EPSP Checklist and ISO 14971 Risk Management File for Indonesian Submissions

1. Key takeaways

The Essential Principles checklist and the ISO 14971 risk management file answer two halves of one question, and reviewers read them together. The Essential Principles of Safety and Performance (EPSP) answer which principles you satisfy; the ISO 14971 risk management documentation answers how you demonstrate that risks have been reduced to acceptable levels. The first is a checklist, the second is methodological evidence, and both occupy fixed sections in the CSDT. A submission that treats them as separate paperwork chores loses the thread that connects a design claim to the proof behind it.

The two documents are also the review’s cross-reference engine. The reviewer uses the EPSP list to find where each principle is addressed and the risk management file to trace how each identified risk was controlled. When the two agree — same terminology, same evidence pointers — the review moves quickly. When they disagree, every discrepancy becomes a question.

• EPSP entry, three elements per principle: applicable or not applicable (with reasons where not), the way it is satisfied (which design feature or which verification), and the evidence pointer (which report, which section).
• Risk management review, closed loop: hazard identification → risk estimation → risk control measures → residual risk evaluation → benefit-risk conclusion.
• Three reviewer focus points: coverage of the Indonesian intended use and use environment, mapping of controls to specific verification evidence, and a clear conclusion on residual risk acceptability.
• EU/US files: usable as a base, but localisation is mandatory.
• Class C and D: heavier evidence chains — clinical evidence for C, post-market surveillance reports added for D.

2. Legal basis

The EPSP checklist appears as a fixed section of the ASEAN CSDT. Risk management is prepared to ISO 14971:2019. The technical documentation requirements sit in Permenkes No. 11/2025, Appendix 3, and the link between classification and evidence depth is set by Permenkes No. 5/2026, Article 55. The references below were verified on 26 October 2026.

The classification link matters for planning. As the risk class rises, the risk management file must support a heavier evidence chain: Class C devices require clinical evidence, and Class D devices additionally require post-market surveillance reports. The risk management file is the index of all technical evidence — if it is not built properly early, the evidence assembled later loses its organising structure, and the deficiency that results is not a missing document but a missing map.

3. Expert insights

Insight 1: a checklist that says only “compliant” is almost guaranteed to be sent back. The way to fill the EPSP list that survives review is to write three things for every principle: ① applicable or not applicable, with reasons stated where a principle is claimed not to apply; ② the way it is satisfied — which design feature or which verification carries it; and ③ the evidence pointer — which report and which section a reviewer should turn to. A bare conformity claim gives the reviewer nothing to verify, and the file comes back with a request to supply exactly what should have been written in the first pass.

Insight 2: reviewers read the risk file as a loop, not as a stack of tables. The examination follows the closed loop from hazard identification through risk estimation, risk control measures and residual risk evaluation to the benefit-risk conclusion. Three points draw the reviewer’s attention: whether the identified risks cover the intended use and use environment as submitted in Indonesia; whether control measures map to specific verification evidence; and whether the acceptability of residual risk carries an explicit conclusion. A file that stops at listing hazards, or that names controls without pointing to the tests that verify them, breaks the loop at a visible joint.

Insight 3: European or American technical files are a starting point, not a submission. They can be used as the base, but they must be localised, for two reasons. First, the intended use and user population may differ — storage and transport conditions in a tropical environment are the standing example. Second, the Indonesian-language labels and IFU must be brought into the risk management consistency check: every warning on the label must be findable as a corresponding item in the risk management file. A label warning that has no risk entry is an orphan, and orphans are what reviewers are trained to look for.

4. Practical recommendations

• Build a three-column mapping table: principle — risk — evidence. Run it horizontally across the EPSP, the ISO 14971 file and the verification reports.
• Use the table as the submission’s core and the deficiency-response index. It is both the centre of the dossier and the fastest retrieval tool when a reviewer’s questions arrive.
• Write every EPSP entry with method and pointer, never a bare compliance claim.
• Check intended-use coverage in the risk file against the Indonesian submission, including storage and transport in tropical conditions where relevant.
• Reconcile label warnings with the risk management file so each warning on the Indonesian label has a matching entry.
• State an explicit residual-risk acceptability conclusion, tied to the benefit-risk discussion rather than asserted.
• Scale the file to the class: plan the clinical evidence workstream for Class C and post-market surveillance reporting for Class D from the outset.

The mapping table earns its keep twice. During writing, it exposes gaps while they are still cheap — a principle with no evidence pointer, a control with no test, a warning with no risk entry. During review, it converts a deficiency letter from an archaeology exercise into a lookup exercise, because every question the reviewer asks can be answered by following one row of the table to its documents.

5. Verification checklist

• □ EPSP checklist completed per the ASEAN CSDT, each principle with applicability, method of satisfaction and evidence pointer
• □ Risk management file prepared under ISO 14971:2019
• □ Closed loop present: hazard identification, risk estimation, risk control, residual risk evaluation, benefit-risk conclusion
• □ Risks cover the Indonesian intended use and use environment
• □ Control measures mapped to specific verification evidence
• □ Residual risk acceptability stated as an explicit conclusion
• □ Indonesian label warnings reconciled with entries in the risk management file
• □ Evidence depth matches the classification under Permenkes No. 5/2026, Article 55
• □ Principle–risk–evidence mapping table maintained and current

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across Southeast Asia, including Indonesia. Our team prepares dossiers to ASEAN CSDT structure, manages AKL/AKL-I submissions with Kemenkes, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com