WorkflowDesign & Development

ISO 14971 Risk Management File Review

Risk management file review that re-checks only the hazard chains a change touches, and leaves acceptability and each signature to the people who own them.

Follow one lost warning to a signed review ↓
Watch with transcript →
The problem

A warning lost in an IFU reformat breaks the risk management file quietly

A risk management file holds hundreds of chains, one per hazardous situation. Each runs from the hazard to its risk control, the report that verifies the control, the residual risk and the sentence that tells the user about it. The links point into the lifecycle management system, the quality system and the regulatory information system, and they are traced by hand in spreadsheets before each audit.

Documents change every week. A change order releases a new IFU revision, a new FMEA row and a new verification report, and nobody can say which chains pass through them. So the team re-traces the whole file, or none of it, and a superseded report or a warning missing from one language version waits for the auditor to find it.

Built forRisk management leadsDesign quality engineersLabeling specialistsSystems engineers

The Problem Today

A change to one document can break a hazard chain silently, so whole risk files are re-traced by hand.

7
warnings US special controls require on surgical stapler labels published
40 hours
to re-trace one risk file's chains by hand our estimate

Traced by hand for each review

  • Analyses
  • Tests
  • Warnings
  • Languages
  • Warnings lost in a reformatOne revision drops a sentence the rules require
  • Superseded reports citedThe chain points to a test that is no longer current

The Solution

  1. Only touched chains checkedA change re-checks the chains that pass through its pages
  2. Each control to its proofThe verification report opened at its current revision
  3. Each warning, every languageThe disclosing sentence found on its page in each version
  4. Second person, then the leadDesign quality checks a sample; the risk management lead approves

Built-in controls

  • Agents never judge whether a risk is acceptable
  • A change clears the signature it touches
  • Post-market input stays a signed reference

What You Get

Risk files stay current between audits, and a missing warning shows up while the change order is still open.

$621,000
a year of chain tracing hours at a large device maker our estimate
  • Breaks found with their pageEach open link names its document, revision and page
  • Fixes from approved textWarnings restored from translation memory, never retyped
  • Reviews signed on current proofEach signature with its meaning, time and session
One change order, one missing warning

A risk management file re-check, and the staple line warning a reformat lost

A powered linear cutter's file holds 318 chains, 1,906 links and 11 IFU language versions. One change order launches a 60 mm reload and reformats the IFU into two columns.

demoThe device, its risk file, the people and every figure on the screens are sample data.

  1. 01Before the re-check

    One change order runs through 103 of 318 chains and clears her signature

    Risk management lead

    The rack draws the file as 318 chains on eight shelves, one per hazardous situation. The change order for the 60 mm reloads brought IFU rev F, a new design FMEA revision, and a verification report, drawing and label for the new size. 103 chains pass through a changed passage, and the other 215 keep their last check. Her earlier approval is cleared until someone signs again.

  2. 02Re-check

    102 chains stay whole, and the one that opens is a staple line crossed

    Risk management lead

    She starts the re-check and watches the agents work through it. Controls: 102 of 103 implemented and matched to the current revision of their report. Disclosure: 75 chains across 11 language versions, 825 sentence places, 814 found and 11 not found, all of them in the same chain. That chain is a staple line crossed with a later firing, severity 4.

  3. 03Re-check

    Four links open at once, because the warning was the control

    Risk management lead

    No design or protective measure can stop a surgeon choosing to cross a staple line, so this hazard's control is information for safety: the IFU warning itself. With the sentence gone, the control is not implemented in rev F, its verification fails, the residual estimate that assumed it no longer stands, and the disclosure is missing. Each open link names its document, revision and page.

  4. 04Re-check

    Rev E carried the sentence as item 9, and rev F's warnings stop at 11

    Risk management lead

    She opens the source behind the disclosure link. English page 14 of rev E sits beside pages 12 and 13 of rev F. Item 9 warned that crossing an existing staple line can increase the risk of leaks. The reformat for the 60 mm reload dropped it, and the list now holds 11 items where rev E held 12. Her reading is recorded with her session.

