Regulatory Open Forum

First, ignore P1 and P2. They only illustrate a concept. They are not required.

Estimate the components of risk using the definition. First determine the harm that occurs if the hazardous situation were to happen. There could be many different harms associated with a hazardous situation. Determine the severity of each harm. Then determine the probability of that harm occurring with the determined severity. Put these values into the risk matrix in the Risk Management Plan to estimate the risk.

There are no calculations required. You could rely on historical data, published articles, registry data, the team's best guess, etc.

In some cases, you cannot estimate the probability such as a use error. In those cases, the risk estimate uses severity only. The Risk Management Plan needs to cover this case.

First, ignore P1 and P2. They only illustrate a concept. They are not required.

Estimate the components of risk using the definition. First determine the harm that occurs if the hazardous situation were to happen. There could be many different harms associated with a hazardous situation. Determine the severity of each harm. Then determine the probability of that harm occurring with the determined severity. Put these values into the risk matrix in the Risk Management Plan to estimate the risk.

There are no calculations required. You could rely on historical data, published articles, registry data, the team's best guess, etc.

In some cases, you cannot estimate the probability such as a use error. In those cases, the risk estimate uses severity only. The Risk Management Plan needs to cover this case.

First, ignore P1 and P2. They only illustrate a concept. They are not required.

Estimate the components of risk using the definition. First determine the harm that occurs if the hazardous situation were to happen. There could be many different harms associated with a hazardous situation. Determine the severity of each harm. Then determine the probability of that harm occurring with the determined severity. Put these values into the risk matrix in the Risk Management Plan to estimate the risk.

There are no calculations required. You could rely on historical data, published articles, registry data, the team's best guess, etc.

In some cases, you cannot estimate the probability such as a use error. In those cases, the risk estimate uses severity only. The Risk Management Plan needs to cover this case.

First, ignore P1 and P2. They only illustrate a concept. They are not required.

Estimate the components of risk using the definition. First determine the harm that occurs if the hazardous situation were to happen. There could be many different harms associated with a hazardous situation. Determine the severity of each harm. Then determine the probability of that harm occurring with the determined severity. Put these values into the risk matrix in the Risk Management Plan to estimate the risk.

There are no calculations required. You could rely on historical data, published articles, registry data, the team's best guess, etc.

In some cases, you cannot estimate the probability such as a use error. In those cases, the risk estimate uses severity only. The Risk Management Plan needs to cover this case.

Remember that the risk of a harm has two components: severity and probability. They are closely related since you need the probability that the harm occurs with the stated severity. A burn provides a good example. The harm could be a burn which has three levels of severity. The probability of a first-degree burn will not be the probability of a second-degree burn, etc.

A common approach is a five-point scale. You need good definitions for the scale so it is easy for the team to agree. Often a medical person can help.

For severity, it is best to start with a five-point scale using definitions and not numbers. Typically, you need a lot of post-market data to use a numerical scale.

The Risk Management Plan will have the severity and probability scales. It will also have a risk matrix that explains how to combine severity and probability to get a risk level. You will need this as part of risk evaluation to determine if the risk is acceptable or requires risk reduction.

If you need risk reduction, start with the sequence of events. They lead to the hazardous situation, so you want to break the sequence. If there is no hazardous situation, there is no harm. Usually, this is hard. Your risk reduction measures should reduce the severity, the probability, or both. For the residual risk, use the same scales and the same risk matrix. You want to get into the best box possible in the risk matrix. You also want that box to be in the acceptable risk region.

First, ignore P1 and P2. They only illustrate a concept. They are not required.

Estimate the components of risk using the definition. First determine the harm that occurs if the hazardous situation were to happen. There could be many different harms associated with a hazardous situation. Determine the severity of each harm. Then determine the probability of that harm occurring with the determined severity. Put these values into the risk matrix in the Risk Management Plan to estimate the risk.

There are no calculations required. You could rely on historical data, published articles, registry data, the team's best guess, etc.

In some cases, you cannot estimate the probability such as a use error. In those cases, the risk estimate uses severity only. The Risk Management Plan needs to cover this case.

Remember Severity of Harm includes people, property, and the environment. For people, the best choice is a qualitative scale of 4 or 5 levels based on the definitions of severity found in either the FDA Medical Device Reporting regulation 21 CFR 803 such as Critical-fatality or non reversible serious injury; Serious-medically reversible serious injury; Major-injury with minor medical intervention; Moderate-injury not requiring medical intervention; Minor-No injury, or other such description. These descriptions should along with the vigilance reporting systems of FDA, EC, and other regulatory bodies where you distribute product. This alignment will help your pot-market activities align with the design processes and make these processes more seamless. 

Based on feed back from the EC, I would avoid setting acceptable regions, as Notified Bodies don't like the use of "Acceptable Risk".  The risks must each individually be reduced As Far As Possible without impacting the Benefit to Risk ratio. Notified Bodies think if you have established an Acceptable region, you can stop reducing risk when you reach that region, which does not meet the regulatory requirements. Also in that scheme each risk must be treated individually as to when to stop risk reduction, there is no universal "acceptable" line to cross.

Be sure you have a copy of ISO TR 24971:2020, as most of what has been discussed in this chain is covered in that 85 page guidance document which is a good aid in understanding ISO 14971:2019 and the topics are aligned  so if you want more on Clause 5 on Risk Analysis in 14971, then go to Clause 5 in 24971.  The Annexes A to the end are cross-cutting topics that cover multiple numbered clauses in the standard.

Wish you the best on this journey, I am starting to understand medical device risk management after 22 years on the standards committee.  I am by no means an expert, but I do have contact information for those that know certain aspects of medical device risk management!  

Remember that the risk of a harm has two components: severity and probability. They are closely related since you need the probability that the harm occurs with the stated severity. A burn provides a good example. The harm could be a burn which has three levels of severity. The probability of a first-degree burn will not be the probability of a second-degree burn, etc.

A common approach is a five-point scale. You need good definitions for the scale so it is easy for the team to agree. Often a medical person can help.

For severity, it is best to start with a five-point scale using definitions and not numbers. Typically, you need a lot of post-market data to use a numerical scale.

The Risk Management Plan will have the severity and probability scales. It will also have a risk matrix that explains how to combine severity and probability to get a risk level. You will need this as part of risk evaluation to determine if the risk is acceptable or requires risk reduction.

If you need risk reduction, start with the sequence of events. They lead to the hazardous situation, so you want to break the sequence. If there is no hazardous situation, there is no harm. Usually, this is hard. Your risk reduction measures should reduce the severity, the probability, or both. For the residual risk, use the same scales and the same risk matrix. You want to get into the best box possible in the risk matrix. You also want that box to be in the acceptable risk region.

First, ignore P1 and P2. They only illustrate a concept. They are not required.

