Is this a complete ISO 14971 risk management file?

No. It is a starting structure and example table. The manufacturer must establish the applicable process, risk acceptability criteria, evidence, and conclusions for its device and markets.

Can I use a single risk score instead of severity, P1, and P2?

Use the method defined in the manufacturer’s risk management plan. The example keeps severity and the two probability factors visible because the matching workflow uses that structure when organizing risk analysis.

Does the workflow approve residual risk?

No. It can flag risk entries above the stated acceptability threshold that lack a control or benefit-risk justification. Responsible personnel must assess the evidence and make the residual-risk and overall benefit-risk determinations.

Medical-device risk file template

ISO 14971 Risk Management File Template & Example

A reviewable starting structure for connecting hazards, controls, residual risk, benefit–risk rationale, and post-market feedback.

Use the reviewable outline below before deciding whether to start a guided workflow.

What this template helps you prepare

An ISO 14971 risk management file connects the device’s intended use and foreseeable misuse to hazards, hazardous situations, harms, risk controls, verification evidence, residual-risk decisions, and post-market feedback. The value of the structure is traceability: a reviewer can follow one risk from its initial analysis through control and final conclusion.

Use this as an example of how to make that chain visible. It does not determine risk acceptability for a device, replace the manufacturer’s risk management process, or establish regulatory conformity.

ISO 14971 risk management file template outline

File section	Include	Reviewer should confirm
Risk management plan	Device, intended use, foreseeable misuse, patient or user population, responsibilities, acceptance criteria, and planned reviews	The plan is version-controlled and the criteria are defined before risk decisions are made.
Hazard identification	Hazards, reasonably foreseeable sequences of events, hazardous situations, and harms	Hazards and misuse scenarios cover the device lifecycle and are not limited to known failures.
Risk analysis	Severity, P1, P2, initial evaluation, and rationale or evidence for estimates	The method follows the manufacturer’s plan and assumptions are documented.
Risk control	Inherent safety by design, then protective measures, then information for safety	Lower-priority controls are not used without considering higher-priority options.
Verification and residual risk	Evidence a control was implemented and effective; residual-risk estimate and evaluation	Verification evidence is linked and residual risk is not assumed to be acceptable.
Benefit-risk and overall conclusion	Per-risk rationale where needed, overall residual-risk evaluation, and risk management report conclusion	Per-risk and overall conclusions are separate and supported by evidence.
Production and post-market feedback	Complaints, PMS or PMCF, vigilance, literature, review triggers, and update decisions	New information can trigger re-evaluation of the risk file.

Example risk-analysis table

ID	Hazard / sequence	Hazardous situation / harm	Initial estimate	Risk control and verification	Residual decision
R-01	[Energy source] / [foreseeable sequence]	[Hazardous situation] / [harm]	S: [ ] · P1: [ ] · P2: [ ] · [evaluation]	Design: [control]; verification: [test or review record]	S: [ ] · P1: [ ] · P2: [ ] · [acceptable or rationale needed]
R-02	[Use error or misuse] / [sequence]	[Hazardous situation] / [harm]	S: [ ] · P1: [ ] · P2: [ ] · [evaluation]	Protective measure: [control]; verification: [evidence]	S: [ ] · P1: [ ] · P2: [ ] · [acceptable or rationale needed]

For every row, keep the reason for the estimate and the link to verification material with the risk record. If a residual risk remains above the defined acceptability criteria, record the applicable benefit-risk rationale rather than leaving the conclusion implicit.

Ready to turn this outline into a working draft?

Start the ISO 14971 risk file workflow

Start with your real inputs. Rakenne guides the draft and checks its workflow rules; your qualified reviewer remains responsible for the final document.

Information to gather before drafting

Device description, intended use, contraindications, user and patient populations, and foreseeable misuse.
Current hazard analyses, FMEA or FTA material, design inputs, test results, complaints, and prior risk-file versions.
The manufacturer’s approved severity, probability, and acceptability criteria, including the method for P1 and P2 if used.
Proposed risk controls, control-verification records, and any residual-risk or benefit-risk evidence.
Production and post-market feedback sources, owners, and triggers for updating the file.

Checks to run, and what they do not decide

The matching Rakenne workflow can flag entries that mention high or unacceptable risk but lack a risk control or benefit-risk justification. It helps make a missing link visible while the document is being drafted or updated.

That check is not a risk assessment, a verification activity, or a regulatory decision. The manufacturer and qualified risk-management, clinical, quality, and regulatory personnel remain responsible for the estimates, evidence, residual-risk determinations, and overall benefit-risk conclusion.

Common review questions

Is a risk control complete once it is listed?

No. Document the control in the appropriate priority order and link it to evidence that it was implemented and is effective before accepting residual risk.

Why separate per-risk and overall residual risk?

An individual risk can be evaluated after its controls, while the aggregate of residual risks needs its own overall evaluation. Keep both conclusions visible so neither is silently inferred from the other.

Where does post-market information belong?

The file should identify the feedback sources and what new information triggers a review. Link the resulting decision back to the relevant risk record or report update.

ISO 14971 Risk File Author — guided structure and a check for missing risk-control or benefit-risk links.
ISO 14971 risk file structure explained — a deeper walkthrough of the workflow, references, and validation check.
Design Dossier Elaborator — carry the reviewed risk summary into broader medical-device technical documentation.
Rakenne vs ChatGPT for an ISO 14971 risk management file — compare the approaches using a fixed synthetic scenario and stated limitations.