What does an auditor check for ISO 14971?

What your ISO 14971 file has to show under the EU MDR

What ISO 14971:2019 requires in the file, clause by clause

The standard does not tell you which document to hand over first. It tells you which records the risk management file has to hold, and where. We cite the structure, not the wording — the text is licensed, and your copy is the one that counts.

• Process, policy, competence — clauses 4.1 to 4.3: the process documented; the policy for risk acceptability documented, and its suitability reviewed at planned intervals with the decisions recorded; records of competence
• Risk management plan — clause 4.4, part of the file, with its minimum content a) to g): among it the criteria for risk acceptability (d), the method for evaluating the overall residual risk (e), verification activities (f) and the production and post-production activities (g); changes to the plan are recorded in the file
• Risk management file — clause 4.5: established and maintained, with traceability for each identified hazard to the risk analysis, the risk evaluation, the implementation and verification of the risk control measures, and the evaluation of residual risks; the file may be a logical construct that points to records elsewhere
• Risk analysis — clauses 5.1 to 5.5: identification of the device, of who carried it out, of scope and date (5.1); intended use and reasonably foreseeable misuse (5.2); safety-related characteristics (5.3); hazards and hazardous situations (5.4); risk estimation together with the categorisation system used for probability and severity (5.5) — each maintained in the file
• Risk evaluation — clause 6: results recorded in the file, against the criteria from the plan; clause 6 has no sub-clauses
• Risk control — clauses 7.1 to 7.6: the measures selected (7.1); verification of implementation and of effectiveness (both 7.2); residual risk evaluation (7.3); benefit-risk analysis (7.4); risks arising from risk control measures (7.5); completeness (7.6) — each with its results in the file
• Overall residual risk — clause 8: evaluated and recorded; significant residual risks disclosed in the accompanying documentation, which includes the instructions for use
• Risk management review before release — clause 9: plan implemented, overall residual risk acceptable, methods for the post-production phase in place; the results form the risk management report in the file
• Production and post-production activities — clauses 10.1 to 10.4: a documented system for collecting information, including the state of the art (10.2 f); review of that information with the results in the file (10.3); actions, with every decision and action recorded in the file (10.4)

Four connections your file has to hold — EU MDR

These connections are required by the Regulation itself — the reference is named so you can look it up instead of taking our word for it. Check each one against your own file.

• Benefit-risk determination: the Regulation knows only one. It rests on clinical data and at the same time has to carry the result of your risk management — if your clinical evaluation and your risk management file arrive at different statements, one of them is wrong. (Sections 1 and 8 of Chapter I of Annex I, and Article 61(1), of Regulation (EU) 2017/745)
• State of the art: whether a risk is acceptable when weighed against the benefit is to be judged against the generally acknowledged state of the art; the same applies to your risk control measures. What it is in your specific case is not something the Regulation states — that is yours to justify. (Sections 1 and 4 of Chapter I of Annex I)
• Feedback from post-market surveillance: what you learn after placing the device on the market has to be evaluated against hazards, risks, the benefit-risk determination and risk acceptability, and your technical documentation has to be brought up to date. For class IIa, IIb and III devices the periodic safety update report (PSUR) states the conclusions of the benefit-risk determination; for class I it is the report under Article 85. (Section 3 of Chapter I of Annex I, Article 83(3), and Articles 85 and 86)
• Serious incidents: once a serious incident has been reported, a risk assessment of that incident is part of the investigation — and its result has to reach your risk management and your technical documentation. (Article 89(1) and Section 3 of Chapter I of Annex I)

What any one notified body will focus on in an audit is not something we will tell you — we do not know it. What we tell you is what your file has to show.

How far the presumption of conformity from EN ISO 14971:2019 reaches under the MDR — and where it stops — is set out under ISO 14971 and MDR.

What has to reopen your file — the Regulation and the standard both say it

Risk management is not a one-off. Your quality management system has to include a process for corrective and preventive action (Article 10(9)(l)), and four provisions name what has to flow back into the risk management file:

• What post-market surveillance finds — evaluated for its impact on hazards, risks, the benefit-risk determination and risk acceptability, and the risk control measures adapted where necessary (Section 3 (e) and (f) of Chapter I of Annex I); the technical documentation updated accordingly (Article 83(3))
• A serious incident — after it has been reported, a risk assessment of that incident is part of the investigation (Article 89(1)); its result reaches your risk management via Section 3 of Chapter I of Annex I
• New clinical findings — the conclusions of post-market clinical follow-up are taken into account in the clinical evaluation and in risk management (Section 8 of Part B of Annex XIV)
• Information from production and post-production — ISO 14971:2019 clauses 10.3 and 10.4: the information is reviewed, a review of the file is triggered where it is relevant to safety, and every decision and action is recorded in the file

The chain clause 4.5 requires for every hazard

ISO 14971:2019, clause 4.5, requires the file to be traceable for each identified hazard — through the risk analysis, the risk evaluation, the implementation and verification of the risk control measures, and the evaluation of the residual risk. Read your own file along that chain:

1. Hazard and hazardous situation identified — clause 5.4
2. Risk estimated, with the categorisation system on record — clause 5.5
3. Risk evaluated against the criteria from the plan — clause 6
4. Risk control option chosen and implemented — clauses 7.1 and 7.2
5. Implementation verified and effectiveness verified — both clause 7.2
6. Residual risk evaluated — clause 7.3; benefit-risk analysis only where the residual risk is not acceptable and further risk control is not practicable — clause 7.4
7. Risks arising from the control measure itself checked — clause 7.5
8. Overall residual risk evaluated — clause 8 — and significant residual risks disclosed in the accompanying documentation, including the instructions for use

Whether that chain is closed for every hazard is something you can read off your own file before anyone else does. What we cannot tell you is how any one assessor will read it.