Estimate the components of risk using the definition. First determine the harm that occurs if the hazardous situation were to happen. There could be many different harms associated with a hazardous situation. Determine the severity of each harm. Then determine the probability of that harm occurring with the determined severity. Put these values into the risk matrix in the Risk Management Plan to estimate the risk.

There are no calculations required. You could rely on historical data, published articles, registry data, the team's best guess, etc.

In some cases, you cannot estimate the probability such as a use error. In those cases, the risk estimate uses severity only. The Risk Management Plan needs to cover this case.

Remember Severity of Harm includes people, property, and the environment. For people, the best choice is a qualitative scale of 4 or 5 levels based on the definitions of severity found in either the FDA Medical Device Reporting regulation 21 CFR 803 such as Critical-fatality or non reversible serious injury; Serious-medically reversible serious injury; Major-injury with minor medical intervention; Moderate-injury not requiring medical intervention; Minor-No injury, or other such description. These descriptions should along with the vigilance reporting systems of FDA, EC, and other regulatory bodies where you distribute product. This alignment will help your pot-market activities align with the design processes and make these processes more seamless. 

Based on feed back from the EC, I would avoid setting acceptable regions, as Notified Bodies don't like the use of "Acceptable Risk".  The risks must each individually be reduced As Far As Possible without impacting the Benefit to Risk ratio. Notified Bodies think if you have established an Acceptable region, you can stop reducing risk when you reach that region, which does not meet the regulatory requirements. Also in that scheme each risk must be treated individually as to when to stop risk reduction, there is no universal "acceptable" line to cross.

Be sure you have a copy of ISO TR 24971:2020, as most of what has been discussed in this chain is covered in that 85 page guidance document which is a good aid in understanding ISO 14971:2019 and the topics are aligned  so if you want more on Clause 5 on Risk Analysis in 14971, then go to Clause 5 in 24971.  The Annexes A to the end are cross-cutting topics that cover multiple numbered clauses in the standard.

Wish you the best on this journey, I am starting to understand medical device risk management after 22 years on the standards committee.  I am by no means an expert, but I do have contact information for those that know certain aspects of medical device risk management!  

Remember that the risk of a harm has two components: severity and probability. They are closely related since you need the probability that the harm occurs with the stated severity. A burn provides a good example. The harm could be a burn which has three levels of severity. The probability of a first-degree burn will not be the probability of a second-degree burn, etc.

A common approach is a five-point scale. You need good definitions for the scale so it is easy for the team to agree. Often a medical person can help.

For severity, it is best to start with a five-point scale using definitions and not numbers. Typically, you need a lot of post-market data to use a numerical scale.

The Risk Management Plan will have the severity and probability scales. It will also have a risk matrix that explains how to combine severity and probability to get a risk level. You will need this as part of risk evaluation to determine if the risk is acceptable or requires risk reduction.

If you need risk reduction, start with the sequence of events. They lead to the hazardous situation, so you want to break the sequence. If there is no hazardous situation, there is no harm. Usually, this is hard. Your risk reduction measures should reduce the severity, the probability, or both. For the residual risk, use the same scales and the same risk matrix. You want to get into the best box possible in the risk matrix. You also want that box to be in the acceptable risk region.

First, ignore P1 and P2. They only illustrate a concept. They are not required.

Estimate the components of risk using the definition. First determine the harm that occurs if the hazardous situation were to happen. There could be many different harms associated with a hazardous situation. Determine the severity of each harm. Then determine the probability of that harm occurring with the determined severity. Put these values into the risk matrix in the Risk Management Plan to estimate the risk.

There are no calculations required. You could rely on historical data, published articles, registry data, the team's best guess, etc.

In some cases, you cannot estimate the probability such as a use error. In those cases, the risk estimate uses severity only. The Risk Management Plan needs to cover this case.

There is a process flow in the standard. If you use an Excel worksheet, there is a column for each process step and a row for each combination of hazard, sequence of events, hazardous situation, harm, severity of the harm, probability of the harm with the stated severity, and estimated initial risk. (There are other columns, but not relevant to this discussion.)

In conducting risk management follow the process steps in order. Don't change the order of the steps, or you will create confusion.

Start with a list of  hazards that apply to your device.

For each hazard, develop a sequence of events. Any given hazard could have more than sequence of events. In addition, one sequence could have a fault condition, another could be normal operation, another could have a use error, etc. They don't all necessarily occur, but this will guide your thinking.

Each sequence of events leads to a hazardous situation. Describe it succinctly.

The hazardous situation leads to harm. In this response, I consider harm to the patient or user only. There are other things for which harm could occur.

There could be more than one harm from the hazardous situation. Put each of them in a separate row.

A harm could occur with different levels of severity. For example, a thermal burn could be first, second, or third degree. Each is a severity level.

A harm's severity happens with a probability. Think of this as a rate. For example a patient has a first degree burn one time in every 12,500 uses.

Use the risk matrix from your Risk Management Plan to estimate the initial risk, i.e., the risk before risk control measures.

Risk control measures reduce the severity or probability or both of the harm. For example, the device has a hot surface which results in a first degree burn if touched. Estimate how often the patient or user would touch the hot surface to get the frequency of the first-degree burn. Pick "information for safety" as a risk control measure by adding a sticker that says "Hot surface – do not touch". The severity stays the same, but the probability deceases because the patient or user heeds the sticker. This is a reduction in the residual risk (with sticker) from the initial risk (without sticker).

Remember Severity of Harm includes people, property, and the environment. For people, the best choice is a qualitative scale of 4 or 5 levels based on the definitions of severity found in either the FDA Medical Device Reporting regulation 21 CFR 803 such as Critical-fatality or non reversible serious injury; Serious-medically reversible serious injury; Major-injury with minor medical intervention; Moderate-injury not requiring medical intervention; Minor-No injury, or other such description. These descriptions should along with the vigilance reporting systems of FDA, EC, and other regulatory bodies where you distribute product. This alignment will help your pot-market activities align with the design processes and make these processes more seamless. 

Based on feed back from the EC, I would avoid setting acceptable regions, as Notified Bodies don't like the use of "Acceptable Risk".  The risks must each individually be reduced As Far As Possible without impacting the Benefit to Risk ratio. Notified Bodies think if you have established an Acceptable region, you can stop reducing risk when you reach that region, which does not meet the regulatory requirements. Also in that scheme each risk must be treated individually as to when to stop risk reduction, there is no universal "acceptable" line to cross.

Be sure you have a copy of ISO TR 24971:2020, as most of what has been discussed in this chain is covered in that 85 page guidance document which is a good aid in understanding ISO 14971:2019 and the topics are aligned  so if you want more on Clause 5 on Risk Analysis in 14971, then go to Clause 5 in 24971.  The Annexes A to the end are cross-cutting topics that cover multiple numbered clauses in the standard.

Wish you the best on this journey, I am starting to understand medical device risk management after 22 years on the standards committee.  I am by no means an expert, but I do have contact information for those that know certain aspects of medical device risk management!  

