ISO 14971 · ICH Q9(R1) · FMEA
Risk
Management
Leaders in Risk Systems That
Inform Decisions, Not Decorate Them
Leaders in Risk Systems That
Inform Decisions, Not Decorate Them
Risk-based is no longer a philosophy; it is the operating instruction of every major framework — ISO 14971 for devices, ICH Q9(R1) for pharmaceuticals, and the risk-based expectations threaded through inspections, validation, and change control. Done honestly, risk management is how a company decides where its attention goes. Done as theater, it is a folder of matrices that were filled in after the decisions were made. We build the honest kind: risk systems that actually steer resources, survive audits, and keep learning after approval.
A risk assessment written after the decision is documentation. Written before, it is management.
Every risk program eventually draws this grid. The grid is not the discipline — the discipline is what feeds it and what follows from it.
The estimates have provenance. Severity comes from clinical judgment; probability comes from data — complaints, literature, reliability — not from whoever was in the room.
The thresholds mean something. The line between acceptable and not was set in advance, in the plan, and someone accountable signed it.
The red cells change behavior. High risk triggers design change, controls, and verification — not a wider matrix with friendlier colors.
Probability is a number with a source, or it is a guess with a cell reference.
The frameworks differ in vocabulary and paperwork, but they demand the same underlying competence: structured, honest reasoning about what can go wrong, decided at the right level of formality.
The risk management file lives and dies with the device: hazard analysis feeding design, controls verified like requirements, and post-production data flowing back in for the life of the product.
Quality risk management runs through the pharmaceutical lifecycle: contamination control strategies, validation depth, supplier oversight, and change decisions all sized by risk.
ICH Q9, FMEA, and HACCP applied as living tools, revisited when knowledge changes, not filed once and forgotten.
Auditors have learned to spot performed risk management, and the tells are consistent. Each of these patterns converts a management tool into a liability with formatting.
Three guessed numbers multiplied into false precision, ranked to two decimal places, driving nothing.
The decision was Tuesday; the risk assessment is dated Thursday. Everyone can tell, including the inspector.
Last product’s worksheet with the names changed — importing conclusions while skipping the thinking.
Scores clustered safely mid-matrix, where nothing demands action and nothing looks ignored.
Probability by committee mood: no data, no rationale, no record of the disagreement in the room.
A risk assessment perfect on the day it was signed, untouched through five complaints and two design changes since.
The file said the failure mode was remote. The service records had been disagreeing for a year.
Tool selection is itself a risk decision — Q9(R1)’s proportionality principle in action. We match the instrument to the question instead of running the heaviest one everywhere.
Use whenThe design is young and the goal is breadth: every hazard on the table before architecture hardens around the missed ones.
Use whenA design or process is defined enough to walk element by element — the workhorse, at its best when the team includes the people who run the process.
Use whenOne top event matters most: working backward from the harm to the combinations of failures that could produce it.
Use whenProcess deviations are the concern — guide-worded walkthroughs of what happens when parameters drift high, low, or absent.
Use whenControl points can be monitored in-line: contamination-style risks with measurable critical limits and defined corrective actions.
Hazard analysis with measurable critical limits and defined corrective actions, matched to the decision in front of you.
Risk judgment cannot be templated. Your leads have chaired risk boards, owned 14971 files for implantables, built Q9 programs for sterile operations, and defended their calls to regulators when the field data arrived.
Severity set with medical input, not engineering optimism — the difference auditors probe first.
Probability estimates built from complaints, reliability, and literature, with the sources cited in the file.
We scale the formality to the decision — and we write down why, which is what Q9(R1) actually asks.
We run the room so the disagreement surfaces and gets resolved on the record, where it belongs.
Risk management is the reasoning layer under the rest of the quality system. These are the services most often engaged with it.
The device QMS and its risk thread, built as one interlocking system.
Explore the Standards →The field data that keeps the risk file honest — collected, trended, and flowed back in.
Explore Surveillance →When a risk materializes, the corrective machinery that closes it and re-teaches the file.
Explore CAPA →Tell us about your product, your file, and the decision in front of you. We’ll match you with a senior risk lead, with a response within one business day. All inquiries are strictly confidential.
