Risk · ICH Q9(R1) · ISO 14971 · FMEA
Risk files that stay connected to production controls.
Link each risk control to the records it depends on, so changes and deviations are visible when the risk file is reviewed.
Live Risk Register with Linked Controls
Every risk row links to the SOP version, the training curriculum, the IPC step, the alarm, the CAPA — pull the SOP, the risk file re-scores.
ICH Q9(R1) methodology support
FMEA, FMECA, HACCP, HAZOP, PHA, fault tree — pick the tool per hazard, keep them all in one register.
ISO 14971 Device Risk File
Full lifecycle: hazard analysis, risk estimation, risk control, benefit-risk, production and post-production risk — with the risk management report…
What goes wrong today3 common problems
Risk file is a PDF from 2022
It was approved, filed, forgotten. Two SOP revisions and one line move later, the residual-risk claim is fiction.
Controls Listed but Not Linked
The risk file says 'operator training + in-process check' — but nobody knows which SOP, which training curriculum, which IPC record actually delivers that control.
New Deviations Don't Trigger Risk Review
Same failure mode recurs six times. The risk file still says severity 2, occurrence 1. The auditor asks why.
Everything V5 does here5 capabilities
Live Risk Register with Linked Controls
Every risk row links to the SOP version, the training curriculum, the IPC step, the alarm, the CAPA — pull the SOP, the risk file re-scores.
ICH Q9(R1) methodology support
FMEA, FMECA, HACCP, HAZOP, PHA, fault tree — pick the tool per hazard, keep them all in one register.
ISO 14971 Device Risk File
Full lifecycle: hazard analysis, risk estimation, risk control, benefit-risk, production and post-production risk — with the risk management report auto-assembled.
Deviation and Complaint Feed Risk Re-Scoring
Every deviation and complaint tagged to a risk row; recurrence auto-flags occurrence rating for re-assessment.
Risk-based decision routing
Change control, deviation classification and CAPA effectiveness gates all consume the live risk score — high-risk changes escalate automatically.
How it works, step by step5 steps
Risk lifecycle.
- Hazards / Failure Modes. Structured method — FMEA, HAZOP, FTA, dFMEA.
- Score with Rationale. Severity / occurrence / detection with signed rationale.
- Controls Linked to Ops. Controls tied to steps or design outputs.
- Effectiveness Monitored. Execution data feeds effectiveness signal.
- Periodic and Event-Driven. Complaints, deviations trigger re-evaluation.
What to look for when choosing
Risk software fails when the risk file is a static register and product risk doesn't feed process risk. Criteria below expose it.
Living Risk File
Do complaints, deviations and CAPAs feed the risk file? Complaints and deviations tag risk items; residual re-evaluated live.
Q9(R1) and 14971 support
Does the tool support both ICH Q9(R1) and ISO 14971? Both frameworks supported with method libraries (FMEA, HAZOP, FTA).
Control linkage
Are controls linked to the process step / design output they act on? Controls tied to step/output; effectiveness signal computed from execution data.
Formality Tiered
Is formality tiered per Q9(R1) so trivial risks aren't overworked? Formality tiers configurable; workflow scales appropriately.
Regulatory Submission-Ready
Do exports meet dossier expectations? Submission-ready exports per method.
V5 Compared with Other Approaches
Risk tooling.
| capability | spreadsheet | legacy Qms | v5 |
|---|---|---|---|
| Living risk file | Static | Occasional refresh | Live feed from ops |
| Q9(R1) + 14971 | Manual | One or the other | Both native |
| Control linkage | None | Partial | Native to step/output |
| Formality tiering | N/A | Static | Configurable |
Regulations this supportsYour quality team stays responsible for compliance
Risk clauses.
ICH Q9(R1)
Formality tiered; workflow scales.
ISO 14971:2019
Ongoing process is the connected risk file, not a document.
ICH Q10 §1.6
Risk file feeds and is fed by the QMS.
Standards Referenced
- ICH Q9(R1) (Quality Risk Management, 2023)
- ISO 14971:2019 (Medical devices — risk management)
- ISO 22000 §7 (HACCP)
- IEC 60812 (FMEA)
- EU GMP Chapter 1 §1.12 (QRM)
Common questions3 answers
- Which risk methodologies does V5 support?
- FMEA, FMECA, HACCP, HAZOP, PHA, fault-tree, bow-tie and simple risk ranking — all in one register with per-risk methodology capture per ICH Q9(R1).
- Does V5 handle ISO 14971 device risk files?
- Yes — hazard/hazardous-situation/harm chain, P1/P2 probability, risk estimation matrix, benefit-risk, production and post-production risk, and the risk management report exported to submission format.
- How does the risk file stay current?
- Every risk row links to live SOPs, IPCs, alarms and CAPAs. Any change to a linked control triggers a re-score task; every deviation tagged to a risk feeds occurrence rating.