Risk Management
ISO 14971 risk assessments with residual-risk tracking and control traceability.
Build risk assessments as a parent analysis with child risk items — each with hazard, harm, severity, probability, risk controls, and residual (post-control) scores. A Cyber risk is scored by exploitability instead of probability, as FDA's premarket cybersecurity guidance recommends. The scores produce a banded risk level (Low, Medium or High); whether each risk is acceptable is a separate decision recorded on the item — Acceptable, ALARP or Not acceptable.
The electronic signature at review and approval binds the entire assessment — every field and every risk item — so altering any row after sign-off breaks the binding. Risk items lock once the analysis is reviewed, so the approval signs stable content. Segregation of duties separates reviewer and approver.
- ✓ Hazard analysis with initial and residual risk scoring
- ✓ Risk-control traceability bound into the signed record
- ✓ Banded risk levels (Low / Medium / High) with a separate, recorded acceptability decision
- ✓ Cyber risks scored by exploitability, with an optional CVSS reference
- ✓ Whole-assessment signature binding