Risk Management Documentation Under ISO 14971: Key Points for Malaysian Submissions

1. Key takeaways

Risk management documentation is a core review object, not an appendix to the technical file. The Essential Principles require risk to be acceptable, and the CAB’s verification conclusion includes a judgement on whether the risk is acceptable in the current state of the art. The risk management file is therefore read twice: once as part of the technical documentation review before registration, and again as part of the post-market surveillance assessment afterwards. It is the common evidence base for both.

Industry practice is to prepare the file on the ISO 14971 model, covering the full chain from risk analysis through evaluation, control, residual risk and the risk management report. The standard supplies the method; the review supplies the test. What the CAB checks is consistency — whether the file, the EPSP mapping, the test evidence and the labelling warnings describe the same device and the same set of risks.

• Status: a core review object, judged against the acceptability of risk in the current state of the art.
• Method: the ISO 14971 chain — analysis, evaluation, control, residual risk, risk management report.
• Dual use: evidence for technical documentation review and for PMS assessment.
• Consistency test: alignment with the EPSP mapping, test evidence and labelling warnings.
• Common deficiencies: incomplete analysis, controls without verification, residual risks not warned, no post-market closure.
• Reuse: an NMPA file can supply the framework, but Malaysian elements have to be added.

2. Legal basis

The requirement is expressed through the Essential Principles in Appendix 1 of the Third Schedule to MDR 2012, which requires that risks be reduced as far as possible and that residual risk be acceptable. The MDA guidance on conducting conformity assessment by way of verification, issued in 2025, makes the operational test explicit: the conclusion includes a judgement on whether the risk is acceptable in the current state of the art. ISO 14971 is the industry method standard against which the file is structured.

The phrase current state of the art is the part that catches files prepared as a formality. It asks not whether the manufacturer applied its own criteria consistently, but whether those criteria reflect what is generally accepted at the time of review. A file that evaluates risk against an internal threshold established years earlier may be internally consistent and still fail the test, because the benchmark has moved.

3. Expert insights

Insight 1: the four common findings share a single cause. Incomplete analysis, usually through missing use scenarios or foreseeable misuse; control measures that are not connected to verification evidence; residual risks that never reach the labelling or IFU as warnings; and risk data that never closes the loop with PMS and complaint records. Each is a break in traceability between one stage of the chain and the next. Reviewers follow the chain in order, so a single break is enough to make the later stages unverifiable.

Insight 2: reuse from an NMPA file requires three additions. The framework travels well, because the methodology is the same ISO 14971 chain. What has to be added is Malaysian-specific: a clause-by-clause mapping to the EPSP; consideration of the local use environment, including climate, power supply and the level of the intended user; and a re-assessment of risks arising from recall or field corrective action history in other countries. The third addition is the one most often omitted, and it is the one most easily found by a reviewer with access to regulatory databases.

Insight 3: the labelling is where residual risk becomes visible. A residual risk that exists in the file but not on the label is, from the reviewer’s perspective, a risk that has been accepted silently. The requirement is not that every risk be eliminated but that what remains be communicated to the user. This is why label warnings and the risk file have to be read against each other; a warning on the label with no corresponding entry in the file is as problematic as the reverse.

Insight 4: the PMS assessment looks for the loop, not for a new document. Risk management outputs, particularly the residual risk monitoring items, should be converted into PMS monitoring indicators. When the MDA examines PMS, it looks at whether that conversion happened. A manufacturer who treats risk management and post-market surveillance as two separate workstreams tends to fail both elements at once, because the failure is the absence of a connection rather than a defect in either document.

4. Practical recommendations

• Build a three-column table. For each major residual risk, record one IFU warning and one post-market monitoring item, so that a single piece of work satisfies the technical review, the labelling and the PMS requirement.
• Trace every control to verification. Each control measure should cite the test or analysis that demonstrates it works.
• Check the state of the art. Confirm that the acceptability criteria reflect current practice rather than historical internal thresholds.
• Add the Malaysian elements. Include EPSP clause mapping, local use environment factors and a re-assessment of foreign recall or field corrective action history.
• Reconcile the label against the file. Every warning on the label should have a corresponding residual risk entry.
• Carry the outputs into PMS. Define monitoring indicators from the risk file and review them on a scheduled basis.

The economics again favour front-loading. A traceability table built once serves three review points and survives renewal; the same content assembled three times, separately, tends to diverge, and divergence is what the consistency test detects.

5. Verification checklist

• □ Risk management file structured to the ISO 14971 chain, from analysis to report
• □ Hazard analysis covers use scenarios and foreseeable misuse
• □ Acceptability criteria reflect the current state of the art
• □ Each control measure cross-referenced to verification evidence
• □ Every major residual risk reflected as a warning in the labelling or IFU
• □ Malaysian elements added: EPSP mapping, local use environment, foreign recall and field corrective action history
• □ Residual risk monitoring items converted into PMS monitoring indicators

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across Southeast Asia, including Malaysia. Our team prepares dossiers to ASEAN CSDT structure, manages submissions and deficiency responses with the MDA, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com