Which statement describes the primary purpose of a risk management file in ISO 14971?

Which statement describes the primary purpose of a risk management file in ISO 14971?

• A. To store project schedules.
• B. To document the risk management process, including hazard identification, risk assessment, control implementation, and monitoring results.
• C. To report marketing risks to management only.
• D. To capture insurance liability data.

Answer: (B)

In ISO 14971, the risk management file is the formal record of the entire risk management activity for a medical device. It tracks how hazards are identified, how risks are assessed, which controls are chosen and implemented, and how those controls are monitored and re-evaluated over time. The file includes the results of risk assessments, the justification for risk acceptance, and evidence from verification and validation of controls, as well as any residual risk assessment and ongoing monitoring plans for production and post-market use. This documentation provides traceability, demonstrates regulatory compliance, and supports informed design and lifecycle decisions. Storing project schedules isn’t the focus of this file, which is about risk management rather than project timelines. Reporting only marketing risks ignores the full scope of hazards and safety-related risks captured in ISO 14971. Insurance liability data falls outside the typical risk management documentation required by the standard.

In ISO 14971, the risk management file is the formal record of the entire risk management activity for a medical device. It tracks how hazards are identified, how risks are assessed, which controls are chosen and implemented, and how those controls are monitored and re-evaluated over time. The file includes the results of risk assessments, the justification for risk acceptance, and evidence from verification and validation of controls, as well as any residual risk assessment and ongoing monitoring plans for production and post-market use. This documentation provides traceability, demonstrates regulatory compliance, and supports informed design and lifecycle decisions.

Storing project schedules isn’t the focus of this file, which is about risk management rather than project timelines. Reporting only marketing risks ignores the full scope of hazards and safety-related risks captured in ISO 14971. Insurance liability data falls outside the typical risk management documentation required by the standard.