QMSR Risk Management and Risk-Based Decisions
In this lesson, we focus on the requirements of the Quality Management System Regulation, referred to as the QMSR, for risk management, a risk-based approach, and risk-based decisions. The lesson is based on an FDA CDRH Learn module.
Picture the comprehensive nature of risk management throughout the product life cycle, from initial design through postmarket surveillance. Some of you may think the requirements for risk look like that picture: sketchy, crowded, uncertain, and perhaps even overwhelming. This lesson aims to provide the knowledge, clarity and resources to understand and successfully implement the risk requirements of the QMSR.
There are four key learning objectives: to define essential risk terms that form the foundation of this lesson; to explain the role of risk management within the broader quality management system; to identify the QMSR requirements for risk management, risk-based approaches and risk-based decisions; and to review a few examples of risk documentation.
Risk and risk management
Let's begin by defining a few key terms. Understanding key risk terms is crucial for implementing effective risk concepts in your quality management system.
Risk is defined as the combination of the probability of occurrence of harm and the severity of that harm. This term describes what could go wrong, how likely it is to happen, and how serious the consequences would be.
Risk management is defined as the systematic application of management policies, procedures and practices to the tasks of analyzing, evaluating, controlling and monitoring risk. The term systematic, used in the definition, clarifies that this is a structured and documented approach to addressing risk.
Where the definitions come from
These terms are defined by the American National Standards Institute, referred to as ANSI; the Association for the Advancement of Medical Instrumentation, referred to as AAMI; and the International Organization for Standardization, referred to as ISO. They appear in the ANSI/AAMI/ISO 13485:2016 standard, titled Medical devices, Quality management systems, Requirements for regulatory purposes, and in the ISO 14971 standard, titled Medical devices, Application of risk management to medical devices.
As indicated in FDA's response to comment 9 in the Final Rule, FDA does not, in this rulemaking, incorporate ISO 14971 or any other standards referenced by, or listed as a source in, ISO 13485. However, FDA acknowledges that these other standards may be helpful in understanding the application of ISO 13485.
FDA further clarified, in its response to comment 32, that the definition of the term risk used by ISO 13485 is appropriate. Clause 0.2 of ISO 13485 states that when the term risk is used, its application within the scope of the standard pertains to safety or performance requirements of the medical device, or to meeting applicable regulatory requirements. FDA stated that a definition of risk unique to the QMSR is therefore not necessary.
Risk-based approach and risk-based decisions
Two additional key terms are risk-based approach and risk-based decision.
A risk-based approach is defined as identifying risks and opportunities, and focusing on preventing or reducing undesired effects. This is more of a proactive approach.
A risk-based decision is defined as making a specific decision based on risk assessment and other criteria. The information obtained is actively used to drive decisions throughout the life of the device and throughout the quality management system.
The role of risk management in the QMS
Now let's explore the role that risk management plays within your quality management system.
Risk management serves several core functions. It helps identify, assess, control, communicate and review device risk to the quality management system processes. It provides reasonable assurance of safety and effectiveness throughout the total product life cycle, from design and development through postmarket surveillance and, eventually, discontinuation.
Risk management provides a framework for sound decision-making within your quality management system. For example, it helps you identify which design outputs are essential for proper device functioning, guides continuous updates based on postmarket surveillance data, defines the extent of verification activities for purchased products, and determines the appropriate approach to software validation and revalidation activities, proportionate to the risk associated with the use of the software.
What the QMSR requires
Let's now examine the specific QMSR requirements for risk management, use of a risk-based approach, and making risk-based decisions.
Title 21 of the Code of Federal Regulations, section 820.10(a), requires manufacturers to document a quality management system that complies with the applicable requirements of ISO 13485, along with other applicable requirements. ISO 13485 is incorporated by reference under 21 CFR 820.7, and it includes specific requirements for risk management, a risk-based approach, and risk-based decision-making.
FDA clarified these requirements in its responses to comments 19 and 27 in the 2024 Final Rule, Medical Devices; Quality System Regulation Amendments, published in the Federal Register, volume 89, page 7496. In its response to comment 19, FDA emphasized that while the integration of risk management principles throughout ISO 13485 does not represent a shift in philosophy, the explicit integration throughout the clauses of ISO 13485 more clearly establishes requirements for risk management throughout the quality management system, or QMS. This should help industry develop more effective total product life-cycle risk management systems. FDA also emphasized that, in adopting ISO 13485, the QMSR incorporates these risk concepts and principles as important elements of an effective quality management system.
