Maps to
FDA QMSR (Part 820): §820.30(g)
ISO 13485: ISO 13485 §7.1
Requirement text
The organization shall document a risk management process throughout the product lifecycle. This includes hazard identification, risk estimation, risk evaluation, risk control, and evaluation of residual risk acceptability. FDA-Plus: Risk management must be integrated with design controls; risk analysis outputs must feed design inputs, and risk control measures must be verified and validated.
Atomic constraints
- •A risk management plan must be documented for each product.
- •Hazards must be systematically identified and analyzed.
- •Risk controls must be implemented and verified for effectiveness.
- •Residual risk must be evaluated and accepted by authorized personnel.
- •Risk management activities must be traceable throughout the product lifecycle.
- •Risk-benefit analysis must be performed when residual risk exceeds acceptable levels.
Evidence signals
- •
FILE_EXISTS
(Risk.*Management|FMEA|Hazard.*Analysis|Risk.*Assessment)
- •
CONTENT_MATCH
Does this document identify hazards, estimate risk severity and probability, define risk controls, and evaluate residual risk acceptability?
Audit defense
The Risk Management File for [your product] ([your document ID]) follows ISO 14971 and integrates with our design controls per QMSR requirements. Every identified hazard has traceable risk controls verified through V&V activities, with residual risk formally accepted by our Risk Management authority.