis techniques available, and 

like any tool their use depends on what you intend to get from it. I will note a few of the more common 

techniques later in this module.

Slide 12 

Now I will use a generic, universal example to show the relationships, circumstances, and sequence of 

events for looking at risk. You will recognize many of the terms we just reviewed.

Slide 13 

The words highlighted in black, and sequence of events on the slide come directly from the 2019 ISO 

14971 Risk Management Standard Annex C Figure C 1. We have a hazard that leads through a sequence 

of events to a hazardous situation.

Slide 14

The example I will use is driving a vehicle, specifically a car. Getting into a two-ton vehicle and going 

twenty plus miles per hour poses a risk. Let’s go through our scenario. 

These items in blue are my specific example of driving a car that I have added to the figure. The hazard is 

me driving in heavy traffic, something many of us in the Washington DC metro area know well. This 

heavy traffic leads to constant stop and go driving with vehicles not having much distance in between 

them. Also, this makes for a longer drive time and can cause drivers to become tired and distracted. This 

leads to a hazardous situation where the car behind me with a distracted driver hits the rear of my car.

Slide 15

We will add into the driving example the probability of the sequence of events and hazardous situation 

occurring on the right side of the slide and the circumstances that can impact severity on the left side.

We can identify the probability of the hazard occurring as P1 and then the probability of the hazardous 

situation occurring as P2. Some additional questions we can ask ourselves, is it rush hour, early in the 

morning, late in the day, what are the road conditions? Additionally for the hazard and hazardous 

situation, we can determine the circumstances that can affect the severity of the harm. These could be 

the speed I am driving, the size and type of my vehicle, car, and its safety features. Note how these are 

all building upon one another in a logical order to get to our harm.

Slide 16

In this example our harm, that occurred after our hazardous situation, is damage to the car in the form 

of a dent in the rear of the car. I used this example of harm as I have had this exact scenario occur in 

stop and go traffic. And in my case, the one hazard that I did not include is the driver behind me opening 
4 

a bag of chips that spilled distracting them. And when I had to make a quick stop because of the vehicle 

in front of me, the hazardous situation, they then hit the rear of my car resulting in a dent.

Slide 17 

The combination of that probability of occurrence and severity of harm becomes the risk for me driving.

Now think about your medical device or devices and think of similar scenarios going from hazard-tohazardous situation to calculating the probability of occurrence and severity of harm to help determine 

risk. Determining the risk of your device is an action and using this figure from ISO 14971:2019 Annex C 

is a good way to get started in making that determination and thinking of questions and answers.

Slide 18

Next, in continuing forward with providing our foundation on understanding medical device risk I will 

provide a high-level introduction to risk-based decisions, risk analysis and risk management for medical 

devices. 

Slide 19

Here are some of the places you may be looking at risk, making risk-based decisions, using risk analysis 

techniques, and performing risk management. Risk is something that occurs throughout and 

encompasses the total product life cycle. It also loops back as more information about the medical 

device becomes available.

Slide 20

You will start by determining risk during device design. From a practical standpoint, I can tell you the 

earlier you identify and understand a devices risk while designing the device the better. It is understood 

in early design you will likely be making estimates and that it is difficult to identify every potential risk.

However, by the time you get to design validation you need to have a good understanding of the risk of 

the device and confirm it.

Slide 21

Also, you will be looking at risk in the manufacturing of the device. Even if you have the lowest risk 

device design things can go wrong during manufacturing. Looking at risk during manufacturing to help 

ensure you are producing the device correctly and identifying risk in the manufacturing process is useful.

I could also draw an arrow back from manufacturing to design to show how this understanding of risk 

loops back at every stage and you could have multiple iterations of it.

Slide 22

Next, you will gather information on use and other risks in the post market realm once the device is out 

in distribution. The information you gather here is extremely important as it now shows how accurate 

you were in determining the risk in design and manufacturing. This information is looped back through, 

built upon, and does not just sit in a file untouched until the next design or design change. Per the 

bottom of these slides, these activities are actions, actions that take place multiple times throughout the 

product life cycle and continue as long as the device is on the market. Last, this list is not all inclusive, it 

is just a couple examples of where and when you may be looking at risk.

Slide 23

We will continue our discussion on risk basics for medical devices by talking about risk-based decisions.

As with the terms risk and benefit, there is no specific formal FDA definition for a risk-based decision.
5 

However throughout both our regulations and guidance documents you will find examples of the need 

to make these decisions as well as get a good understanding on the expectations.

Risk-based decision making is essential to CDRH. For example, it is incorporated in how FDA determines 

the safety and effectiveness of a device in 21 CFR 860.7(d)(1). In the regulation it talks about the 

probable benefits of a device outweighing any probable risks and that the evidence provided 

demonstrates the absence of unreasonable risk.

Also, I will use the 1996 Quality System Regulation Preamble to highlight these types of decisions that 

you will make using risk as it relates to your quality system.

