Can a device be released with unmitigated hazards still present?

Yes, as long as the resulting risk — after applying appropriate risk controls — is judged acceptable against the manufacturer's pre-defined risk acceptability criteria, and the overall benefit-risk analysis for the device remains favorable. ISO 14971 does not require eliminating every hazard, which is often impossible; it requires reducing risk as far as reasonably practicable and ensuring the residual risk is outweighed by the device's clinical benefit.

Is "probability" in the risk equation the probability of the hazard existing, or of harm actually occurring?

It is the probability of the harm occurring — which folds together the probability of the hazardous situation arising at all and the probability that, given the hazardous situation, harm actually results (sometimes a hazardous situation occurs but no harm follows, because of chance, a user intervention, or another safeguard). ISO 14971 allows either estimating this as one combined probability or, in a more detailed analysis, breaking it into the probability of the hazardous situation and the probability of harm given that situation, and multiplying them.

Does every hazard need its own row in the risk analysis, even ones that seem obviously safe?

Yes — a rigorous hazard analysis (commonly performed via FMEA, fault tree analysis, or a structured hazard identification checklist against IEC/TR 60601 or ISO 14971 Annex guidance) is expected to be exhaustive at the identification stage. A hazard can always be screened out later as negligible risk once probability and severity are estimated, but skipping identification because a hazard "seems fine" defeats the purpose of a systematic analysis and is a common audit finding.

How does risk relate to the "benefit-risk" determination required for device clearance?

Once every identified hazard's risk has been estimated and, where possible, reduced through risk controls, the residual risks that remain are summed into an overall residual risk picture for the device. Regulatory clearance requires that this overall residual risk be acceptable when weighed against the device's clinical benefit — a device with meaningfully higher residual risk can still be cleared if its benefit (treating an otherwise fatal condition, for instance) is judged to outweigh it, which is why benefit-risk determination is a distinct, final step in the risk management file, not just a restatement of the risk matrix results.

← Biomedical Engineering Studio

Concept Explainer · Biomedical Engineering

Hazard vs. Harm vs. Risk (ISO 14971)

Three words used almost interchangeably in casual conversation — and three legally distinct, separately documented concepts in every medical device risk file.

ISO 14971, the international standard for applying risk management to medical devices, is precise about a chain of cause and effect that everyday language blurs together. A hazard is a potential source of harm — it can exist in a device for its entire service life without ever hurting anyone. Harm is the actual physical injury, damage to health, or damage to property that results if a hazard is realized. Risk is not either of those things — it's a combination of two numbers: the probability that a given harm occurs, and the severityof that harm if it does. Confusing these three terms isn't just imprecise language; in a Design History File and risk management file, each one is a separately required, separately traceable field, and treating them as synonyms produces a risk analysis that regulators will reject.