Risk Management Use Case

Risk management is a critical aspect of medical device development. The Risk Management Use Case implements ISO 14971 methodology to help you create and maintain a comprehensive risk management process throughout your product lifecycle.

KU/KTs

These are the Mandatory KTs that take part in the Risk Management:

The Risk Management use case in CertHub usually spans over two Knowledge Units:

• Risk Management Plan

  • Probability Of Occurence Matrix
  • Severity if Harm Matrix
  • Risk Management Team - an overview of who manages which Risks or Risk Control Measures

• Risk Assessment

  • Failure Modes – The specific way in which a component, function, or process fails to perform as intended.
  • System Misbehaviour – Ways in which a system can misbehave, cause by one or more Failure Modes.
  • Hazardous Situations – Circumstances in which people, property, or the environment are exposed to one or more hazards.
  • Harms – Injury or damage to the health of people, or damage to property or the environment.
  • Risks – The combination of the probability of occurrence of harm and the severity of that harm.
  • Risk Analysis – The systematic use of available information to identify hazards and to estimate the risk.
  • Risk Control Measures – Actions/measures implemented to reduce risks to, or maintain them within, specified acceptable levels.
  • Residual Risks – Risk remaining after risk control measures have been implemented.

Defining Relationships within the Risk Management

Each Knowledge Topic (KT) can have different relationships defined within the use case configuration.

Source Knowledge Topic	Relation Name	Target Knowledge Topic	Allow Multiple	Description	Additional Field
Risks	Relates To	Harm	Yes	Select the possible Harm resulting from this Risk.
	Mitigated By	Risk Control Measures	Yes	Select the Risk Control Measure that mitigates this Risk.
	Managed By	Risk Management Team	No	Select the responsible Risk Management Team.
Failure Modes	causes	System Misbehaviour	Yes	Select the System Misbehaviour that the Failure Mode causes.
	associated with	Parts/Components	Yes	Select the Part/Component that is associated with the Failure Mode.
	relates to	Medical Device Accessory	Yes	Select the Medical Device Accessory that relates to the Failure Mode.
Residual Risks	is derived from	Risks	Yes	Select the underlying Risk that was mitigated by the Risk Control Measure.
	is mitigated by	Risk Control Measures	Yes	Select the underlying Control Measure that mitigates this Residual Risk.
Hazard	causes	Hazardous Situation	Yes	Select the Hazardous Situation related to this Hazard.
	caused by	System Misbehaviour	Yes	Select the System Misbehaviour that causes this Hazard.
Hazardous Situation	caused By	Hazard	Yes	Select the Hazard associated with this Hazardous Situation.
	causes	Harm	Yes	Select the Harm associated with this Hazardous Situation.
Harm	caused by	Hazardous Situation	Yes	Select the Hazardous Situation that could lead to this Harm.
	causes	Risks	Yes	Select the Risk that is caused by this Harm.
Risk Control Measures	Mitigates	Risks	Yes	Select the Risks mitigated by this Risk Control Measure.
	results in	Residual Risks	Yes	Select the Residual Risks that result from this Risk Control Measure.
Risk Management Team	Manages	Risks	Yes	Select the Risks managed by this Risk Management Team.
	Responsible for	Risk Control Measures	Yes	Select the Risk Control Measure this team is responsible for.
Risk Analysis	Analyzed	Risks	Yes	Select the Risk being analyzed.
	identified System Misbehaviour	System Misbehaviour	No	Select the System Misbehaviour identified in this analysis.	Probability P0
	Identified Hazard	Hazard	No	Select the Hazard identified in this analysis.	Probability P1
	Identified Hazardous Situation	Hazardous Situation	No	Select the Hazardous Situation identified in this analysis.	Probability P2
	Identified Harm	Harm	No	Select the Harm identified in this analysis.	Probability P0xP1xP2
	Identified RCM	Risk Control Measures	Yes	Select the Risk Control Measure determined for this analysis.
	Identified RMT	Risk Management Team	Yes	Select the Risk Management Team responsible for this risk analysis.
System Misbehaviour	Causes	Hazard	Yes	Select the Hazards that are caused by this System Misbehaviour.
	Caused by	Failure Modes	Yes	Select the Failure Modes that cause this System Misbehaviour.
Forseeable Misuse	causes	Hazard	Yes	Select the Hazard that is caused by this Forseeable Misuse.
Abnormal Use	causes	Hazard	Yes	Select the Hazards that are caused by this Abnormal Use.

Risk Analysis Table

The Risk Analysis is a central part of the Risk Management Use Case.

There is a dediacted Table Risk Analysis, which connects:
Failure Modes → System Misbheaviour → Hazards → Hazardous Situations → Harms → Risks → Risk Control Measures → Residual Risks

Based on the relationships set between the KT data, the Risk Analysis is inferred automatically giving you an overview of the Risks defined for your Product.

The following shows a snippet of the automatically inferred Risk Analysis Table within CertHub

Probabilites not displayed?

Make sure the respective fields have the certhub-key Property!

Templates

The Risk Management includes key templates:

• Risk Management Plan – Outlines the strategy, responsibilities, and methods for risk management throughout the product lifecycle.
• Risk Management Report – Summarizes the identified risks, analysis results, applied risk controls, and final risk evaluation.
• Benefit-Risk Analysis – Demonstrates that clinical benefits outweigh residual risks when unacceptable risks remain after control measures.
• Risk Acceptability Criteria – Establishes the severity/probability matrix and thresholds that determine whether risks are acceptable or require further reduction.
• FMEA Table - Systematically lists potential failure modes, their causes, probability chains, severity, and effects on device safety.

Processes

Risk Management in CertHub is structured around three essential processes:

1. Risk Management – Defines the systematic lifecycle process covering planning, hazard analysis, risk evaluation, control implementation, verification, post-production monitoring, and risk management file maintenance per ISO 14971.
2. Risk Evaluation – Establishes the steps for assessing identified risks through severity/probability estimation, comparing against acceptance criteria, implementing controls for unacceptable risks, evaluating residual risks, and conducting benefit-risk analysis when needed.
3. Hazard Analysis – Defines the methodology for identifying failure modes, system misbehaviors, hazards, hazardous situations, potential harms, and estimating associated risks per ISO 14971.

Integration with Other Areas of the System

• Parts/Components or Medical Device Accessory can be connected to Failure Modes
• Abnormal Use an be connected to Hazards
• Use Scenarios can be conected to Hazards
• Potential Use Errors an be connected to Hazardous Situations
• User Requirements can be connected to Risk Control Measures
• System Requirements can be connected to Risks** and Risk Control Measures