Risk Management Use Case

Risk management is a critical aspect of medical device development. The Risk Management Use Case implements ISO 14971 methodology to help you create and maintain a comprehensive risk management process throughout your product lifecycle.

KU/KTs

These are the Mandatory KTs that take part in the Risk Management:

The Risk Management use case in CertHub usually spans over two Knowledge Units:

• Risk Management Plan

  • Probability Of Occurrence Matrix
  • Severity if Harm Matrix
  • Risk Management Team - an overview of who manages which Risks or Risk Control Measures

• Risk Assessment

  • Failure Modes – The specific way in which a component, function, or process fails to perform as intended.
  • System Misbehaviour – Ways in which a system can misbehave, cause by one or more Failure Modes.
  • Hazardous Situations – Circumstances in which people, property, or the environment are exposed to one or more hazards.
  • Harms – Injury or damage to the health of people, or damage to property or the environment.
  • Risks – The combination of the probability of occurrence of harm and the severity of that harm.
  • Risk Analysis – The systematic use of available information to identify hazards and to estimate the risk.
  • Risk Control Measures – Actions/measures implemented to reduce risks to, or maintain them within, specified acceptable levels.
  • Residual Risks – Risk remaining after risk control measures have been implemented.

Defining Relationships within the Risk Management

The diagram shows how the Knowledge Topics of this use case are connected. An arrow points from the source to the target Knowledge Topic. An arrow with two arrowheads marks a bidirectional relationship.

Each Knowledge Topic (KT) can have different relationships defined within the use case configuration.

Source Knowledge Topic	Relation Name	Target Knowledge Topic	Allow Multiple	Description	Additional Field
Risks	Relates To	Harm	No	Select the Harm resulting from this Risk.	Severity
	Mitigated By	Risk Control Measures	Yes	Select the Risk Control Measure that mitigates this Risk.
	Managed By	Risk Management Team	No	Select the responsible Risk Management Team.
	has residual	Residual Risks	No	Select the Residual Risk derived from this Risk.
	has probability	Probability of Occurrence	No	Select the Probability of Occurrence for this Risk.
	arises from	Hazardous Situation	No	Select the Hazardous Situation this Risk arises from.
Failure Modes	causes	System Misbehaviour	Yes	Select the System Misbehaviour that the Failure Mode causes.
	associated with	Parts/Components	Yes	Select the Part/Component that is associated with the Failure Mode.
	relates to	Medical Device Accessory	Yes	Select the Medical Device Accessory that relates to the Failure Mode.
Residual Risks	is derived from	Risks	No	Select the underlying Risk that was mitigated by the Risk Control Measure.
	is mitigated by	Risk Control Measures	Yes	Select the underlying Control Measure that mitigates this Residual Risk.
	has probability	Probability of Occurrence	No	Select the Probability of Occurrence for this Residual Risk.
	has severity	Severity of Harm	No	Select the Severity for this Residual Risk.
Hazard	causes	Hazardous Situation	Yes	Select the Hazardous Situation related to this Hazard.
	caused by	System Misbehaviour	Yes	Select the System Misbehaviour that causes this Hazard.
Hazardous Situation	caused By	Hazard	Yes	Select the Hazard associated with this Hazardous Situation.
	causes	Harm	Yes	Select the Harm associated with this Hazardous Situation.
	leads to	Risks	Yes	Select the Risks that arise from this Hazardous Situation.
Harm	caused by	Hazardous Situation	Yes	Select the Hazardous Situation that could lead to this Harm.
	causes	Risks	Yes	Select the Risk that is caused by this Harm.
	has severity	Severity of Harm	No	Select the Severity for this Harm.
Risk Control Measures	Mitigates	Risks	Yes	Select the Risks mitigated by this Risk Control Measure.
	results in	Residual Risks	Yes	Select the Residual Risks that result from this Risk Control Measure.
Risk Management Team	Manages	Risks	Yes	Select the Risks managed by this Risk Management Team.
	Responsible for	Risk Control Measures	Yes	Select the Risk Control Measure this team is responsible for.
Risk Analysis	identified System Misbehaviour	System Misbehaviour	No	Select the System Misbehaviour identified in this analysis.	Probability P0
	Identified Hazard	Hazard	No	Select the Hazard identified in this analysis.	Probability P1
	Identified Hazardous Situation	Hazardous Situation	No	Select the Hazardous Situation identified in this analysis.	Probability P2
	Identified Harm	Harm	No	Select the Harm identified in this analysis.
	Analyzed	Risks	No	Select the Risk being analyzed.	Probability
	Identified RCM	Risk Control Measures	Yes	Select the Risk Control Measure determined for this analysis.
	Identified RMT	Risk Management Team	Yes	Select the Risk Management Team responsible for this risk analysis.
System Misbehaviour	Causes	Hazard	Yes	Select the Hazards that are caused by this System Misbehaviour.
	Caused by	Failure Modes	Yes	Select the Failure Modes that cause this System Misbehaviour.
Foreseeable Misuse	causes	Hazard	Yes	Select the Hazard that is caused by this Foreseeable Misuse.
Abnormal Use	causes	Hazard	Yes	Select the Hazards that are caused by this Abnormal Use.
Probability of Occurrence	probability of	Risks	Yes	Select the Risks with this Probability of Occurrence.
	probability of	Residual Risks	Yes	Select the Residual Risks with this Probability of Occurrence.
Severity of Harm	Severity of	Harm	Yes	Select the Harms with this Severity.
	Severity of	Residual Risks	Yes	Select the Residual Risks with this Severity.

