Risk management software where the risk file matches the floor.
V5 runs FMEA, HACCP, HAZOP and ISO 14971 device risk files as a living register: every risk control links to the actual production control, deviation or CAPA it depends on — if the control changes, the risk file flags it before the next batch runs.
What breaks without this.
Risk file is a PDF from 2022
It was approved, filed, forgotten. Two SOP revisions and one line move later, the residual-risk claim is fiction.
Controls listed but not linked
The risk file says 'operator training + in-process check' — but nobody knows which SOP, which training curriculum, which IPC record actually delivers that control.
New deviations don't trigger risk review
Same failure mode recurs six times. The risk file still says severity 2, occurrence 1. The auditor asks why.
Records-by-execution. Compliance, by design.
Live risk register with linked controls
Every risk row links to the SOP version, the training curriculum, the IPC step, the alarm, the CAPA — pull the SOP, the risk file re-scores.
ICH Q9(R1) methodology support
FMEA, FMECA, HACCP, HAZOP, PHA, fault tree — pick the tool per hazard, keep them all in one register.
ISO 14971 device risk file
Full lifecycle: hazard analysis, risk estimation, risk control, benefit-risk, production and post-production risk — with the risk management report auto-assembled.
Deviation and complaint feed risk re-scoring
Every deviation and complaint tagged to a risk row; recurrence auto-flags occurrence rating for re-assessment.
Risk-based decision routing
Change control, deviation classification and CAPA effectiveness gates all consume the live risk score — high-risk changes escalate automatically.
What to look for when you're buying.
Risk software fails when the risk file is a static register and product risk doesn't feed process risk. Criteria below expose it.
Living risk file
What it tests: Do complaints, deviations and CAPAs feed the risk file?
Why it matters: Static risk files fail Q9(R1) and 14971 both.
V5: Complaints and deviations tag risk items; residual re-evaluated live.
Q9(R1) and 14971 support
What it tests: Does the tool support both ICH Q9(R1) and ISO 14971?
Why it matters: Cross-domain teams use both.
V5: Both frameworks supported with method libraries (FMEA, HAZOP, FTA).
Control linkage
What it tests: Are controls linked to the process step / design output they act on?
Why it matters: Otherwise 'control effectiveness' is theory.
V5: Controls tied to step/output; effectiveness signal computed from execution data.
Formality tiered
What it tests: Is formality tiered per Q9(R1) so trivial risks aren't overworked?
Why it matters: Q9(R1) explicitly requires it.
V5: Formality tiers configurable; workflow scales appropriately.
Regulatory submission-ready
What it tests: Do exports meet dossier expectations?
Why it matters: Dossier-ready outputs save weeks.
V5: Submission-ready exports per method.
Spreadsheet vs legacy QMS vs V5.
Risk tooling.
| Capability | Spreadsheet | Legacy QMS | V5 Ultimate |
|---|---|---|---|
| Living risk file | Static | Occasional refresh | Live feed from ops |
| Q9(R1) + 14971 | Manual | One or the other | Both native |
| Control linkage | None | Partial | Native to step/output |
| Formality tiering | N/A | Static | Configurable |
The clauses, verbatim — and how V5 answers each.
Risk clauses.
Formality in QRM should be commensurate with the level of risk...
V5: Formality tiered; workflow scales.
The manufacturer shall establish, implement, document and maintain an ongoing process...
V5: Ongoing process is the connected risk file, not a document.
Knowledge management and QRM are key enablers...
V5: Risk file feeds and is fed by the QMS.
Step by step on the floor.
Risk lifecycle.
- 1Identify
Hazards / failure modes
Structured method — FMEA, HAZOP, FTA, dFMEA.
- 2Evaluate
Score with rationale
Severity / occurrence / detection with signed rationale.
- 3Control
Controls linked to ops
Controls tied to steps or design outputs.
- 4Verify
Effectiveness monitored
Execution data feeds effectiveness signal.
- 5Review
Periodic and event-driven
Complaints, deviations trigger re-evaluation.
The math, with the assumptions visible.
Risk ROI is measured in avoided events and in reduced dossier prep time.
Dossier prep time
Submission-ready exports.
Repeat failure rate on controlled items
Live effectiveness signal.
Programs usually see fewer surprise events within two quarters.
What changed on the floor.
Setting
A pharma/device combined organisation with 6 sites.
Before
Two static risk registers per site; complaints didn't refresh residual.
After
One living risk file per platform; residual updates on complaint intake; submissions cut prep by 60%.
Proof points
- Risk controls linked to live SOPs, IPCs and CAPAs — not text
- Deviations and complaints feed occurrence ratings automatically
- ISO 14971 risk management report auto-assembled from the register
- ICH Q9(R1) 'formality of QRM' explicitly captured per risk
Built to satisfy
- ICH Q9(R1) (Quality Risk Management, 2023)
- ISO 14971:2019 (Medical devices — risk management)
- ISO 22000 §7 (HACCP)
- IEC 60812 (FMEA)
- EU GMP Chapter 1 §1.12 (QRM)
Related on V5
Frequently asked questions
Which risk methodologies does V5 support?+
FMEA, FMECA, HACCP, HAZOP, PHA, fault-tree, bow-tie and simple risk ranking — all in one register with per-risk methodology capture per ICH Q9(R1).
Does V5 handle ISO 14971 device risk files?+
Yes — hazard/hazardous-situation/harm chain, P1/P2 probability, risk estimation matrix, benefit-risk, production and post-production risk, and the risk management report exported to submission format.
How does the risk file stay current?+
Every risk row links to live SOPs, IPCs, alarms and CAPAs. Any change to a linked control triggers a re-score task; every deviation tagged to a risk feeds occurrence rating.
See V5 on your own line.
Free trial, no card. Live in 7 days with guided onboarding.