How to Build an ISO 14971 Risk Management File That Survives FDA Review

1 hour ago

6 min read

By David Petrich, Landrich Group Co-Founder and VP of Quality and Regulatory

Risk Management Files and Regulatory Scrutiny

IVD and medical device companies approaching FDA submission typically have a Risk Management File (RMF). However, it’s the substance of this file that determines success in regulatory review.

ISO 14971:2019 provides a global framework and is commonly understood as a benchmark for a device RMF. However, an RMF that satisfies ISO 14971 on paper but doesn't demonstrate genuine integration with the device design can encounter serious problems throughout a product’s entire lifecycle. In fact, this gap is one of the most common sources of pre-submission deficiencies and post-inspection 483 observations. The gap isn't usually in the hazard identification. Instead, it's found in the risk control measures (i.e., mitigations), their implementation, and supporting objective evidence that residual risks are acceptable and as low as possible.

At Landrich Group, we work with Medical Device, IVD, and Companion Diagnostics (CDx) manufacturers to ensure they have effective and defensible risk management processes and documentation (i.e., RMFs), avoid common pitfalls, and address the key questions FDA and other reviewers, such as Notified Bodies or other National Competent Authorities, are likely to raise.

What Is an ISO 14971 Risk Management File?

A RMF is a set of records and documents demonstrating how a medical-device manufacturer identifies hazards, estimates, and evaluates risks. It should also cover how the manufacturer implements and verifies risk controls, evaluates residual risk, and monitors risk throughout the device lifecycle. Under ISO 14971:2019, the RMF should contain the following elements: Risk Management Plan (RMP), risk assessments, residual benefit/risk statement, and production and post-production data to update risks, and a Risk Management Report (RMR) to provide traceability from identified hazards through risk analysis, risk controls, verification of those controls, and residual risk evaluation for a product’s entire lifecycle.

What Does FDA Expect in a Medical Device Risk Management File?

Although the FDA does not explicitly mandate compliance with ISO Standard 14971:2019, the standard is recognized as an FDA consensus standard for risk management. In practice, FDA reviewers and investigators look for the following elements of an RMF:

A defined scope: what device, what intended use, what life cycle phases are covered
A Risk Management Plan with the criteria for risk acceptability
Systematic hazard identification with documented reasoning
Risk controls that are actually implemented in the design (not just listed in a table)
Verification evidence demonstrating that controls work as intended
A residual risk evaluation with documented acceptability rationale

An RMF that includes these elements and demonstrates traceability is defensible. Files that lack these elements, even with thorough traceability, will not hold up to scrutiny. A file may have a complete hazard table, but this isn’t enough if it doesn’t show where the controls are documented in the Design History File (DHF) or contain evidence the controls were verified. It is important that the RMF is managed throughout a product’s entire lifecycle and includes production, post-products, and other relevant updates that potential change a products benefit/risk profile.

How QMSR Changes the Risk Management Context in 2026

As of February 2026, the FDA implemented the Quality Management System Regulation (QMS-R), which incorporates by reference ISO 13485:2016, Medical devices - Quality management systems. QSMR provides a globally harmonized QMS framework for medical device manufacturers to promote consistency in design, production, and lifecycle controls across global markets and now specifically requires more emphasis on risk management processes and supporting documentation. For IVDs, the expectation is that risk management is integrated into the entire design process following ISO 14971 requirements. For risk management teams, the practical takeaway is that the RMF should not function as a standalone compliance artifact. Risk management should be demonstrably connected to design and development, verification and validation, change control, and the broader quality management system. Landrich has guided IVD manufacturers through the QMSR transition and discussed the implications in detail previously.

What Are Common ISO 14971 Risk Management File Gaps?

Gap 1: Hazards identified but controls not tied to design outputs

The most common gap in risk management files is a hazard table that lists controls in general terms ("operator training," "device labeling," "design feature X") without linking those controls to specific design outputs in the DHF. These types of gaps are a common cause of FDA 483 Observations, which force manufacturers into a costly response-and-correction cycle on the FDA’s timeline. Another common oversight is not actively updating risk assessments and RMF contents when design changes are made, or new information on risks is obtained from production and post-production experience.