  5. 05Labeling

    The approved sentence goes back into all 11 versions from translation memory

    Labeling specialist

    The labeling specialist signs in as herself, opens rev E and rev F, and restores warnings item 9 word for word into draft 3, in all 11 language versions, signed as author. Only this chain is re-checked, and the warning is found in 11 of 11. The usability evidence ran on the single-column rev E layout, so that question waits for the lead.

  6. 06Sampled check

    A second person opens 3 chains the agents called whole, link by link

    Design quality engineer

    The design quality engineer signs in as himself. The rule in settings draws 3 of the 102 whole chains at random: a titanium clip caught in the 60 mm jaws, a staple line not inspected in lung tissue, an opened reload kept for a later case. He opens all six links of each beside its source and signs the sampled check, meaning Review.

  7. 07Sign-off

    She rules the rev E usability evidence still holds for the two-column IFU

    Risk management lead

    The warning's effectiveness evidence, task 14 with 15 of 15 surgeons, was run on the old layout. She reads the review packet and decides it applies to rev F, reason UL-1: the same wording, order and place in the warnings list. She signs that decision as a review. Only her conclusion on overall residual risk is still open.

  8. 08Sign-off

    317 risks sit in the acceptable region, and one was accepted on benefit-risk

    Risk management lead

    The agents set out the overall residual risk facts and draw no conclusion: 317 of 318 in the plan's acceptable region, one accepted after benefit-risk analysis, none unacceptable. She chooses acceptable under the plan's criteria herself and approves review rev 9 over IFU rev F draft 3. A later draft of the IFU would reopen it.

  9. 09Release

    The change order may now release, and the release stays in the quality system

    Risk management lead

    The change page lists what the order touched: the IFU, the design FMEA, the 60 mm verification report, drawing and label, 103 chains in all. It now reads can release, review signed. The quality release lead at the stapler plant does the release in the quality management system. Before anyone edits a document, its reach shows the chains it would touch.

103 chains to re-check, counted from the passages one change touched

A chain is counted once, at the first changed passage it runs through. The rest keep their last check.

Chains that disclose in the IFU, now at rev F75
More chains that cite the 60 mm verification report22
More chains that disclose on the 60 mm label6
Chains re-checked103
Chains that keep their last check215
Chains in the fileOn 8 shelves, one per hazard family318

demoSample data, from the working solution.

Around the review

Open reviews, source documents and signatures across each risk management file

What the lead, design quality and the auditor read between one re-check and the next.

Reviews in flightEach file under review with its reason, open chains, owner and due date. Files with new documents re-check in one run; signing stays one file at a time.
24 source documentsThe plan, the hazard analysis, three FMEAs and each verification report, with the system it lives in, its revision and the chains running through it.
Post-market inputOne signed document from the post-market team, held by its number, title and signer. The 9 chains whose estimate rests on it are marked for the lead.
SignaturesWho signed what, why, with which meaning and from which session: authorship, review or approval. The trail exports as a CSV and an evidence pack.
Rules and proposalsSample sizes, the dwell before a record counts as read, the disclosure rule and who signs what. A proposal to cut the sample waits for approval.

demoSample data, from the working solution.

Who restores, who samples and who decides a risk is acceptable

The approver never draws the sample, and nobody signs for anyone else.

Risk management lead
Sees
Open chains, the usability question and the overall residual risk facts
Signs
Decides acceptability under the plan and approves the review
Labeling specialist
Sees
Each warning by language version, one revision beside the other
Signs
Restores or writes labeling text, as its author
Design quality engineer
Sees
Sampled chains, each link beside its source passage
Signs
The sampled check, and never the approval
Systems engineer
Sees
The reach of a document before he changes a requirement
Signs
Fixes to the firmware and battery chains he owns
Notified body auditor
Sees
The signed review and the trail, as a read-only guest
Signs
Nothing; reads and exports
Head of design assurance
Sees
Proposed changes to the review rules
Signs
Approves a loosened rule someone else proposed
Who reads the file

Seven agents trace the chains, and none of them edits a document

They read, match, count and draft. People write labeling, sample and approve.

