How to implement risk controls

ISO 14971:2019 §6.5 – §6.9 — Risk control implementation and verification

The three-tier hierarchy (§6.6b)

When a risk needs to be reduced, ISO 14971:2019 §6.5 requires you to select controls using the following priority order. You must exhaust each tier before moving to the next:

Tier 1 — Inherent safety by design

Eliminate the hazard entirely through design choices. This is the most effective form of risk control because it removes the source of the hazard rather than relying on users to avoid it.

• Use lower voltages that cannot cause cardiac fibrillation
• Round sharp edges so they cannot lacerate
• Select biocompatible materials to eliminate biological hazard
• Design software to reject out-of-range inputs rather than processing them
• Implement hardware interlocks that prevent operation in unsafe states

Tier 2 — Protective measures in the device or manufacturing process

Where the hazard cannot be eliminated by design, add guards, interlocks, alarms, or manufacturing process controls that prevent harm from occurring.

• Physical guards over cutting elements
• Electrical insulation and earthing
• Software alarms that alert the clinician before a dangerous state is reached
• Sterilization processes to eliminate biological hazard in the product
• Dose calculation limits that prevent software from recommending lethal doses
• Redundant sensors with voting logic for safety-critical measurements

Tier 3 — Information for safety

As a last resort, inform users about residual risks through labelling, warnings, and instructions for use. This tier is the least effective because it relies entirely on the user reading, understanding, and following the information.

• Contraindications in the instructions for use
• Warnings on device labelling (e.g., "Do not use near flammable gases")
• Training requirements for operators
• Maintenance schedules and inspection intervals
• Single-use designation and prohibition on reprocessing

The hierarchy in practice

Verifying control effectiveness (§6.7)

Implementing a control measure is not sufficient — you must verify that it works. ISO 14971:2019 §6.7 requires that the implementation and effectiveness of each risk control is verified before the risk estimate is updated. Verification activities include:

• Bench testing or simulation (e.g., dielectric strength testing for insulation)
• Software testing demonstrating that input range checks reject out-of-range values
• Usability evaluation (formative study) confirming that warnings are noticed and understood
• Process validation records for manufacturing controls
• Biocompatibility testing per ISO 10993 series for material changes

Controls that introduce new risks (§6.8)

Every risk control measure must be evaluated for whether it introduces new hazards or hazardous situations. This is a frequently overlooked requirement that auditors will check. Examples of controls creating new risks:

• Adding an alarm to prevent overdose → alarm fatigue leading to clinicians ignoring legitimate alerts
• Adding a needle guard → guard mechanism can jam, preventing proper use
• Adding software input validation → validation rejects valid edge-case inputs, preventing treatment
• Changing to a lower-voltage power supply → device may not function reliably, causing missed therapy

New risks introduced by controls must themselves be entered into the risk management process and controlled if necessary.

ALARP demonstration

For risks in the ALARP region, you must demonstrate that risks have been reduced as far as reasonably practicable. ALARP justification requires:

1. Identifying all plausible additional control options
2. Evaluating the technical feasibility and cost of each option
3. Documenting why any rejected option is not reasonably practicable (disproportionate effort, technical impossibility, or would introduce greater risks)
4. Performing a benefit-risk analysis if residual risk remains in the ALARP region