In its response to comment 27, FDA clarified its expectation that medical device manufacturers, led by individuals with executive responsibilities, embrace a culture of quality as a key component in ensuring safe and effective medical devices. FDA also stated that this culture of quality meets regulatory requirements through specific behaviors, attitudes, activities and processes.
Risk throughout ISO 13485
In adopting ISO 13485, the QMSR incorporates risk management throughout its requirements, and emphasizes risk management activities and making risk-based decisions.
These requirements for risk management, use of a risk-based approach, and making risk-based decisions are included throughout multiple clauses of ISO 13485. They include clause 4.1 for general requirements, clause 6.2 for human resources, clause 7.1 for planning of product realization, clause 7.3 for design and development, and clause 7.4 for purchasing.
They are also included in clause 7.5 for production and service provision, clause 7.6 for control of monitoring and measuring equipment, clause 8.2 for monitoring and measurement, clause 8.3 for control of nonconforming product, and clause 8.5 for improvement. Notice how risk management permeates the quality management system.
Clause 4.1, general requirements
Under clause 4.1, general requirements, organizations must apply a risk-based approach to the control of appropriate QMS processes. For outsourced processes, controls must be proportionate to the risk involved and to the external party's ability to meet requirements. Additionally, software validation and revalidation activities must be proportionate to the risk associated with the use of the software.
For example, you can review your QMS and identify risks or areas of needed improvement within its processes, using the method that best suits your needs, such as a strengths, weaknesses, opportunities and threats analysis, or SWOT, or even a simpler technique such as brainstorming. Once an area of needed improvement is identified, you can then use a more detailed analysis, such as hazard analysis and critical control points, or HACCP, to create a plan for process improvement or for implementing control measures.
Clauses 6.2 and 7.1
Clause 6.2, human resources, includes a note for guidance that the methodology used to check training effectiveness should be proportionate to the risk associated with the work for which the training is provided. For example, for some low-risk job assignments, training could be limited to requiring the assigned individual to read the procedures that describe the job. Higher-risk activities, by contrast, warrant more rigorous training verification, such as testing or questioning the trained individual, or even evaluating their work performance.
Clause 7.1, planning of product realization, requires organizations to document one or more processes for risk management in product realization, and to maintain records of risk management activities. This ensures that risk management is not just conceptual, but documented and traceable. As indicated in the note to this clause, the ISO 14971 standard can be used to obtain further information on documenting risk management processes.
Clause 7.3, design and development
Under clause 7.3, design and development inputs must include applicable outputs of risk management, along with other requirements essential for the design and development of the product and processes. Review and approve design and development inputs to ensure they are complete, unambiguous and compatible with each other, so that conflicts are resolved before the inputs are finally approved. Design and development outputs must specify the characteristics of the product that are essential for its safe and proper use.
In addition, clause 7.3 specifies that, when controlling design and development changes, reviews must include evaluation of the effects on constituent parts, on product in process or already delivered, and on the inputs or outputs of risk management and product realization processes. The evaluation and documentation of the change should be in direct proportion to the significance of the change, and communicated to relevant functions in your organization to determine the total effect of the change.
Clause 7.4, purchasing
For clause 7.4, purchasing, the criteria for supplier evaluation and selection must be proportionate to the risk associated with the medical device. The selection process and controls might differ for a contract sterilizer, a supplier of off-the-shelf components, or a design and development service, based on how critical the process or product being provided is to the safety and performance of your product, and to the adequacy or effectiveness of your QMS.
When suppliers don't fulfill purchasing requirements, this is addressed in proportion to the risk associated with the purchased product, and to compliance with applicable regulatory requirements.
Clause 7.4 also requires that the extent of verification activities for purchased product be based on supplier evaluation results, and be proportionate to the risk associated with the purchased product. Higher-risk purchased products or services require more extensive verification. It is the organization's decision what type and extent of control and evaluation activities are appropriate.