Remember that the risk of a harm has two components: severity and probability. They are closely related since you need the probability that the harm occurs with the stated severity. A burn provides a good example. The harm could be a burn which has three levels of severity. The probability of a first-degree burn will not be the probability of a second-degree burn, etc.

A common approach is a five-point scale. You need good definitions for the scale so it is easy for the team to agree. Often a medical person can help.

For severity, it is best to start with a five-point scale using definitions and not numbers. Typically, you need a lot of post-market data to use a numerical scale.

The Risk Management Plan will have the severity and probability scales. It will also have a risk matrix that explains how to combine severity and probability to get a risk level. You will need this as part of risk evaluation to determine if the risk is acceptable or requires risk reduction.

If you need risk reduction, start with the sequence of events. They lead to the hazardous situation, so you want to break the sequence. If there is no hazardous situation, there is no harm. Usually, this is hard. Your risk reduction measures should reduce the severity, the probability, or both. For the residual risk, use the same scales and the same risk matrix. You want to get into the best box possible in the risk matrix. You also want that box to be in the acceptable risk region.

First, ignore P1 and P2. They only illustrate a concept. They are not required.

Estimate the components of risk using the definition. First determine the harm that occurs if the hazardous situation were to happen. There could be many different harms associated with a hazardous situation. Determine the severity of each harm. Then determine the probability of that harm occurring with the determined severity. Put these values into the risk matrix in the Risk Management Plan to estimate the risk.

There are no calculations required. You could rely on historical data, published articles, registry data, the team's best guess, etc.

In some cases, you cannot estimate the probability such as a use error. In those cases, the risk estimate uses severity only. The Risk Management Plan needs to cover this case.

There is a process flow in the standard. If you use an Excel worksheet, there is a column for each process step and a row for each combination of hazard, sequence of events, hazardous situation, harm, severity of the harm, probability of the harm with the stated severity, and estimated initial risk. (There are other columns, but not relevant to this discussion.)

In conducting risk management follow the process steps in order. Don't change the order of the steps, or you will create confusion.

Start with a list of  hazards that apply to your device.

For each hazard, develop a sequence of events. Any given hazard could have more than sequence of events. In addition, one sequence could have a fault condition, another could be normal operation, another could have a use error, etc. They don't all necessarily occur, but this will guide your thinking.

Each sequence of events leads to a hazardous situation. Describe it succinctly.

The hazardous situation leads to harm. In this response, I consider harm to the patient or user only. There are other things for which harm could occur.

There could be more than one harm from the hazardous situation. Put each of them in a separate row.

A harm could occur with different levels of severity. For example, a thermal burn could be first, second, or third degree. Each is a severity level.

A harm's severity happens with a probability. Think of this as a rate. For example a patient has a first degree burn one time in every 12,500 uses.

Use the risk matrix from your Risk Management Plan to estimate the initial risk, i.e., the risk before risk control measures.

Risk control measures reduce the severity or probability or both of the harm. For example, the device has a hot surface which results in a first degree burn if touched. Estimate how often the patient or user would touch the hot surface to get the frequency of the first-degree burn. Pick "information for safety" as a risk control measure by adding a sticker that says "Hot surface – do not touch". The severity stays the same, but the probability deceases because the patient or user heeds the sticker. This is a reduction in the residual risk (with sticker) from the initial risk (without sticker).

Remember Severity of Harm includes people, property, and the environment. For people, the best choice is a qualitative scale of 4 or 5 levels based on the definitions of severity found in either the FDA Medical Device Reporting regulation 21 CFR 803 such as Critical-fatality or non reversible serious injury; Serious-medically reversible serious injury; Major-injury with minor medical intervention; Moderate-injury not requiring medical intervention; Minor-No injury, or other such description. These descriptions should along with the vigilance reporting systems of FDA, EC, and other regulatory bodies where you distribute product. This alignment will help your pot-market activities align with the design processes and make these processes more seamless. 

Based on feed back from the EC, I would avoid setting acceptable regions, as Notified Bodies don't like the use of "Acceptable Risk".  The risks must each individually be reduced As Far As Possible without impacting the Benefit to Risk ratio. Notified Bodies think if you have established an Acceptable region, you can stop reducing risk when you reach that region, which does not meet the regulatory requirements. Also in that scheme each risk must be treated individually as to when to stop risk reduction, there is no universal "acceptable" line to cross.

Be sure you have a copy of ISO TR 24971:2020, as most of what has been discussed in this chain is covered in that 85 page guidance document which is a good aid in understanding ISO 14971:2019 and the topics are aligned  so if you want more on Clause 5 on Risk Analysis in 14971, then go to Clause 5 in 24971.  The Annexes A to the end are cross-cutting topics that cover multiple numbered clauses in the standard.

Wish you the best on this journey, I am starting to understand medical device risk management after 22 years on the standards committee.  I am by no means an expert, but I do have contact information for those that know certain aspects of medical device risk management!  

Remember that the risk of a harm has two components: severity and probability. They are closely related since you need the probability that the harm occurs with the stated severity. A burn provides a good example. The harm could be a burn which has three levels of severity. The probability of a first-degree burn will not be the probability of a second-degree burn, etc.

A common approach is a five-point scale. You need good definitions for the scale so it is easy for the team to agree. Often a medical person can help.

For severity, it is best to start with a five-point scale using definitions and not numbers. Typically, you need a lot of post-market data to use a numerical scale.

The Risk Management Plan will have the severity and probability scales. It will also have a risk matrix that explains how to combine severity and probability to get a risk level. You will need this as part of risk evaluation to determine if the risk is acceptable or requires risk reduction.

If you need risk reduction, start with the sequence of events. They lead to the hazardous situation, so you want to break the sequence. If there is no hazardous situation, there is no harm. Usually, this is hard. Your risk reduction measures should reduce the severity, the probability, or both. For the residual risk, use the same scales and the same risk matrix. You want to get into the best box possible in the risk matrix. You also want that box to be in the acceptable risk region.

First, ignore P1 and P2. They only illustrate a concept. They are not required.

Estimate the components of risk using the definition. First determine the harm that occurs if the hazardous situation were to happen. There could be many different harms associated with a hazardous situation. Determine the severity of each harm. Then determine the probability of that harm occurring with the determined severity. Put these values into the risk matrix in the Risk Management Plan to estimate the risk.

There are no calculations required. You could rely on historical data, published articles, registry data, the team's best guess, etc.

In some cases, you cannot estimate the probability such as a use error. In those cases, the risk estimate uses severity only. The Risk Management Plan needs to cover this case.