Slide 24

I identified the term risk being used 35 times in the Preamble of the 1996 Quality System Regulation, 

and only once in the 1996 Quality System Regulation itself in 820.30(g) design validation. Here are a few 

preamble excerpts of risk-based decisions and expectations for them.

In a discussion on removing the term “critical device” in 1996 FDA stated, “In fact the new regulation is 

less prescriptive and gives the manufacturer the flexibility to determine the controls that are necessary 

commensurate with risk.” Who determines that risk and the controls required? You. You make that 

determination, and you are to use risk in doing it.

And concerning the amount of documentation needed for your quality system. The extent of the 

documentation necessary to meet the regulation requirements may vary with the complexity of the 

design and manufacturing operations, the size of the firm, the importance of a process, and the risk 

associated with the failure of the device, among other factors. Again, you are expected to use the risk 

associated with failure of the device as a factor in determining the extent of the documentation needed 

in your quality system.

Slide 25

And for our last preamble example, “FDA agrees that the degree of corrective and preventive action 

taken to eliminate or minimize actual or potential nonconformities must be appropriate to the 

magnitude of the problem and commensurate with the risks encountered. FDA cannot dictate in a 

regulation the degree of action that should be taken because each circumstance will be different, but 

FDA does expect the manufacturer to develop procedures for assessing the risk, the actions that need to 

be taken for different levels of risk, and how to correct or prevent the problem from recurring, 

depending on that risk assessment.”

So yet again, you must make risk-based decisions and assessments and have them in place. Since these 

circumstances are specific to your device the responsibility is on you to do it and to make these 

determinations.

Slide 26

Now, let’s see more of where FDA makes its own risk-based decisions and uses risk assessments 

regarding medical devices. Medical devices are classified based on risk. Class I medical devices being the 

lowest risk and class III being the highest. Premarket submission decisions, from IDE, 510(k) through De

Novo and Pre-Market Approval are based on risk. The Office of Regulatory Affairs (ORA) uses risk to 

schedule medical device inspections. Recall classifications are based on risk as are enforcement actions.

We even use risk analysis tools such as Health Hazard Evaluations (HHEs) and Health Risk Assessments 
6 

(HRAs) when determining a recalls classification. Just like the industry we regulate; FDA too uses risk to 

make decisions and these decisions often impact public health. 

Slide 27

Earlier we defined risk analysis and just mentioned their use in FDA recalls. There are many risk analysis 

techniques, again please understand the ones that you use and why their use is appropriate for making 

your risk determinations.

Here are three commonly used risk analysis techniques. We could spend hours talking about each one, 

and in later learning modules we will explore them in greater detail. These are Preliminary Hazard 

Analysis (PHA), Fault Tree Analysis (FTA) which is a top-down approach and Failure Mode and Effects 

Analysis (FMEA) which is a looking at individual line items, single component, or single process etc. to 

look at risk.

Please reference the ISO/TR 24971 for guidance on selected risk analysis techniques, including those for 

in-vitro diagnostic medical devices. One of the changes to the ISO 14971:2019 standard is the risk 

analysis appendices were removed and added to the TR 24971 guidance document. It is a great 

document to look at different risk analysis techniques for medical devices.

Slide 28

Speaking of the ISO 14971:2019 standard. I want to note everything we have previously talked about 

falls under the aspect of risk with the final goal you are working towards being risk management. For our 

purposes here, I am only letting you know there is a risk management standard for medical devices, and 

this is it, the AAMI/ANSI/ISO 14971:2019 Medical Devices-Application of risk management to medical 

devices. It is a systematic approach to conducting risk management activities.

We could spend an entire week just getting started on the risk management standard and its 

subsequent guidance document AAMI/ISO TR24971:2020-Medical devices, guidance on the application 

of ISO 14971.

Slide 29

In summary, understanding defined terms is key to getting started. It is important to know the 

relationships and sequence of events in determining risk. It is essential that you identify and make riskbased decisions, use appropriate risk analysis techniques, and implement risk management throughout 

the total product life cycle. Last, use FDA regulations, guidance documents and international standards 

and guidance to meet your risk needs.

Slide 30

The links on this slide are specific resources to help you understand the foundational aspects of risk.

Some are in the public domain, and some are not. Use these and educational materials such as this 

presentation on risk basics to get started in understanding the topic of risk and the risk of your medical 

device. Please note this list in not all inclusive and FDA has many more guidance documents on benefit 

risk.

Slide 31

This presentation and other helpful videos and educational resources can be found at CDRH Learn. For 

text-based information on premarket and postmarket topics including how to bring a medical device to 

market please visit device advice. For additional information on these or any other general medical 
7 

device regulatory topics, feel free to call us at the Division of Industry and Consumer Education Monday 

thru Friday from 9 am to 4:30 PM Eastern Time.

Slide 32

Let’s conclude with your call to action. Become familiar with risk. Determine the risk of your medical 

device. Build a culture that values the importance of understanding risk. Use the resources available to 

help you comply with your responsibilities.

Thanks for watching.

**********