Landrich has documented the most cited DHF gaps to anticipate and avoid these potential setbacks. An FDA reviewer who asks "show me where this control is implemented" should be able to follow a direct reference from the RMF to a DHF record. When that link doesn't exist, the control is effectively unverifiable.

Gap 2: Residual risks stated as acceptable without justification

ISO 14971 requires that residual risks be evaluated against defined risk acceptability criteria that are contained in a Risk Management Plan (RMP). RMPs or RMFs that assign residual risk ratings without documented criteria, or that state "risk is acceptable" without referencing how that determination was made, leave FDA reviewers without a basis to evaluate the conclusion. This is especially significant for IVD products where false positive or false negative rates have direct clinical consequences.

Gap 3: Risk-benefit analysis conducted at a point-in-time rather than maintained throughout development

Risk management is a lifecycle activity under ISO 14971. A RMF cannot merely reflect the device design as it existed at one point in development. It must document how risks were re-evaluated after design changes and as more experience is gained with production and post-production activities. Otherwise, there will be a gap between the file and the actual device. Design changes that affect risk must trigger a documented risk management review, with conclusions recorded.

What Makes a Risk Management File FDA-Ready?

An RMF that survives FDA review has three structural properties beyond completeness.

First, the file must be integrated with design and development activities and the DHF. Every risk control (i.e., mitigation) has a corresponding design record. Every verification of a risk control references the test that demonstrated the control is effective without unanticipated consequences. The RMF reads as a product of the design process, not an independent document.

Second, the RMF should explain the rationale or reasoning, not just the conclusions. The acceptability criteria are defined before risks are evaluated. The rationale for each risk rating is stated. It must document every risk that was initially unacceptable and the control implemented to raise it to an acceptable level and meet the state-of-the-art requirements for the type of device.

Finally, the file (RMF) must cover the full intended use population. For IVDs, this means the RMF addresses risks for all intended users (point-of-care vs. laboratory, trained vs. lay), all intended use environments, and all intended specimen types. A file (RMF) built around a controlled laboratory setting cannot be submitted for a claim that includes point-of-care use. Risk management processes must be integrated with design and development activities and updated based on clinical performance studies, production, and post-production experience. Outputs from risk assessment activities serve as inputs (i.e., design inputs) to the design and development process to ensure a product’s risk profile is acceptable.

ISO 14971 Risk Management File Checklist Before FDA Submission

Is the scope of the Risk Management File (RMF) clearly defined and consistent with the submission's intended use?
Is there a documented Risk Management Plan (RMP) with defined acceptability criteria?
Can every risk control measure (i.e., mitigation) be traced to a specific design output in the DHF or RMF?
Is there verification evidence for every risk control in the RMF or DHF file?
Are residual risk ratings documented with explicit acceptability rationale?
Is there an evaluation of residual risks after control measures have been applied, and the assessment of overall residual risk acceptability?
Is there a Benefit-Risk Analysis that describes an analysis of the benefits of the device to patients/users versus the residual risks?
Were risks re-evaluated after significant design change?
Were risks updated after gaining production and post-production experience for the device?
Does the overall benefit-risk analysis cover the full intended use population and use environments?
Is the file (RMF) consistent with the current design baseline?

How Can Risk Management Gaps Affect an FDA Submission?

A complete, integrated risk management file strengthens a submission by demonstrating that you've systematically assessed the potential failure scenarios for your device. FDA reviewers and investigators who see a well-structured RMF spend less time asking questions about device safety and more time evaluating the clinical evidence. A file with gaps invites the opposite dynamic.

Conversely, an RMF that reveals unmitigated hazards or inadequate residual risk justification can result in delayed technical File submissions, a deficiency letter, a Complete Response Letter (CRL), or an FDA Form 483 observation in an inspection scenario.

Landrich Group is based in the San Francisco Bay Area and supports IVD and device manufacturers across California and globally. Landrich Group provides independent risk management file reviews and gap assessments for IVD and medical device companies preparing for FDA submission or inspection. Contact us to schedule an initial consultation.