Remember Severity of Harm includes people, property, and the environment. For people, the best choice is a qualitative scale of 4 or 5 levels based on the definitions of severity found in either the FDA Medical Device Reporting regulation 21 CFR 803 such as Critical-fatality or non reversible serious injury; Serious-medically reversible serious injury; Major-injury with minor medical intervention; Moderate-injury not requiring medical intervention; Minor-No injury, or other such description. These descriptions should along with the vigilance reporting systems of FDA, EC, and other regulatory bodies where you distribute product. This alignment will help your pot-market activities align with the design processes and make these processes more seamless. 

Based on feed back from the EC, I would avoid setting acceptable regions, as Notified Bodies don't like the use of "Acceptable Risk".  The risks must each individually be reduced As Far As Possible without impacting the Benefit to Risk ratio. Notified Bodies think if you have established an Acceptable region, you can stop reducing risk when you reach that region, which does not meet the regulatory requirements. Also in that scheme each risk must be treated individually as to when to stop risk reduction, there is no universal "acceptable" line to cross.

Be sure you have a copy of ISO TR 24971:2020, as most of what has been discussed in this chain is covered in that 85 page guidance document which is a good aid in understanding ISO 14971:2019 and the topics are aligned  so if you want more on Clause 5 on Risk Analysis in 14971, then go to Clause 5 in 24971.  The Annexes A to the end are cross-cutting topics that cover multiple numbered clauses in the standard.

Wish you the best on this journey, I am starting to understand medical device risk management after 22 years on the standards committee.  I am by no means an expert, but I do have contact information for those that know certain aspects of medical device risk management!  

Remember that the risk of a harm has two components: severity and probability. They are closely related since you need the probability that the harm occurs with the stated severity. A burn provides a good example. The harm could be a burn which has three levels of severity. The probability of a first-degree burn will not be the probability of a second-degree burn, etc.

A common approach is a five-point scale. You need good definitions for the scale so it is easy for the team to agree. Often a medical person can help.

For severity, it is best to start with a five-point scale using definitions and not numbers. Typically, you need a lot of post-market data to use a numerical scale.

The Risk Management Plan will have the severity and probability scales. It will also have a risk matrix that explains how to combine severity and probability to get a risk level. You will need this as part of risk evaluation to determine if the risk is acceptable or requires risk reduction.

If you need risk reduction, start with the sequence of events. They lead to the hazardous situation, so you want to break the sequence. If there is no hazardous situation, there is no harm. Usually, this is hard. Your risk reduction measures should reduce the severity, the probability, or both. For the residual risk, use the same scales and the same risk matrix. You want to get into the best box possible in the risk matrix. You also want that box to be in the acceptable risk region.

First, ignore P1 and P2. They only illustrate a concept. They are not required.

Estimate the components of risk using the definition. First determine the harm that occurs if the hazardous situation were to happen. There could be many different harms associated with a hazardous situation. Determine the severity of each harm. Then determine the probability of that harm occurring with the determined severity. Put these values into the risk matrix in the Risk Management Plan to estimate the risk.

There are no calculations required. You could rely on historical data, published articles, registry data, the team's best guess, etc.

In some cases, you cannot estimate the probability such as a use error. In those cases, the risk estimate uses severity only. The Risk Management Plan needs to cover this case.

The answer is you put them where they occur and do not overthink the organization of your documents. The standard has a process flow built in, that is identifying hazards, then determining the exposure of these hazards such that harm can occur (this is an important step to understanding not only how harm can occur, but also where you can place risk controls to break the hazard to harm pathway) and then what types of harm can occur to people, property and the environment as a result of THAT EXPOSURE, and don't try to connect Hazardous Situations where no realistic connections occur. 

I am a visual learner and like to draw pictures to help me understand the situation. If the picture does not show a connection then don't try to create one. Just document what you have found and stop. 

One of the aspects of risk management that is so often overlooked all over the process, is "why are we doing this?".  We want to make decisions to reduce risk, and time spent with all this clutter is time wasted from improving our products to improve safety. So don't overthink your documents and their organization where it does not lead to product improvement

Remember Severity of Harm includes people, property, and the environment. For people, the best choice is a qualitative scale of 4 or 5 levels based on the definitions of severity found in either the FDA Medical Device Reporting regulation 21 CFR 803 such as Critical-fatality or non reversible serious injury; Serious-medically reversible serious injury; Major-injury with minor medical intervention; Moderate-injury not requiring medical intervention; Minor-No injury, or other such description. These descriptions should along with the vigilance reporting systems of FDA, EC, and other regulatory bodies where you distribute product. This alignment will help your pot-market activities align with the design processes and make these processes more seamless. 

Based on feed back from the EC, I would avoid setting acceptable regions, as Notified Bodies don't like the use of "Acceptable Risk".  The risks must each individually be reduced As Far As Possible without impacting the Benefit to Risk ratio. Notified Bodies think if you have established an Acceptable region, you can stop reducing risk when you reach that region, which does not meet the regulatory requirements. Also in that scheme each risk must be treated individually as to when to stop risk reduction, there is no universal "acceptable" line to cross.

Be sure you have a copy of ISO TR 24971:2020, as most of what has been discussed in this chain is covered in that 85 page guidance document which is a good aid in understanding ISO 14971:2019 and the topics are aligned  so if you want more on Clause 5 on Risk Analysis in 14971, then go to Clause 5 in 24971.  The Annexes A to the end are cross-cutting topics that cover multiple numbered clauses in the standard.

Wish you the best on this journey, I am starting to understand medical device risk management after 22 years on the standards committee.  I am by no means an expert, but I do have contact information for those that know certain aspects of medical device risk management!  

Remember that the risk of a harm has two components: severity and probability. They are closely related since you need the probability that the harm occurs with the stated severity. A burn provides a good example. The harm could be a burn which has three levels of severity. The probability of a first-degree burn will not be the probability of a second-degree burn, etc.

A common approach is a five-point scale. You need good definitions for the scale so it is easy for the team to agree. Often a medical person can help.

For severity, it is best to start with a five-point scale using definitions and not numbers. Typically, you need a lot of post-market data to use a numerical scale.

The Risk Management Plan will have the severity and probability scales. It will also have a risk matrix that explains how to combine severity and probability to get a risk level. You will need this as part of risk evaluation to determine if the risk is acceptable or requires risk reduction.

If you need risk reduction, start with the sequence of events. They lead to the hazardous situation, so you want to break the sequence. If there is no hazardous situation, there is no harm. Usually, this is hard. Your risk reduction measures should reduce the severity, the probability, or both. For the residual risk, use the same scales and the same risk matrix. You want to get into the best box possible in the risk matrix. You also want that box to be in the acceptable risk region.

First, ignore P1 and P2. They only illustrate a concept. They are not required.

Estimate the components of risk using the definition. First determine the harm that occurs if the hazardous situation were to happen. There could be many different harms associated with a hazardous situation. Determine the severity of each harm. Then determine the probability of that harm occurring with the determined severity. Put these values into the risk matrix in the Risk Management Plan to estimate the risk.

There are no calculations required. You could rely on historical data, published articles, registry data, the team's best guess, etc.