Risk Analysis Table

The Risk Analysis is a central part of the Risk Management Use Case.

There is a dediacted Table Risk Analysis, which connects:
Failure Modes → System Misbehaviour → Hazards → Hazardous Situations → Harms → Risks → Risk Control Measures → Residual Risks

Based on the relationships set between the KT data, the Risk Analysis is inferred automatically giving you an overview of the Risks defined for your Product.

The following shows a snippet of the automatically inferred Risk Analysis Table within CertHub

Probabilities not displayed?

Make sure the respective fields have the certhub-key Property!

Risk Evaluation Matrices

The Risk Evaluation Matrices show how many of your Risks and Residual Risks fall into each combination of Probability of Occurrence (rows) and Severity of Harm (columns), and whether that combination is acceptable. CertHub computes them automatically from the relationships between your records.

There are three matrices:

Matrix	What it shows	Numbers in cells	What you can edit
Risk Acceptability Matrix	Acceptability of Probability-Severity combinations	No	The color of each cell
Risk Evaluation Matrix	Number of Risks per Probability and Severity	Yes	Nothing, colors come from the Risk Acceptability Matrix
Residual Risk Evaluation Matrix	Number of Residual Risks per Probability and Severity	Yes	Nothing, colors come from the Risk Acceptability Matrix

Example of a colored Residual Risk Evaluation Matrix

Required Knowledge Topics

The matrices are built from five Knowledge Topics. Each of them must exist in your product, with exactly this name, and only once per product:

Knowledge Topic	Role in the matrices
Probability of Occurrence	Each record is one row
Severity of Harm	Each record is one column
Risks	Counted in the Risk Evaluation Matrix
Harm	Connects a Risk to its Severity
Residual Risks	Counted in the Residual Risk Evaluation Matrix

Only once per product

If one of these Knowledge Topics exists more than once in a product (for example a second Harm KT in another Knowledge Unit), CertHub cannot tell which one to use and the matrices are not displayed.

Probability of Occurrence and Severity of Harm

The rows and columns are not configured in the matrices themselves. They always follow the records in Probability of Occurrence and Severity of Harm, and are shown in the order of the records in the two Knowledge Topics.

Changing Severity or Probability Records

Every change to the records in Probability of Occurrence and Severity of Harm affects all three matrices at once:

Change	Effect on the matrices
Adding a record	A new row (Probability) or column (Severity) appears. Its cells are white until you color them in the Risk Acceptability Matrix.
Renaming a level	The row or column title changes. Counts and colors stay as they are.
Deleting a record	The row or column disappears together with its colors. Risks, Harms and Residual Risks that were connected to it lose their Severity or Probability and are listed as not classified until you connect them to another record.

CertHub keys for Severity and Probability

The field that holds the name of a severity or probability level (e.g. Minor or Likely) needs a certhub-key property. Its value is used as the column or row title in the matrices.

Knowledge Topic	Field	certhub-key
Severity of Harm	Severity	severity_of_harm
Probability of Occurrence	Probability	probability_of_occurrence

Select the field in the form editor and add the key under Custom properties:

Linking Records to a Severity and Probability

A record is counted in a matrix cell once CertHub can find exactly one Severity and one Probability for it. Risks and Residual Risks get there in different ways.

Risks: the Probability belongs to the Risk, the Severity belongs to the Harm.

• Connect the Risk to its Probability of Occurrence record.
• Connect the Risk to its Harm.
• Connect the Harm to its Severity of Harm record.

The Risk takes over the Severity of its Harm. Several Risks can lead to the same Harm and each have their own Probability, but they all share the Severity of that Harm.

Residual Risks: both values belong to the Residual Risk itself.

• Connect the Residual Risk to its Probability of Occurrence record.
• Connect the Residual Risk to its Severity of Harm record.

A Residual Risk does not take over anything from its Risk or Harm, because its values describe the situation after the Risk Control Measures have been applied.

One Severity and one Probability per record

A Risk, Harm or Residual Risk record cannot be assigned to several Severity or Probability records at the same time:

• a Risk has one Probability and one Harm,
• a Harm has one Severity,
• a Residual Risk has one Probability and one Severity.

The other direction is not limited: one Severity or Probability record can be connected to as many records as you like.

You create these connections in the Domain-Specific Tracing of a record. It works from both sides: open a Risk and select its Probability, or open a Probability record and select all Risks and Residual Risks that have this probability.

Creating the Matrices

A matrix is a Knowledge Topic like any other, it just has no records of its own.

