ISO 14971 Risk Management Documentation for Medical Devices in Iran

1. Key takeaways

Risk management documentation is prepared under ISO 14971:2019, and the practical attention of Iranian reviewers concentrates on three places: the criteria for judging risk acceptability, the evaluation conclusions for individual risks, and the overall conclusion on the combined residual risk. The judgement of GRZAN is that placing these three items at the front of the document with clear conclusions is more effective than submitting a complete risk file running to hundreds of pages — what reviewers need is not a record of process but conclusions they can judge. Structure the document for the reader who is judging it, not for the process that produced it. A reviewer who can reach the three conclusions in the first pages arrives at the rest of the file already oriented.

• Risk management documentation follows ISO 14971:2019, whose structure is familiar to reviewers.
• Reviewer attention concentrates on three places: the acceptability criteria, the individual risk conclusions, and the combined residual risk conclusion.
• Clear conclusions placed up front are more effective than hundreds of pages of process records. The front of the document is the part every reviewer reads.
• Reviewers need judgable conclusions, not process documentation, and the document should be arranged so those conclusions arrive first. The document opens with what the reviewer will judge by.

2. Legal basis

The legal and normative references supporting this module are the following.

1. ISO 14971:2019 (Medical devices — Application of risk management to medical devices): generally accepted by the Iranian authorities; where a corresponding ISIRI standard exists, conformity is judged against the ISIRI standard — this is a practical estimate.
2. ISO 13485:2016 quality system evidence — this is a practical estimate.
3. Law on the Administration of Medical, Pharmaceutical and Food-Beverage Affairs, FAOLEX LEX-FAOC227692, 1955-06-20, Article 3.

3. Expert insights

Insight 1: the acceptability criteria are the reviewer’s first landing point. Before a reviewer can evaluate any individual conclusion, the reviewer must know the standard against which that conclusion was reached. If the criteria themselves are vague — for example a policy of “reducing risk as far as possible” — then every downstream conclusion becomes unverifiable, because there is no fixed measure against which acceptability was judged. GRZAN requires that the criteria be quantified or at least clearly graded: severity levels defined, probability bands defined, and the combination rules that turn the two into an acceptability judgement written out explicitly. Vague criteria are not a stylistic weakness; they are a structural defect, because they make the entire risk file logically incapable of supporting the conclusions it contains. Quantified criteria also serve the applicant internally, because they make every later judgement mechanical rather than argumentative. A criterion that cannot be applied mechanically is a criterion that cannot be checked by anyone but its author.

Insight 2: the conclusion for each individual risk must be checkable. Every identified risk should carry a judgement of “severity — probability of occurrence — acceptability”, recorded where the reviewer can find it and trace it back to the criteria. The test is simple: can a reviewer pick any row in the risk list and verify the conclusion from the criteria alone? If the answer is yes, the file functions as evidence; if the answer is no, the file functions as narrative. Missing entries are treated exactly as what they are — incomplete work — and are requested directly as supplements. A complete, individually checkable risk list is the difference between a reviewer reading the file and a reviewer re-performing it. The format matters as much as the content: a list that can be scanned row by row supports the check, while a narrative buries it. Every entry should be traceable to the criteria on page one.

Insight 3: the combined residual risk needs an overall conclusion. ISO 14971:2019 requires that, after all individual risks have been evaluated, an assessment be made of whether the combined residual risk is acceptable. Individual conclusions, however complete, do not add up to this conclusion on their own; the standard demands a separate, explicit judgement about the product taken as a whole. In practice this conclusion is one of the most frequently omitted items, and its absence is a high-frequency trigger for deficiency requests — precisely because it cannot be inferred by the reviewer on the applicant’s behalf. Stating it clearly, and grounding it in the criteria on the first page, closes one of the most predictable gaps in the module. The combined conclusion is where the individual judgements are weighed together, and no reviewer can perform that weighing on the applicant’s behalf. Writing it takes a paragraph; answering for its absence takes a deficiency cycle.

4. Practical recommendations

• Put the criteria on the first page: quantified or clearly graded acceptability criteria belong on page one of the document, fixing the measure before the first conclusion is drawn.
• Keep the risk list complete and checkable: list the severity, probability and acceptability judgements item by item, so that no identified risk lacks a recorded judgement.
• Give an overall conclusion on the combined residual risk: do not omit this item; it is the sentence most often missing and most often requested.
• Cross-reference with the biological and clinical evaluations: the risk conclusions of the three documents should be consistent and free of contradiction, and any mismatch reconciled before submission.

5. Verification checklist

• □ The risk acceptability criteria have been quantified or clearly graded and placed on the first page
• □ The risk list gives a severity–probability–acceptability judgement for every entry
• □ An overall conclusion on the combined residual risk has been given
• □ The risk conclusions have been cross-checked for consistency with the biological and clinical evaluations
• □ Risk management document versions correspond one to one with product models

Regulatory information verified as of October 29, 2026

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Iranian market. Our team prepares IFDA-compliant dossiers, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com