In some cases, you cannot estimate the probability such as a use error. In those cases, the risk estimate uses severity only. The Risk Management Plan needs to cover this case.

The answer is you put them where they occur and do not overthink the organization of your documents. The standard has a process flow built in, that is identifying hazards, then determining the exposure of these hazards such that harm can occur (this is an important step to understanding not only how harm can occur, but also where you can place risk controls to break the hazard to harm pathway) and then what types of harm can occur to people, property and the environment as a result of THAT EXPOSURE, and don't try to connect Hazardous Situations where no realistic connections occur. 

I am a visual learner and like to draw pictures to help me understand the situation. If the picture does not show a connection then don't try to create one. Just document what you have found and stop. 

One of the aspects of risk management that is so often overlooked all over the process, is "why are we doing this?".  We want to make decisions to reduce risk, and time spent with all this clutter is time wasted from improving our products to improve safety. So don't overthink your documents and their organization where it does not lead to product improvement

Remember Severity of Harm includes people, property, and the environment. For people, the best choice is a qualitative scale of 4 or 5 levels based on the definitions of severity found in either the FDA Medical Device Reporting regulation 21 CFR 803 such as Critical-fatality or non reversible serious injury; Serious-medically reversible serious injury; Major-injury with minor medical intervention; Moderate-injury not requiring medical intervention; Minor-No injury, or other such description. These descriptions should along with the vigilance reporting systems of FDA, EC, and other regulatory bodies where you distribute product. This alignment will help your pot-market activities align with the design processes and make these processes more seamless. 

Based on feed back from the EC, I would avoid setting acceptable regions, as Notified Bodies don't like the use of "Acceptable Risk".  The risks must each individually be reduced As Far As Possible without impacting the Benefit to Risk ratio. Notified Bodies think if you have established an Acceptable region, you can stop reducing risk when you reach that region, which does not meet the regulatory requirements. Also in that scheme each risk must be treated individually as to when to stop risk reduction, there is no universal "acceptable" line to cross.

Be sure you have a copy of ISO TR 24971:2020, as most of what has been discussed in this chain is covered in that 85 page guidance document which is a good aid in understanding ISO 14971:2019 and the topics are aligned  so if you want more on Clause 5 on Risk Analysis in 14971, then go to Clause 5 in 24971.  The Annexes A to the end are cross-cutting topics that cover multiple numbered clauses in the standard.

Wish you the best on this journey, I am starting to understand medical device risk management after 22 years on the standards committee.  I am by no means an expert, but I do have contact information for those that know certain aspects of medical device risk management!  

Remember that the risk of a harm has two components: severity and probability. They are closely related since you need the probability that the harm occurs with the stated severity. A burn provides a good example. The harm could be a burn which has three levels of severity. The probability of a first-degree burn will not be the probability of a second-degree burn, etc.

A common approach is a five-point scale. You need good definitions for the scale so it is easy for the team to agree. Often a medical person can help.

For severity, it is best to start with a five-point scale using definitions and not numbers. Typically, you need a lot of post-market data to use a numerical scale.

The Risk Management Plan will have the severity and probability scales. It will also have a risk matrix that explains how to combine severity and probability to get a risk level. You will need this as part of risk evaluation to determine if the risk is acceptable or requires risk reduction.

If you need risk reduction, start with the sequence of events. They lead to the hazardous situation, so you want to break the sequence. If there is no hazardous situation, there is no harm. Usually, this is hard. Your risk reduction measures should reduce the severity, the probability, or both. For the residual risk, use the same scales and the same risk matrix. You want to get into the best box possible in the risk matrix. You also want that box to be in the acceptable risk region.

First, ignore P1 and P2. They only illustrate a concept. They are not required.

Estimate the components of risk using the definition. First determine the harm that occurs if the hazardous situation were to happen. There could be many different harms associated with a hazardous situation. Determine the severity of each harm. Then determine the probability of that harm occurring with the determined severity. Put these values into the risk matrix in the Risk Management Plan to estimate the risk.

There are no calculations required. You could rely on historical data, published articles, registry data, the team's best guess, etc.

In some cases, you cannot estimate the probability such as a use error. In those cases, the risk estimate uses severity only. The Risk Management Plan needs to cover this case.

No, don't "hope it will all work out", it is risk management science. Follow the steps that have been developed over the last 25+years for medical devices and it WILL WORK. 

As we have referred to ISO TR 24971:2020 guidance throughout this discussion, make sure you have the document and USE IT. 

We all will be here if you have more questions. If you get a chance, there are some good courses in this area you might want to take, including the AAMI risk management course, for disclosure, I teach that course, and one taught by Peter Sebellius of Medical Device HQ. Peter is on LinkedIn also, as am I. I am the co-Moderator of the Medical Device Risk Management group there as well. 

Best Wishes in your journey and if you have questions, just ask!

The answer is you put them where they occur and do not overthink the organization of your documents. The standard has a process flow built in, that is identifying hazards, then determining the exposure of these hazards such that harm can occur (this is an important step to understanding not only how harm can occur, but also where you can place risk controls to break the hazard to harm pathway) and then what types of harm can occur to people, property and the environment as a result of THAT EXPOSURE, and don't try to connect Hazardous Situations where no realistic connections occur. 

I am a visual learner and like to draw pictures to help me understand the situation. If the picture does not show a connection then don't try to create one. Just document what you have found and stop. 

One of the aspects of risk management that is so often overlooked all over the process, is "why are we doing this?".  We want to make decisions to reduce risk, and time spent with all this clutter is time wasted from improving our products to improve safety. So don't overthink your documents and their organization where it does not lead to product improvement

Remember Severity of Harm includes people, property, and the environment. For people, the best choice is a qualitative scale of 4 or 5 levels based on the definitions of severity found in either the FDA Medical Device Reporting regulation 21 CFR 803 such as Critical-fatality or non reversible serious injury; Serious-medically reversible serious injury; Major-injury with minor medical intervention; Moderate-injury not requiring medical intervention; Minor-No injury, or other such description. These descriptions should along with the vigilance reporting systems of FDA, EC, and other regulatory bodies where you distribute product. This alignment will help your pot-market activities align with the design processes and make these processes more seamless. 

Based on feed back from the EC, I would avoid setting acceptable regions, as Notified Bodies don't like the use of "Acceptable Risk".  The risks must each individually be reduced As Far As Possible without impacting the Benefit to Risk ratio. Notified Bodies think if you have established an Acceptable region, you can stop reducing risk when you reach that region, which does not meet the regulatory requirements. Also in that scheme each risk must be treated individually as to when to stop risk reduction, there is no universal "acceptable" line to cross.

Be sure you have a copy of ISO TR 24971:2020, as most of what has been discussed in this chain is covered in that 85 page guidance document which is a good aid in understanding ISO 14971:2019 and the topics are aligned  so if you want more on Clause 5 on Risk Analysis in 14971, then go to Clause 5 in 24971.  The Annexes A to the end are cross-cutting topics that cover multiple numbered clauses in the standard.