1. Open the Knowledge Unit in which the matrix should live (e.g. Risk Management Plan or Risk Assessment).

2. Create a new, empty multi-record Knowledge Topic.

3. Give it exactly one of these names:

   • Risk Evaluation Matrix
   • Residual Risk Evaluation Matrix
   • Risk Acceptability Matrix

CertHub recognizes the name and displays the computed matrix instead of a record table. Each of the three matrices may exist only once per product, the same rule as for the required Knowledge Topics above.

note

The matrices are computed on products only. On a Knowledge Topic schema, no matrix is shown until the schema has been applied to a product and records have been added there.

Risk Evaluation Matrix and Residual Risk Evaluation Matrix

Both matrices show the number of records in each cell: Risks in the Risk Evaluation Matrix, Residual Risks in the Residual Risk Evaluation Matrix. The cell colors are taken from the Risk Acceptability Matrix and cannot be changed here.

Use Export to download a matrix as CSV, XLSX or PDF. The PDF keeps the cell colors.

Records that cannot be placed into a cell are not counted, and a warning above the matrix lists them. See Records could not be classified for the reasons and how to fix them.

Referencing the Matrices in Documents

Both matrices can also be referenced in documents, for example to show the Risk Evaluation Matrix in your Risk Management Report. Insert a reference to the matrix Knowledge Topic in the Text Editor, in the same way as for any other Knowledge Topic. See The Complete Guide to References in Text Editor for the available reference types.

Risk Acceptability Matrix

The Risk Acceptability Matrix is the color blueprint. It has the same rows and columns as the evaluation matrices but no numbers. The color you give a cell here is applied to the same cell in the Risk Evaluation Matrix and the Residual Risk Evaluation Matrix.

To change colors:

1. Click a cell to open the color picker and choose a color.
2. To color several cells at once, hold Cmd (macOS) or Ctrl (Windows) and click each cell, then click one of the selected cells and choose a color.

Colors can only be changed in the current draft of the Knowledge Unit. If the Risk Acceptability Matrix does not exist, the evaluation matrices still work, but all their cells stay white.

Matrix Troubleshooting

Matrix not displayed or empty?

• A normal record table is shown instead of the matrix: the Knowledge Topic name does not match exactly. It must be Risk Evaluation Matrix, Residual Risk Evaluation Matrix or Risk Acceptability Matrix.
• The matrix is missing: check that none of the required Knowledge Topics or matrices exists twice in the product.
• "No evaluation matrix data available": there are no records in Probability of Occurrence or Severity of Harm yet.
• All counts are 0: the Risks or Residual Risks are not connected yet. The warning above the matrix lists the affected records.

Records could not be classified

A record is only counted once CertHub can find exactly one Severity and one Probability for it. If that is not the case, the record cannot be placed into a cell and is left out of the counts. A warning above the matrix tells you how many records are affected and lists them by name, together with the reason:

Reason shown	Why the record cannot be classified	How to fix it
Missing Probability or Severity	One of the two values is missing, so CertHub does not know the row or the column. For a Risk: it has no Probability, no Harm, or its Harm has no Severity. For a Residual Risk: it has no Probability or no Severity.	Add the missing connection, see Linking Records to a Severity and Probability.
More than one Probability × Severity combination	The record is connected to several Probabilities or Severities and would belong to more than one cell.	Remove the extra connections so that one Severity and one Probability remain.

Templates

The Risk Management includes key templates:

• Risk Management Plan – Outlines the strategy, responsibilities, and methods for risk management throughout the product lifecycle.
• Risk Management Report – Summarizes the identified risks, analysis results, applied risk controls, and final risk evaluation.
• Benefit-Risk Analysis – Demonstrates that clinical benefits outweigh residual risks when unacceptable risks remain after control measures.
• Risk Acceptability Criteria – Establishes the severity/probability matrix and thresholds that determine whether risks are acceptable or require further reduction.
• FMEA Table - Systematically lists potential failure modes, their causes, probability chains, severity, and effects on device safety.

Processes

Risk Management in CertHub is structured around three essential processes:

1. Risk Management – Defines the systematic lifecycle process covering planning, hazard analysis, risk evaluation, control implementation, verification, post-production monitoring, and risk management file maintenance per ISO 14971.
2. Risk Evaluation – Establishes the steps for assessing identified risks through severity/probability estimation, comparing against acceptance criteria, implementing controls for unacceptable risks, evaluating residual risks, and conducting benefit-risk analysis when needed.
3. Hazard Analysis – Defines the methodology for identifying failure modes, system misbehaviors, hazards, hazardous situations, potential harms, and estimating associated risks per ISO 14971.

Integration with Other Areas of the System

• Parts/Components or Medical Device Accessory can be connected to Failure Modes
• Abnormal Use an be connected to Hazards
• Use Scenarios can be connected to Hazards
• Potential Use Errors an be connected to Hazardous Situations
• User Requirements can be connected to Risk Control Measures
• System Requirements can be connected to Risks** and Risk Control Measures