# ISO 14971 Risk Management File Template & Example

> Use this ISO 14971 risk management file template and example table to organize intended use, hazards, risk controls, residual risk, and review questions.


Published: 2026-07-10

URL: https://rakenne.app/templates/iso-14971-risk-management-file-template/index.md


## What this template helps you prepare

An ISO 14971 risk management file connects the device's intended use and foreseeable misuse to hazards, hazardous situations, harms, risk controls, verification evidence, residual-risk decisions, and post-market feedback. The value of the structure is traceability: a reviewer can follow one risk from its initial analysis through control and final conclusion.

Use this as an example of how to make that chain visible. It does not determine risk acceptability for a device, replace the manufacturer's risk management process, or establish regulatory conformity.

## ISO 14971 risk management file template outline

| File section | Include | Reviewer should confirm |
| --- | --- | --- |
| Risk management plan | Device, intended use, foreseeable misuse, patient or user population, responsibilities, acceptance criteria, and planned reviews | The plan is version-controlled and the criteria are defined before risk decisions are made. |
| Hazard identification | Hazards, reasonably foreseeable sequences of events, hazardous situations, and harms | Hazards and misuse scenarios cover the device lifecycle and are not limited to known failures. |
| Risk analysis | Severity, P1, P2, initial evaluation, and rationale or evidence for estimates | The method follows the manufacturer's plan and assumptions are documented. |
| Risk control | Inherent safety by design, then protective measures, then information for safety | Lower-priority controls are not used without considering higher-priority options. |
| Verification and residual risk | Evidence a control was implemented and effective; residual-risk estimate and evaluation | Verification evidence is linked and residual risk is not assumed to be acceptable. |
| Benefit-risk and overall conclusion | Per-risk rationale where needed, overall residual-risk evaluation, and risk management report conclusion | Per-risk and overall conclusions are separate and supported by evidence. |
| Production and post-market feedback | Complaints, PMS or PMCF, vigilance, literature, review triggers, and update decisions | New information can trigger re-evaluation of the risk file. |

### Example risk-analysis table

| ID | Hazard / sequence | Hazardous situation / harm | Initial estimate | Risk control and verification | Residual decision |
| --- | --- | --- | --- | --- | --- |
| R-01 | [Energy source] / [foreseeable sequence] | [Hazardous situation] / [harm] | S: [ ] · P1: [ ] · P2: [ ] · [evaluation] | Design: [control]; verification: [test or review record] | S: [ ] · P1: [ ] · P2: [ ] · [acceptable or rationale needed] |
| R-02 | [Use error or misuse] / [sequence] | [Hazardous situation] / [harm] | S: [ ] · P1: [ ] · P2: [ ] · [evaluation] | Protective measure: [control]; verification: [evidence] | S: [ ] · P1: [ ] · P2: [ ] · [acceptable or rationale needed] |

For every row, keep the reason for the estimate and the link to verification material with the risk record. If a residual risk remains above the defined acceptability criteria, record the applicable benefit-risk rationale rather than leaving the conclusion implicit.

{{< acquisition-cta >}}

## Information to gather before drafting

- Device description, intended use, contraindications, user and patient populations, and foreseeable misuse.
- Current hazard analyses, FMEA or FTA material, design inputs, test results, complaints, and prior risk-file versions.
- The manufacturer's approved severity, probability, and acceptability criteria, including the method for P1 and P2 if used.
- Proposed risk controls, control-verification records, and any residual-risk or benefit-risk evidence.
- Production and post-market feedback sources, owners, and triggers for updating the file.

## Checks to run, and what they do not decide

The matching Rakenne workflow can flag entries that mention high or unacceptable risk but lack a risk control or benefit-risk justification. It helps make a missing link visible while the document is being drafted or updated.

That check is not a risk assessment, a verification activity, or a regulatory decision. The manufacturer and qualified risk-management, clinical, quality, and regulatory personnel remain responsible for the estimates, evidence, residual-risk determinations, and overall benefit-risk conclusion.

## Common review questions

### Is a risk control complete once it is listed?

No. Document the control in the appropriate priority order and link it to evidence that it was implemented and is effective before accepting residual risk.

### Why separate per-risk and overall residual risk?

An individual risk can be evaluated after its controls, while the aggregate of residual risks needs its own overall evaluation. Keep both conclusions visible so neither is silently inferred from the other.

### Where does post-market information belong?

The file should identify the feedback sources and what new information triggers a review. Link the resulting decision back to the relevant risk record or report update.

## Related medical-device resources

- [ISO 14971 Risk File Author](/skills/iso14971-risk-file-author/) — guided structure and a check for missing risk-control or benefit-risk links.
- [ISO 14971 risk file structure explained](/learn/tutorials/iso14971-risk-file-structure-explained/) — a deeper walkthrough of the workflow, references, and validation check.
- [Design Dossier Elaborator](/skills/design-dossier-elaborator/) — carry the reviewed risk summary into broader medical-device technical documentation.
- [Rakenne vs ChatGPT for an ISO 14971 risk management file](/learn/best-practices/rakenne-vs-chatgpt-iso14971-risk-management-file/) — compare the approaches using a fixed synthetic scenario and stated limitations.


---

Back to [Document Templates & Examples](https://rakenne.app/templates/index.md)