Wish you the best on this journey, I am starting to understand medical device risk management after 22 years on the standards committee.  I am by no means an expert, but I do have contact information for those that know certain aspects of medical device risk management!  

Remember that the risk of a harm has two components: severity and probability. They are closely related since you need the probability that the harm occurs with the stated severity. A burn provides a good example. The harm could be a burn which has three levels of severity. The probability of a first-degree burn will not be the probability of a second-degree burn, etc.

A common approach is a five-point scale. You need good definitions for the scale so it is easy for the team to agree. Often a medical person can help.

For severity, it is best to start with a five-point scale using definitions and not numbers. Typically, you need a lot of post-market data to use a numerical scale.

The Risk Management Plan will have the severity and probability scales. It will also have a risk matrix that explains how to combine severity and probability to get a risk level. You will need this as part of risk evaluation to determine if the risk is acceptable or requires risk reduction.

If you need risk reduction, start with the sequence of events. They lead to the hazardous situation, so you want to break the sequence. If there is no hazardous situation, there is no harm. Usually, this is hard. Your risk reduction measures should reduce the severity, the probability, or both. For the residual risk, use the same scales and the same risk matrix. You want to get into the best box possible in the risk matrix. You also want that box to be in the acceptable risk region.

First, ignore P1 and P2. They only illustrate a concept. They are not required.

Estimate the components of risk using the definition. First determine the harm that occurs if the hazardous situation were to happen. There could be many different harms associated with a hazardous situation. Determine the severity of each harm. Then determine the probability of that harm occurring with the determined severity. Put these values into the risk matrix in the Risk Management Plan to estimate the risk.

There are no calculations required. You could rely on historical data, published articles, registry data, the team's best guess, etc.

In some cases, you cannot estimate the probability such as a use error. In those cases, the risk estimate uses severity only. The Risk Management Plan needs to cover this case.

No, don't "hope it will all work out", it is risk management science. Follow the steps that have been developed over the last 25+years for medical devices and it WILL WORK. 

As we have referred to ISO TR 24971:2020 guidance throughout this discussion, make sure you have the document and USE IT. 

We all will be here if you have more questions. If you get a chance, there are some good courses in this area you might want to take, including the AAMI risk management course, for disclosure, I teach that course, and one taught by Peter Sebellius of Medical Device HQ. Peter is on LinkedIn also, as am I. I am the co-Moderator of the Medical Device Risk Management group there as well. 

Best Wishes in your journey and if you have questions, just ask!

The answer is you put them where they occur and do not overthink the organization of your documents. The standard has a process flow built in, that is identifying hazards, then determining the exposure of these hazards such that harm can occur (this is an important step to understanding not only how harm can occur, but also where you can place risk controls to break the hazard to harm pathway) and then what types of harm can occur to people, property and the environment as a result of THAT EXPOSURE, and don't try to connect Hazardous Situations where no realistic connections occur. 

I am a visual learner and like to draw pictures to help me understand the situation. If the picture does not show a connection then don't try to create one. Just document what you have found and stop. 

One of the aspects of risk management that is so often overlooked all over the process, is "why are we doing this?".  We want to make decisions to reduce risk, and time spent with all this clutter is time wasted from improving our products to improve safety. So don't overthink your documents and their organization where it does not lead to product improvement

Remember Severity of Harm includes people, property, and the environment. For people, the best choice is a qualitative scale of 4 or 5 levels based on the definitions of severity found in either the FDA Medical Device Reporting regulation 21 CFR 803 such as Critical-fatality or non reversible serious injury; Serious-medically reversible serious injury; Major-injury with minor medical intervention; Moderate-injury not requiring medical intervention; Minor-No injury, or other such description. These descriptions should along with the vigilance reporting systems of FDA, EC, and other regulatory bodies where you distribute product. This alignment will help your pot-market activities align with the design processes and make these processes more seamless. 

Based on feed back from the EC, I would avoid setting acceptable regions, as Notified Bodies don't like the use of "Acceptable Risk".  The risks must each individually be reduced As Far As Possible without impacting the Benefit to Risk ratio. Notified Bodies think if you have established an Acceptable region, you can stop reducing risk when you reach that region, which does not meet the regulatory requirements. Also in that scheme each risk must be treated individually as to when to stop risk reduction, there is no universal "acceptable" line to cross.

Be sure you have a copy of ISO TR 24971:2020, as most of what has been discussed in this chain is covered in that 85 page guidance document which is a good aid in understanding ISO 14971:2019 and the topics are aligned  so if you want more on Clause 5 on Risk Analysis in 14971, then go to Clause 5 in 24971.  The Annexes A to the end are cross-cutting topics that cover multiple numbered clauses in the standard.

Wish you the best on this journey, I am starting to understand medical device risk management after 22 years on the standards committee.  I am by no means an expert, but I do have contact information for those that know certain aspects of medical device risk management!  

Remember that the risk of a harm has two components: severity and probability. They are closely related since you need the probability that the harm occurs with the stated severity. A burn provides a good example. The harm could be a burn which has three levels of severity. The probability of a first-degree burn will not be the probability of a second-degree burn, etc.

A common approach is a five-point scale. You need good definitions for the scale so it is easy for the team to agree. Often a medical person can help.

For severity, it is best to start with a five-point scale using definitions and not numbers. Typically, you need a lot of post-market data to use a numerical scale.

The Risk Management Plan will have the severity and probability scales. It will also have a risk matrix that explains how to combine severity and probability to get a risk level. You will need this as part of risk evaluation to determine if the risk is acceptable or requires risk reduction.

If you need risk reduction, start with the sequence of events. They lead to the hazardous situation, so you want to break the sequence. If there is no hazardous situation, there is no harm. Usually, this is hard. Your risk reduction measures should reduce the severity, the probability, or both. For the residual risk, use the same scales and the same risk matrix. You want to get into the best box possible in the risk matrix. You also want that box to be in the acceptable risk region.

First, ignore P1 and P2. They only illustrate a concept. They are not required.

Estimate the components of risk using the definition. First determine the harm that occurs if the hazardous situation were to happen. There could be many different harms associated with a hazardous situation. Determine the severity of each harm. Then determine the probability of that harm occurring with the determined severity. Put these values into the risk matrix in the Risk Management Plan to estimate the risk.

There are no calculations required. You could rely on historical data, published articles, registry data, the team's best guess, etc.

In some cases, you cannot estimate the probability such as a use error. In those cases, the risk estimate uses severity only. The Risk Management Plan needs to cover this case.

No, don't "hope it will all work out", it is risk management science. Follow the steps that have been developed over the last 25+years for medical devices and it WILL WORK. 

As we have referred to ISO TR 24971:2020 guidance throughout this discussion, make sure you have the document and USE IT. 

