Risk Management Documents: ISO 14971

1. Key takeaways

Myanmar’s requirements for risk management documentation are layered by risk class: Class A may use a simplified version, while Class B and Class C must submit a complete summary. The governing standard is ISO 14971.

GRZAN note: the risk management file is the hub that connects the device description, the test reports and the clinical evaluation. It explains why the identified risks are acceptable and why these particular tests had to be performed. If the risk management file and the test reports drift apart, reviewers will question the internal consistency of the entire technical documentation, so the file deserves the same drafting care as the reports it binds together.

• Class A — risk management documentation may be simplified;
• Class B — risk management documentation is required;
• Class C — risk management documentation is required;
• Governing standard — ISO 14971 (summary form).

In project terms, the risk management file should be written early rather than last. Because it must explain why the tests were chosen and why the residual risks are acceptable, it depends on inputs from the device description and the verification programme — but the test reports and the clinical evaluation in turn take their structure from the risks the file identifies. Treating it as a hub, drafted in parallel with the test plan, keeps the whole technical section aligned instead of letting each document evolve on its own.

2. Legal basis

The class-specific requirements are drawn from the technical documents cross-reference table in Section 2 of the Myanmar Food and Drug Administration’s Technical Guidelines for Online Submission of Medical Devices, and the file is submitted through the e-Submission system’s medical device module. The same guidelines place Myanmar’s standards system on the internationally recognised set summarised below, which means risk work performed to ISO 14971 for other markets can be reused here in summary form rather than rebuilt.

3. Expert insights

Insight 1: the layered requirement for the risk management file matches the overall classification logic. Class A is simplified and Classes B and C require the full summary, reflecting the design principle that the higher the risk, the deeper the documentation. Teams can therefore scale their drafting effort to the class rather than producing one uniform file for every product line.

Insight 2: the summary form means the deliverable is an extraction, not the full archive. Companies should prepare a structured summary covering four stages — risk analysis, risk evaluation, risk control and the evaluation of residual risk — rather than submitting the complete risk management file. The full internal record remains available to answer follow-up questions, but what the reviewer sees is a distilled, decision-oriented document.

Insight 3: the risk management file must corroborate the test items. If the risk analysis identifies an electrical safety risk, the test report should contain the corresponding IEC 60601 test items. This correspondence is the key evidence reviewers use to judge documentation quality: a risk named in the file but never tested, or a test with no originating risk, both break the chain. Building the risk-point-to-test-item mapping table early — before the test laboratory is even booked — makes the correspondence something the team designs in, rather than something it repairs under a deficiency letter.

Insight 4: the acceptability of residual risk needs an explicit conclusion. The summary must not stop at listing risks; it must state the acceptability judgment after risk control. A list without a conclusion leaves the central regulatory question — whether the product is safe enough — unanswered.

Additional point to insight 4: the ISO 14971 summary should be updated in step with design changes, forming a closed loop with change notification, so that the submitted summary always describes the device actually being registered.

Insight 5: the version of the risk management file must be consistent with the rest of the dossier. Chaotic version numbering is read as a signal that the quality management system is failing. Version control across the dossier is therefore part of the evidence for the ISO 13485 system the file itself depends on.

4. Practical recommendations

• Scale the depth of the risk management file to the class. Simplified for Class A, complete summary for Classes B and C.
• Make the risk management file correspond to the test items. Maintain a risk-point-to-test-item mapping table.
• State the residual risk acceptability conclusion explicitly in the summary. Do not stop at listing risks.
• Update the risk management file whenever the design changes. Trigger change notification at the same time.
• Manage version numbers uniformly. Keep them consistent with every other part of the dossier.

Read together, the recommendations describe a single discipline: the risk file is not a stand-alone deliverable but the connective tissue of the dossier. Drafted to the class-appropriate depth, mapped against the test items, closed with a residual-risk conclusion, and kept version-locked to the rest of the submission, it turns a set of separate documents into one internally consistent technical story — which is precisely what the reviewer is looking for.

5. Verification checklist

• □ Depth of the risk management file prepared according to the device class
• □ Risk-point-to-test-item mapping table established
• □ Summary contains the residual risk acceptability conclusion
• □ Linkage mechanism between design changes and risk file updates established
• □ Document version numbers managed uniformly
• □ Summary covers the four stages of risk analysis, evaluation and control
• □ Risk file included in the registration register management

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across Southeast Asia, including Myanmar. Our team prepares the technical dossier to ASEAN CSDT structure, manages submission and deficiency responses with the Myanmar FDA, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com