How to estimate and evaluate risk
ISO 14971:2019 §6.3 – §6.4 — Risk estimation and risk evaluation
The short answer
Risk = Probability of harm × Severity of harm. You estimate these two parameters for each hazardous situation, calculate a risk score, then compare it to the acceptability criteria defined in your Risk Management Plan to decide whether the risk is acceptable, ALARP, or unacceptable.
The risk formula: probability × severity
ISO 14971:2019 defines risk as the combination of the probability of occurrence of harm and the severity of that harm. In practice, most manufacturers implement a numerical risk matrix with ordinal scales for both parameters.
In the 2019 edition, probability of harm is expressed as the product of two sub-probabilities:
- P1 — probability of the hazardous situation occurring (given that the hazard exists and the sequence of events unfolds)
- P2 — probability that the hazardous situation leads to harm (given that someone is exposed to the hazardous situation)
Combined: P(harm) = P1 × P2. This two-level model allows more granular analysis — particularly for software where the same code defect might create a hazardous situation but the clinical consequence depends on whether the operator detects and overrides it.
Severity scale
| Level | Label | Definition | Examples |
|---|---|---|---|
| S1 | Negligible | No injury; discomfort only | Minor skin irritation, transient discomfort |
| S2 | Minor | Minor, reversible injury; no permanent impairment | Small laceration, temporary pain, minor bruising |
| S3 | Serious | Significant injury, possible permanent impairment | Burns, fractures, organ damage, prolonged hospitalization |
| S4 | Critical | Life-threatening or major permanent impairment | Severe hemorrhage, major organ failure, permanent disability |
| S5 | Catastrophic | Death | Fatal outcome |
Probability scale
| Level | Label | Frequency range |
|---|---|---|
| P1 | Improbable | Less than 1 in 1,000,000 uses |
| P2 | Remote | Less than 1 in 100,000 uses |
| P3 | Occasional | Less than 1 in 1,000 uses |
| P4 | Probable | Less than 1 in 100 uses |
| P5 | Frequent | 1 in 100 or more uses |
The 5×5 risk matrix and acceptability regions
The risk score (S × P) is plotted on a 5×5 matrix. The matrix is divided into three acceptability regions — the boundaries of which must be defined in the Risk Management Plan before any assessment begins:
| Score range | Region | Decision required |
|---|---|---|
| 1–4 | Acceptable | Risk is acceptable as-is; document the decision |
| 5–9 | ALARP | Reduce further if reasonably practicable; justify if not |
| 10–25 | Unacceptable | Risk controls are mandatory; benefit-risk analysis required if controls not sufficient |
These boundary values (4/5 and 9/10) are common but not mandated by ISO 14971 itself. Your Risk Management Plan can define different boundaries — but once defined, they cannot be changed mid-assessment without documented justification.
Methods for estimating probability
- Field data and post-market surveillance: complaint rates, MDR/MAUDE database, literature searches for similar devices
- FMEA occurrence rating: engineering judgment based on component reliability, process capability, and test data
- Fault tree quantitative analysis: combining failure rates from reliability databases (MIL-HDBK-217, FIDES) with logical gate probabilities
- Clinical literature: published complication rates for procedures the device supports
- Expert judgment: documented consensus from clinical and engineering experts when data is unavailable
Risk evaluation: comparing to acceptability criteria
Risk evaluation (ISO 14971:2019 §6.4) is the act of comparing the estimated risk against the criteria defined in the Risk Management Plan. If the risk is acceptable, document the decision and proceed. If it falls in the ALARP or unacceptable region, risk controls are required.
The risk acceptability criteria must be established before the risk assessment is performed — not after risks are known. Changing criteria post-hoc to make risks appear acceptable is a common audit finding and constitutes a serious process failure.
Benefit-risk analysis
When residual risk remains in the ALARP or unacceptable region after all practicable controls have been applied, ISO 14971:2019 §7 and §8 require a benefit-risk determination. The medical benefits of the device must be weighed against the remaining risks. If benefits outweigh risks, the overall residual risk may be judged acceptable — but this decision must be documented with explicit justification and clinical evidence.