We all will be here if you have more questions. If you get a chance, there are some good courses in this area you might want to take, including the AAMI risk management course, for disclosure, I teach that course, and one taught by Peter Sebellius of Medical Device HQ. Peter is on LinkedIn also, as am I. I am the co-Moderator of the Medical Device Risk Management group there as well. 

Best Wishes in your journey and if you have questions, just ask!

The answer is you put them where they occur and do not overthink the organization of your documents. The standard has a process flow built in, that is identifying hazards, then determining the exposure of these hazards such that harm can occur (this is an important step to understanding not only how harm can occur, but also where you can place risk controls to break the hazard to harm pathway) and then what types of harm can occur to people, property and the environment as a result of THAT EXPOSURE, and don't try to connect Hazardous Situations where no realistic connections occur. 

I am a visual learner and like to draw pictures to help me understand the situation. If the picture does not show a connection then don't try to create one. Just document what you have found and stop. 

One of the aspects of risk management that is so often overlooked all over the process, is "why are we doing this?".  We want to make decisions to reduce risk, and time spent with all this clutter is time wasted from improving our products to improve safety. So don't overthink your documents and their organization where it does not lead to product improvement

Remember Severity of Harm includes people, property, and the environment. For people, the best choice is a qualitative scale of 4 or 5 levels based on the definitions of severity found in either the FDA Medical Device Reporting regulation 21 CFR 803 such as Critical-fatality or non reversible serious injury; Serious-medically reversible serious injury; Major-injury with minor medical intervention; Moderate-injury not requiring medical intervention; Minor-No injury, or other such description. These descriptions should along with the vigilance reporting systems of FDA, EC, and other regulatory bodies where you distribute product. This alignment will help your pot-market activities align with the design processes and make these processes more seamless. 

Based on feed back from the EC, I would avoid setting acceptable regions, as Notified Bodies don't like the use of "Acceptable Risk".  The risks must each individually be reduced As Far As Possible without impacting the Benefit to Risk ratio. Notified Bodies think if you have established an Acceptable region, you can stop reducing risk when you reach that region, which does not meet the regulatory requirements. Also in that scheme each risk must be treated individually as to when to stop risk reduction, there is no universal "acceptable" line to cross.

Be sure you have a copy of ISO TR 24971:2020, as most of what has been discussed in this chain is covered in that 85 page guidance document which is a good aid in understanding ISO 14971:2019 and the topics are aligned  so if you want more on Clause 5 on Risk Analysis in 14971, then go to Clause 5 in 24971.  The Annexes A to the end are cross-cutting topics that cover multiple numbered clauses in the standard.

Wish you the best on this journey, I am starting to understand medical device risk management after 22 years on the standards committee.  I am by no means an expert, but I do have contact information for those that know certain aspects of medical device risk management!  

Remember that the risk of a harm has two components: severity and probability. They are closely related since you need the probability that the harm occurs with the stated severity. A burn provides a good example. The harm could be a burn which has three levels of severity. The probability of a first-degree burn will not be the probability of a second-degree burn, etc.

A common approach is a five-point scale. You need good definitions for the scale so it is easy for the team to agree. Often a medical person can help.

For severity, it is best to start with a five-point scale using definitions and not numbers. Typically, you need a lot of post-market data to use a numerical scale.

The Risk Management Plan will have the severity and probability scales. It will also have a risk matrix that explains how to combine severity and probability to get a risk level. You will need this as part of risk evaluation to determine if the risk is acceptable or requires risk reduction.

If you need risk reduction, start with the sequence of events. They lead to the hazardous situation, so you want to break the sequence. If there is no hazardous situation, there is no harm. Usually, this is hard. Your risk reduction measures should reduce the severity, the probability, or both. For the residual risk, use the same scales and the same risk matrix. You want to get into the best box possible in the risk matrix. You also want that box to be in the acceptable risk region.

First, ignore P1 and P2. They only illustrate a concept. They are not required.

Estimate the components of risk using the definition. First determine the harm that occurs if the hazardous situation were to happen. There could be many different harms associated with a hazardous situation. Determine the severity of each harm. Then determine the probability of that harm occurring with the determined severity. Put these values into the risk matrix in the Risk Management Plan to estimate the risk.

There are no calculations required. You could rely on historical data, published articles, registry data, the team's best guess, etc.

In some cases, you cannot estimate the probability such as a use error. In those cases, the risk estimate uses severity only. The Risk Management Plan needs to cover this case.

No, don't "hope it will all work out", it is risk management science. Follow the steps that have been developed over the last 25+years for medical devices and it WILL WORK. 

As we have referred to ISO TR 24971:2020 guidance throughout this discussion, make sure you have the document and USE IT. 

We all will be here if you have more questions. If you get a chance, there are some good courses in this area you might want to take, including the AAMI risk management course, for disclosure, I teach that course, and one taught by Peter Sebellius of Medical Device HQ. Peter is on LinkedIn also, as am I. I am the co-Moderator of the Medical Device Risk Management group there as well. 

Best Wishes in your journey and if you have questions, just ask!

The answer is you put them where they occur and do not overthink the organization of your documents. The standard has a process flow built in, that is identifying hazards, then determining the exposure of these hazards such that harm can occur (this is an important step to understanding not only how harm can occur, but also where you can place risk controls to break the hazard to harm pathway) and then what types of harm can occur to people, property and the environment as a result of THAT EXPOSURE, and don't try to connect Hazardous Situations where no realistic connections occur. 

I am a visual learner and like to draw pictures to help me understand the situation. If the picture does not show a connection then don't try to create one. Just document what you have found and stop. 

One of the aspects of risk management that is so often overlooked all over the process, is "why are we doing this?".  We want to make decisions to reduce risk, and time spent with all this clutter is time wasted from improving our products to improve safety. So don't overthink your documents and their organization where it does not lead to product improvement

Remember Severity of Harm includes people, property, and the environment. For people, the best choice is a qualitative scale of 4 or 5 levels based on the definitions of severity found in either the FDA Medical Device Reporting regulation 21 CFR 803 such as Critical-fatality or non reversible serious injury; Serious-medically reversible serious injury; Major-injury with minor medical intervention; Moderate-injury not requiring medical intervention; Minor-No injury, or other such description. These descriptions should along with the vigilance reporting systems of FDA, EC, and other regulatory bodies where you distribute product. This alignment will help your pot-market activities align with the design processes and make these processes more seamless. 

Based on feed back from the EC, I would avoid setting acceptable regions, as Notified Bodies don't like the use of "Acceptable Risk".  The risks must each individually be reduced As Far As Possible without impacting the Benefit to Risk ratio. Notified Bodies think if you have established an Acceptable region, you can stop reducing risk when you reach that region, which does not meet the regulatory requirements. Also in that scheme each risk must be treated individually as to when to stop risk reduction, there is no universal "acceptable" line to cross.