Clauses 7.5 and 7.6, software validation
Clause 7.5, production and service provision, requires that, for the validation of computer software used in production and service provision, the specific approach and activities associated with software validation and revalidation be proportionate to the risk associated with the use of the software, including effects on the product's ability to conform to specifications. Some processes also require that operators have extra training or be specially qualified, or that the process itself have a specific approval.
Similarly, clause 7.6, control of monitoring and measuring equipment, requires that, for the validation of the application of computer software used for monitoring and measurement of requirements, the specific approach and activities associated with software validation and revalidation be proportionate to the associated risk, including effects on product conformity to specifications.
For example, a manufacturer uses software-based environmental monitoring to track temperature and humidity in clean rooms where sterile syringes are assembled. This software directly affects the ability to meet product specifications. Thus, the company would be required to develop a validation and revalidation plan to ensure the software performs as intended.
Clauses 8.2, 8.3 and 8.5
Under clause 8.2, monitoring and measurement, information gathered through feedback processes must serve as a potential input into risk management, for monitoring and maintaining product requirements, and for product realization or improvement processes. For example, suppose you reviewed several complaints received over a period of time and identified an increase in the frequency of malfunctions of a specific part. The risk management file should be reviewed and updated accordingly, to determine whether the risk profile changes and whether risk control measures are required.
Clause 8.3, control of nonconforming product, requires that when nonconforming product is detected after delivery or after use has started, organizations take action appropriate to the effects, or potential effects, of the nonconformity. The response must match the risk level. This could include activities such as notifying customers, issuing field safety notices, conducting product recalls, or performing corrective actions to prevent recurrence.
Finally, clause 8.5, improvement, requires that corrective actions be proportionate to the effects of the nonconformities encountered, and that preventive actions be proportionate to the effects of the potential problems. The degree of action taken should depend on, and relate to, the risk. For example, for a high-risk device, you may decide to recall and relabel a device with misprinted instructions as a corrective action. Or you may add extra validation checks before a software update rollout as a preventive action.
Documenting risk
Now let's look at a few examples of risk documentation for these requirements.
Two resources contain useful information on risk management activities and documentation. The first is the ANSI/AAMI/ISO 14971:2019 standard, titled Medical devices, Application of risk management to medical devices, which provides a systematic approach to conducting risk management activities. The second is the AAMI/ISO TIR24971:2020 document, titled Medical devices, Guidance on the application of ISO 14971, which provides guidance on applying ISO 14971.
There are several ways to document your risk activities and decisions. You can use a risk management plan, which outlines the risk management scope, responsibilities and criteria at the start of product development. You can use a risk analysis report to identify hazards and estimate risk during design and development. Some people capture their risk information in a risk evaluation summary, to document the justification for the acceptability of individual and overall risk.
A popular way to document risk information is a risk traceability matrix, which demonstrates that risks are addressed and mitigated throughout the product life cycle. And then there is the risk management file, which serves as a centralized record of all risk-related documentation maintained throughout the device life cycle. Additional examples of risk documentation include design review meeting minutes, change control records, improvement documentation, production and process FMEAs, and benefit-risk analysis reports.
Summary and call to action
In summary, risk management is integral to safe and effective devices and to an effective quality management system. By incorporating ISO 13485:2016 by reference, the QMSR incorporates risk management principles and risk-based approaches throughout the total product life cycle, and risk-based decision-making within the QMS.
Here is your call to action. First, review the QMSR requirements for risk management, risk-based approaches and risk-based decisions. Document your risk management activities thoroughly, and revisit them frequently. And finally, use risk management as a framework for sound decision-making within your QMS, to provide assurance that your devices will be safe and effective.
This lesson draws on the FDA CDRH Learn presentation “Medical Device Quality Management System Regulation Risk Management,” published in November 2025. It is introductory education, not an official FDA course. Applicable regulations and your company's approved procedures govern actual work.
SOURCE CREDIT FDA CDRH Learn, “Medical Device Quality Management System Regulation Risk Management” (YouTube, 25 November 2025); narration adapted from FDA's presentation transcript. This video re-presents FDA's educational content with a new narrator and original graphics. It is not an official FDA course. Applicable regulations and company procedures govern actual work.