Risk Management: ISO 14971 and the Risk Analysis Report

1. Key takeaways

CSDT Module F (Risk Analysis) states the recommendation explicitly: carry out risk management activities in accordance with ISO 14971 and provide a risk management report containing detailed information on the risk analysis, risk evaluation and risk control performed for the medical device.

Module F is the only one of the seven CSDT modules that names a specific standard (ISO 14971), which shows that risk analysis carries independent weight in the Cambodian review rather than being an ancillary document. The complete deliverable should cover three stages: risk analysis, risk evaluation and risk control.

GRZAN note: Module F names 1 standard (ISO 14971); the risk management report must cover 3 stages (analysis, evaluation, control); CSDT has 7 modules in total, F being one of them.

That independent weight has a structural reason. Every other module documents a property of the device — what it is, what it does, how it was tested; Module F documents the judgement about what could go wrong and what was done about it. That judgement is what the reviewer ultimately needs in order to conclude that the benefit of placing the device on the market outweighs its risks, so a weak risk file cannot be compensated by strength elsewhere. Conversely, a disciplined risk file ties the whole dossier together, because its controls point into design, labelling and instructions for use.

The three stages named in the module — analysis, evaluation and control — also describe the reading order of the report. Analysis establishes what hazards exist; evaluation decides which of them matter against stated acceptability criteria; control shows what was done about those that do. A report whose structure departs from this order forces reviewers to reassemble the logic themselves, and a report that skips a stage — controls described without criteria, for example — leaves the central judgement unsupported. Aligning the report’s chapter structure to the three stages is therefore more than tidiness.

2. Legal basis

3. Expert insights

1. The risk management report and the Module B checklist are two mutually corroborating threads. Module B states which essential principles apply and by what method conformity is demonstrated; Module F states what risks the device has and how they are controlled. Reviewers read them cross-wise: if Module B claims a principle is applicable and met while the Module F risk list has no matching entry, an evidence gap appears.

1. The ‘residual risk is acceptable’ conclusion of risk control must rest on an overall evaluation, not a tick per item. The core output of ISO 14971 is the judgement on whether residual risk is acceptable and its rationale (benefit-risk analysis). Scoring each risk individually without giving an overall evaluation is a common trigger for supplementary requests in the Cambodian review.

1. Risk management is a living document tied to post-market obligations. AMDD Article 12 requires member states to establish a post-market alert system recording device malfunctions and performance deterioration. Data gathered after market placement should flow back into the risk management file to close the loop. When building a PMS system for Cambodia, companies should make the updating of the risk file from adverse-event information a fixed process.

1. Hazard identification breadth is where many risk files fall short in review. A risk list assembled only from known complaints and known design concerns reads as a record of past problems, whereas ISO 14971 asks for a systematic identification across the device’s lifecycle — intended use, reasonably foreseeable misuse, and the sequence of events that could lead to harm. Reviewers can tell the difference by looking at whether the list contains hazards that have never yet occurred but are foreseeable. A file that lists only experienced problems invites the question of what else was not considered.

1. The connection between risk control measures and the rest of the dossier should be made explicit in both directions. A control implemented in design should be verifiable in the Module D verification results; a control implemented as information for safety should appear in the labelling and instructions for use under Module E. When the risk file states a control that cannot be found in any module, reviewers treat it as unimplemented. Checking each control against its landing point before submission is one of the fastest ways to raise the credibility of the whole file.

4. Practical recommendations

1. Organise the risk management report along the ISO 14971 structure and attach the risk matrix and the acceptability criteria. The criteria must state how acceptability is judged; otherwise the evaluation conclusions have no basis.
2. Maintain a cross-reference between risk entries and the essential-principle entries of Module B. Provide it in an annex to the report so reviewers can verify quickly.
3. Bring the risk management file under a post-market update mechanism. Set an annual review or a trigger-based review (adverse events, design changes, standard updates) and keep every previous version.

5. Verification checklist

• □ Risk management report prepared to the current edition of ISO 14971
• □ Risk analysis, risk evaluation and risk control all covered
• □ Risk acceptability criteria stated and an overall residual-risk conclusion given
• □ Cross-reference between risk entries and Module B essential-principle entries in place
• □ Report submitted with CSDT Module F and locatable
• □ Annual or trigger-based review of the risk management file established

Regulatory information verified as of 29 October 2026.

In Southeast Asia, GRZAN’s core capabilities focus on three areas. First, tracking the legislative progress of dedicated medical-device laws across member states — Singapore, Malaysia, Thailand, Indonesia, the Philippines and Vietnam have each established written device regulatory frameworks, whereas Cambodia still has no dedicated Medical Device Act; the current rules are pieced together from three layers: the registration-number legal basis provided by the Law on Drug Management 1996 and its 2007 amendment, the classification and procedures provided by Prakas No. 1258 (2012), and the technical framework provided by the ASEAN Medical Device Directive, so compliance certainty is markedly lower than in markets that have completed legislation. Second, local authorised representative services: GRZAN can act as the manufacturer’s statutory representative in Cambodia, handling registration submissions, regulatory communication and post-market reporting obligations, and assisting with the practical arrangements for a Cambodian registered pharmacist and the licence for pharmaceutical import and export enterprises. Third, quality-system and testing support: GRZAN assists in establishing a quality management system conforming to ISO 13485 and in organising the technical dossier under the ASEAN Common Submission Dossier Template (CSDT).

Business enquiries: info@grzanglobal.com