All insights
Risk reviewPostmarket evidence cleanupSource review as of 2026-06-11

ISO 14971 Risk Matrix vs FMEA RPN: Medical Device Review Checklist

When a risk owner is preparing a product risk-review meeting, the problem is that an engineering score can be mistaken for a complete risk decision without source basis, controls, residual questions, and owner judgment. The useful output is a risk-priority review map that keeps source facts, owner questions, and qualified-review boundaries visible.

The useful output is a risk-prioritization workpaper that maps FMEA rows into ISO 14971 review questions without treating an RPN number as a qualified conclusion about product safety, effectiveness, acceptability, or market action.

For one risk owner before a product risk-review meeting.

The RPN review moment

Picture the founder and RA/QA lead before a design review. Engineering has a spreadsheet with FMEA scores, but the reviewer asks which hazard sequence, risk-control evidence, residual-risk question, and owner decision the score represents.

The useful move is not to argue over one number. The useful move is to convert the score into a source-backed risk-review packet that qualified reviewers can inspect.

Risk-prioritization workpaper

Workpaper rowWhat to capture
TriggerDesign change, complaint trend, supplier issue, usability signal, PMS signal, verification result, or review question.
Source ledgerISO 14971, FDA recognized-standard page, IEC 60812, QMSR, EU MDR, internal risk file, design-control records, and access dates.
FMEA rowFailure mode, cause, effect, detection assumption, score basis, and source limit.
ISO 14971 review questionHazard, hazardous situation, harm, severity, probability, control evidence, residual-risk question, and owner.
Decision boundaryOpen risk acceptability, benefit-risk, clinical, regulatory, legal, design, quality, and leadership decisions.

What good looks like

A useful risk packet lets a reviewer trace from an engineering row to a risk-management question. It shows why the row matters, which evidence supports it, which evidence is missing, and which conclusion still belongs to qualified review.

The packet should preserve uncertainty. If a probability estimate, severity rationale, detection assumption, or risk-control record is weak, the weakness belongs in the review artifact.

Source ledger

ISO 14971:2019, Medical devices - Application of risk management to medical devices

What it can tell you

The official ISO page for the medical-device risk-management standard and its scope at a high level.

What it cannot decide

Whether one hazard, harm, probability, risk-control measure, or residual-risk decision is acceptable.

FDA Recognized Consensus Standards, ISO 14971 detail

What it can tell you

FDA recognized-consensus-standard context for ISO 14971 and its general risk-management process scope.

What it cannot decide

Whether a declaration, risk file, or device-specific risk-management argument will satisfy FDA review.

IEC 60812:2018, Failure modes and effects analysis

What it can tell you

Official IEC context for FMEA and FMECA as analysis techniques.

What it cannot decide

Whether a medical-device FMEA row can replace hazard, harm, risk-control, or residual-risk review.

eCFR 21 CFR Part 820, Quality Management System Regulation

What it can tell you

Current Part 820 QMSR context for quality-system records and finished-device controls.

What it cannot decide

How one risk-management file, FMEA table, or design-control record should be accepted.

Regulation (EU) 2017/745, EUR-Lex

What it can tell you

EU MDR source context for risk, benefit-risk, PMS, and manufacturer obligations.

What it cannot decide

Whether a device-specific risk-management file, clinical argument, or conformity position is acceptable.

Frequently asked questions

Can an FMEA RPN number decide medical-device risk acceptability?

No. This checklist treats FMEA scoring as one review input. Risk acceptability, residual-risk, benefit-risk, clinical, regulatory, legal, and design decisions remain with qualified reviewers.

What should be in the source ledger?

Include ISO 14971, FDA recognized-standard context, IEC 60812, QMSR, EU MDR, internal risk-file records, design-control records, complaint or PMS evidence, access dates, and source limits.

Need an ISO 14971 vs FMEA review packet?

Send the FMEA row, design trigger, or PMS signal. We can scope a source-backed risk-prioritization workpaper for qualified review.

Reader feedback

Useful pages should feed the next topic choices. Leave a signal or a short comment.

0 approved comments0 awaiting review
Comments are reviewed before they appear publicly. Keep it non-confidential and focused on what helped or what was still unclear.