Change reader

Lists each changed document with its old and new revision and the pages, rows and sections that moved.

  • Never says why a change is acceptable
Chain builder

Builds one chain per hazardous situation from the hazard analysis and FMEAs, each link quoted with its passage.

  • Never estimates severity or probability
  • Never invents a link
Reach finder

Finds the chains that pass through a changed passage, marks them owed and clears the review signature.

  • Clears signatures, never restores them
Verification matcher

Opens each control's verification report at its current revision and checks the control tested and the result.

  • Never judges a result beyond its stated criterion
  • Never reads the post-market input
Disclosure matcher

Finds each disclosed residual risk's sentence in every IFU language version and on labels.

  • Reports not found with the pages searched, never proved absent
  • Never writes labeling
Report drafter

Drafts the review section from the chains and the decisions people made.

  • Never signs
  • Never states that a risk is acceptable
Clock keeper

Watches the change re-check clock and the audit dates for each review.

  • Cannot extend a clock

Acceptability, labeling text and post-market estimates stay with people

Here the agents only find and quote; the lead, labeling and quality release keep these calls.

No agent calls a risk acceptableThe agents gather the overall residual risk facts. The conclusion, including not acceptable, is the risk management lead's, signed under the plan.
Labeling is written by peopleA missing sentence is reported with the pages searched. The labeling specialist restores the approved text from translation memory, or writes a new one that a person must read.
Software clears a signature and never restores oneA change, a disagreement or a newer post-market input clears the approval and the sample. Downloads then say unsigned until someone signs again.
Post-market information is held as a referenceIt arrives as one signed document from the post-market team. The agents do not open it; the lead confirms each estimate that rests on it after reading it in the quality system.
Release happens in the quality systemAn approved review lets the change order release. The quality release lead releases it there.

Four systems a risk file points into, each read only

A link counts as checked only when its source passage has been opened at its current revision.

Product lifecycle managementHazard analysis, FMEAs, verification reports and drawings
Quality management systemThe plan, change orders and reports, where signatures are recorded
Regulatory information managementIFUs and labels in each language, and the translation memory
Post-market referencesSigned inputs held by number, title and signer, never opened

What risk management leads ask about risk management file review

What is a risk management file review?

A risk management file review checks that each chain in the risk management file still holds against today's documents: the hazard, its control, the report that verifies the control, the residual risk and the sentence that discloses it. Here agents do the tracing, and people fix, sample and approve.

Who calls a residual risk acceptable?

The risk management lead, under the plan's criteria, with her signature. The agents set out the facts for overall residual risk and draw no conclusion of their own.

What happens when a change order enters the file?

The change reader lists what moved, the reach finder marks only the chains that pass through a changed passage, and the review signature that rested on them is cleared. The other chains keep their last check.

How are warnings checked in other languages?

The disclosure matcher looks for each disclosed residual risk's sentence in each language version of the IFU and on labels, and quotes the page. When a sentence is missing it says not found, with the pages it searched, and the labeling specialist restores it from approved translations.

Who checks the agents' work?

A design quality engineer, never the approver, opens a random sample of the chains the agents called whole, each link beside its source, and signs the sampled check. A disagreement reopens the chain.

Does it read post-market surveillance data?

No. Production and post-production information arrives as one signed reference from the post-market team. The chains whose estimate rests on it are marked, and only the risk management lead confirms them after reading it.

What does an auditor from the notified body see?

A read-only view of the signed review and the trail: who signed, when, why, with which meaning and from which session. The evidence pack and the CSV say unsigned whenever the review is not signed.

Bring one risk file
and the change order that just landed.

We will show you which chains the change touches, and any link it broke.