ISO 13485:2016 also uses risk-based decision making as a foundation. The ISO references “where appropriate” 26 other times within the standard. Essentially, this was done to allow companies the flexibility to “right size” the QMS (quality management system) to meet appropriate business and regulatory needs.