Operator’s Guides

The Operator’s Guide to ISO 14971

Twelve modules. One worked device. A complete ISO 14971:2019 risk management file, built from scratch in front of you. Twelve videos, 6.5 hours of teaching, and a written article for every module. Free, no login, no gate.

Papercraft diorama of the WearPump insulin pump surrounded by a risk matrix, shield, checklists, and calipers

ISO 14971:2019 is the risk management standard every medical device company answers to. Most training either reads the clauses at you or hides the useful part behind a consulting engagement. This course does neither. Each module works the standard on one running device, WearPump, a wearable insulin pump, so every concept lands on something real: its hazards, its risk matrix, its control decisions, its file.

I teach it because I have had to live it. I spent eight years taking a surgical robotics platform from prototype through FDA De Novo authorization, and the risk file was load-bearing the whole way. Watch the modules in order, or jump to the clause you are fighting with today. The full playlist is on YouTube; every module page here pairs the video with a written version.

01 What Is ISO 14971? Why Medical Device Risk Management Exists One standard. One device. Twelve modules. This is the foundation every medical device risk management program starts from. 28:12 02 Hazard, Hazardous Situation, and Harm: ISO 14971 Clause 3 Definitions General safety training teaches a two-step model. ISO 14971 uses three terms, and the one in the middle decides whether your risk file survives its first audit. 45:00 03 ISO 14971 Clause 4: The Risk Management Plan and System Most risk management starts at the hazard table. The standard says it starts well before that, with a plan, a governance structure, and an acceptability line you draw before you have measured anything. 42:03 04 Intended Use and Device Characteristics: ISO 14971 Risk Analysis Part 1 Before you can identify a single hazard, you have to answer three questions precisely. Almost every course on medical device risk skips straight past them to the analysis technique. 32:45 05 Hazard Identification with FMEA and FTA: ISO 14971 Risk Analysis Part 2 Fault tree analysis finds a category of hazard that failure modes and effects analysis is structurally built to miss. Here's how to run both on the same device, and where they converge. 35:08 06 Risk Estimation with Severity and Probability: ISO 14971 Risk Analysis Part 3 RPN and ISO 14971 risk look like the same number. They are not. Here's why the difference matters, and how to score every hazard on a device honestly. 31:47 07 Risk Evaluation and the Acceptability Line: ISO 14971 Clause 6 Risk evaluation is where a color on the matrix becomes a verdict. Here's how to draw the acceptability line, demonstrate ALARP, and be honest about the gray zone most companies fudge. 32:07 08 The Risk Control Hierarchy: ISO 14971 Clause 7 ISO 14971 gives a device its own three-tier risk-control hierarchy, in a mandatory order. Here's how to work it on a real device, why you usually can't lead with a warning label, and the two steps almost every risk file skips. 32:55 09 Residual Risk and Benefit-Risk Analysis in ISO 14971 ISO 14971 rarely lets you drive a risk to zero. Here's how you re-score what's left, build a benefit-risk case an auditor will accept, and tell the limit of your engineering apart from a risk actually worth shipping. 28:31 10 Overall Residual Risk Evaluation: ISO 14971 Clause 8 Clause 8 is the step most risk files skip: judging the whole device, not each risk. Here's how residuals cluster on one harm, why you weigh the device against the therapy it replaces, and the four-part statement a reviewer can actually check. 25:16 11 The Risk Management Report: ISO 14971 Clause 9 The file is the work; the report is the signed judgment about it, and a regulator wants the judgment. Here's what Clause 9 requires, the seven elements of the report, the one acceptance sentence that decides your submission, and who has to sign it. 30:27 12 Post-Market Surveillance: ISO 14971 Clause 10 Your device launches, and the real data starts arriving. Here's what post-market surveillance actually requires, the five sources worth watching, the trigger that turns watching into acting, and how twelve complaints in one month become a dated change in the risk file. 29:01

Get the next guide

ISO 14971 is the first Operator’s Guide. ISO 13485, IEC 60601, and the GHG Protocol are in the queue. Leave your email and each new guide lands in your inbox the day it ships. Nothing else, no drip sequence.

Done. You’ll get the next guide when it ships.

The standard is free. So is this course. Building the product is the work.

Work With Dave

Prefer a smaller first step? Book a $500 one-hour working session →

Dave Saunders

Dave Saunders is the founder of Base Reality Group and a Fractional CPO for hard-tech founders. He was a founder and operator at Galen Robotics, where the surgical-robotics platform earned FDA De Novo authorization in 2023, and he managed a 35-patent portfolio licensed from Johns Hopkins. He wrote Founders Who Finish and publishes The Build. More about Dave →