Be sure you have a copy of ISO TR 24971:2020, as most of what has been discussed in this chain is covered in that 85 page guidance document which is a good aid in understanding ISO 14971:2019 and the topics are aligned  so if you want more on Clause 5 on Risk Analysis in 14971, then go to Clause 5 in 24971.  The Annexes A to the end are cross-cutting topics that cover multiple numbered clauses in the standard.

Wish you the best on this journey, I am starting to understand medical device risk management after 22 years on the standards committee.  I am by no means an expert, but I do have contact information for those that know certain aspects of medical device risk management!  

Remember that the risk of a harm has two components: severity and probability. They are closely related since you need the probability that the harm occurs with the stated severity. A burn provides a good example. The harm could be a burn which has three levels of severity. The probability of a first-degree burn will not be the probability of a second-degree burn, etc.

A common approach is a five-point scale. You need good definitions for the scale so it is easy for the team to agree. Often a medical person can help.

For severity, it is best to start with a five-point scale using definitions and not numbers. Typically, you need a lot of post-market data to use a numerical scale.

The Risk Management Plan will have the severity and probability scales. It will also have a risk matrix that explains how to combine severity and probability to get a risk level. You will need this as part of risk evaluation to determine if the risk is acceptable or requires risk reduction.

If you need risk reduction, start with the sequence of events. They lead to the hazardous situation, so you want to break the sequence. If there is no hazardous situation, there is no harm. Usually, this is hard. Your risk reduction measures should reduce the severity, the probability, or both. For the residual risk, use the same scales and the same risk matrix. You want to get into the best box possible in the risk matrix. You also want that box to be in the acceptable risk region.

First, ignore P1 and P2. They only illustrate a concept. They are not required.

Estimate the components of risk using the definition. First determine the harm that occurs if the hazardous situation were to happen. There could be many different harms associated with a hazardous situation. Determine the severity of each harm. Then determine the probability of that harm occurring with the determined severity. Put these values into the risk matrix in the Risk Management Plan to estimate the risk.

There are no calculations required. You could rely on historical data, published articles, registry data, the team's best guess, etc.

In some cases, you cannot estimate the probability such as a use error. In those cases, the risk estimate uses severity only. The Risk Management Plan needs to cover this case.

No, don't "hope it will all work out", it is risk management science. Follow the steps that have been developed over the last 25+years for medical devices and it WILL WORK. 

As we have referred to ISO TR 24971:2020 guidance throughout this discussion, make sure you have the document and USE IT. 

We all will be here if you have more questions. If you get a chance, there are some good courses in this area you might want to take, including the AAMI risk management course, for disclosure, I teach that course, and one taught by Peter Sebellius of Medical Device HQ. Peter is on LinkedIn also, as am I. I am the co-Moderator of the Medical Device Risk Management group there as well. 

Best Wishes in your journey and if you have questions, just ask!

The answer is you put them where they occur and do not overthink the organization of your documents. The standard has a process flow built in, that is identifying hazards, then determining the exposure of these hazards such that harm can occur (this is an important step to understanding not only how harm can occur, but also where you can place risk controls to break the hazard to harm pathway) and then what types of harm can occur to people, property and the environment as a result of THAT EXPOSURE, and don't try to connect Hazardous Situations where no realistic connections occur. 

I am a visual learner and like to draw pictures to help me understand the situation. If the picture does not show a connection then don't try to create one. Just document what you have found and stop. 

One of the aspects of risk management that is so often overlooked all over the process, is "why are we doing this?".  We want to make decisions to reduce risk, and time spent with all this clutter is time wasted from improving our products to improve safety. So don't overthink your documents and their organization where it does not lead to product improvement

Remember Severity of Harm includes people, property, and the environment. For people, the best choice is a qualitative scale of 4 or 5 levels based on the definitions of severity found in either the FDA Medical Device Reporting regulation 21 CFR 803 such as Critical-fatality or non reversible serious injury; Serious-medically reversible serious injury; Major-injury with minor medical intervention; Moderate-injury not requiring medical intervention; Minor-No injury, or other such description. These descriptions should along with the vigilance reporting systems of FDA, EC, and other regulatory bodies where you distribute product. This alignment will help your pot-market activities align with the design processes and make these processes more seamless. 

Based on feed back from the EC, I would avoid setting acceptable regions, as Notified Bodies don't like the use of "Acceptable Risk".  The risks must each individually be reduced As Far As Possible without impacting the Benefit to Risk ratio. Notified Bodies think if you have established an Acceptable region, you can stop reducing risk when you reach that region, which does not meet the regulatory requirements. Also in that scheme each risk must be treated individually as to when to stop risk reduction, there is no universal "acceptable" line to cross.

Be sure you have a copy of ISO TR 24971:2020, as most of what has been discussed in this chain is covered in that 85 page guidance document which is a good aid in understanding ISO 14971:2019 and the topics are aligned  so if you want more on Clause 5 on Risk Analysis in 14971, then go to Clause 5 in 24971.  The Annexes A to the end are cross-cutting topics that cover multiple numbered clauses in the standard.

Wish you the best on this journey, I am starting to understand medical device risk management after 22 years on the standards committee.  I am by no means an expert, but I do have contact information for those that know certain aspects of medical device risk management!  

Remember that the risk of a harm has two components: severity and probability. They are closely related since you need the probability that the harm occurs with the stated severity. A burn provides a good example. The harm could be a burn which has three levels of severity. The probability of a first-degree burn will not be the probability of a second-degree burn, etc.

A common approach is a five-point scale. You need good definitions for the scale so it is easy for the team to agree. Often a medical person can help.

For severity, it is best to start with a five-point scale using definitions and not numbers. Typically, you need a lot of post-market data to use a numerical scale.

The Risk Management Plan will have the severity and probability scales. It will also have a risk matrix that explains how to combine severity and probability to get a risk level. You will need this as part of risk evaluation to determine if the risk is acceptable or requires risk reduction.

If you need risk reduction, start with the sequence of events. They lead to the hazardous situation, so you want to break the sequence. If there is no hazardous situation, there is no harm. Usually, this is hard. Your risk reduction measures should reduce the severity, the probability, or both. For the residual risk, use the same scales and the same risk matrix. You want to get into the best box possible in the risk matrix. You also want that box to be in the acceptable risk region.

First, ignore P1 and P2. They only illustrate a concept. They are not required.

Estimate the components of risk using the definition. First determine the harm that occurs if the hazardous situation were to happen. There could be many different harms associated with a hazardous situation. Determine the severity of each harm. Then determine the probability of that harm occurring with the determined severity. Put these values into the risk matrix in the Risk Management Plan to estimate the risk.

There are no calculations required. You could rely on historical data, published articles, registry data, the team's best guess, etc.

In some cases, you cannot estimate the probability such as a use error. In those cases, the risk estimate uses severity only. The Risk Management Plan needs to cover this case.