What is residual risk and overall residual risk?

ISO 14971:2019 §6.9 + §7 — Residual risk evaluation and overall residual risk

The short answer

Residual risk is the risk remaining after all risk controls have been applied to a specific hazardous situation. Overall residual risk is the combined effect of all individual residual risks for the device as a whole. Both must be evaluated against acceptability criteria and, if necessary, justified through benefit-risk analysis.

Individual residual risk (§6.9)

After implementing and verifying each risk control measure, you must re-estimate the risk for each hazardous situation. The risk remaining after all controls is the residual risk. ISO 14971:2019 §6.9 requires you to:

Re-estimate the probability of harm after controls
Re-estimate the severity (if controls affect severity — e.g., a guard that limits laceration depth)
Compare the residual risk score to the acceptability criteria in the Risk Management Plan
If residual risk is unacceptable, implement further controls
If residual risk is in the ALARP region, perform benefit-risk analysis

When is residual risk "acceptable"?

A residual risk is acceptable when it falls within the acceptable region of the risk matrix as defined in the Risk Management Plan. However, "acceptable" does not mean the manufacturer decides without reference to any objective criteria. The acceptability boundaries must be:

Defined before the risk assessment begins (not post-hoc)
Justified with reference to applicable standards, regulatory guidance, and the state of the art
Consistent with national and regional regulatory requirements

A risk in the acceptable region must still be documented in the Risk Management File with a record that it was evaluated and accepted — silence is not an acceptable record.

Overall residual risk (§7)

In addition to evaluating individual residual risks, ISO 14971:2019 §7 requires an overall residual risk evaluation. This considers the aggregate effect of all residual risks:

Could the combination of multiple low-level residual risks create an unacceptable aggregate burden?
Is there a pattern of residual risks that indicates a systemic design problem?
Has the device been compared to the state of the art for similar devices?

The overall residual risk evaluation is documented in the Risk Management Report. It must conclude either that the overall residual risk is acceptable, or — if not — that medical benefits outweigh the risks.

Benefit-risk determination

When overall residual risk remains above the acceptable threshold despite all practicable controls, §7 permits the device to proceed if the medical benefits outweigh the risks. This is not a license to accept any level of risk — it requires explicit justification:

Element	What must be documented
Benefits identified	Clinical outcomes the device achieves (survival, function improvement, diagnostic accuracy)
Benefit evidence	Clinical data, literature, clinical evaluation report supporting the claimed benefits
Risk magnitude	Quantified residual risks with probability and severity estimates
Comparison to alternatives	Available treatments or diagnostic methods and their risk profiles
Conclusion	Explicit statement that benefits outweigh risks with documented rationale

Disclosure of residual risks in the IFU

ISO 14971:2019 §8 requires that all residual risks that require disclosure to users are communicated in the instructions for use or labelling. This includes:

Known contraindications where the residual risk for certain patient groups is unacceptable
Precautions required from users to maintain risk at an acceptable level
Warnings about foreseeable misuse that could lead to harm
Maintenance requirements that, if not followed, could elevate risk

What to do when residual risk remains unacceptable

If after all controls, including benefit-risk analysis, residual risk is still unacceptable:

The device cannot be released to market in its current state
Fundamental design changes are required to eliminate or reduce the unacceptable hazard
The intended use may need to be restricted to narrow the risk population
In rare cases, the device concept must be abandoned

Common mistakes in residual risk evaluation

Accepting without criteria: Declaring a risk "acceptable" without reference to pre-defined quantitative or qualitative criteria defined in the Risk Management Plan
No re-estimation after controls: Marking a risk as controlled without updating the probability and severity estimates to reflect the post-control situation
Missing overall residual risk section: Evaluating individual residual risks but omitting the aggregate overall residual risk evaluation required by §7
Post-hoc criteria setting: Defining acceptability boundaries after seeing the risk scores, then selecting thresholds that make uncontrolled risks appear acceptable
Benefit-risk without clinical data: Concluding benefits outweigh risks without citing clinical evidence for the claimed benefits