Assess & treat a risk

An end-to-end walkthrough — create a risk on the ISO 14971 model, score it, mitigate and verify it, and re-evaluate and accept the residual.

This guide takes one hazard from identified to accepted. It uses the universal item actions from Working with items where they apply, and focuses on the risk-specific judgments. For the concepts behind each step, see Risk registers, Scoring risk, Mitigations, and ALARP & residual risk.

Create a risk

A risk is an item that captures a hazard and the harm it could cause, on the ISO 14971 model.

Before you start Open the Risks module in your project.

  1. Create a risk the usual way — + Add, or right-click in the tree and choose Add Item.
  2. Describe the chain that defines it: the hazard, the hazardous situation in which it's exposed, and the harm that could result.
  3. Complete the remaining fields your risk type requires, and save.

Result A risk record exists in the register, ready to assess.

Score the risk

Scoring places the risk on your matrix so its acceptability is determined consistently, not by opinion.

  1. Set the Severity of the harm and the Probability of it occurring, using the scales defined in your organization's Risk Configuration.
  2. The risk matrix combines them into a risk level and an acceptability band — typically Acceptable, ALARP, or Unacceptable.

Result An initial risk level, color-coded on the matrix. This is the risk before any controls. See Scoring risk for matrix configuration and FMEA.

Mitigate and verify

Mitigations are the controls that reduce a risk — and they’re tracked, not just noted. The risk moves through its workflow with the Mitigate and Verify transitions.

  1. On the risk, describe the control that reduces it.
  2. Link the control to the requirement, design element, or test that implements and verifies it, so it is traceable.
  3. When the control is in place, take the Mitigate transition. Once it has been verified, take the Verify transition.

Result The control is recorded against the risk, its status follows the transitions you took, and it is linked to the work that delivers it.

Re-evaluate & accept the residual

After a control is in place, the risk that remains — the residual — must be re-scored and judged.

Before you start The control should be in place and the risk mitigated and verified.

  1. Re-evaluate the risk: re-score Probability to reflect the control's effect. Severity carries over from the initial assessment — it is not re-scored.
  2. Review the residual risk level on the matrix.
  3. If it's acceptable — or reduced as far as reasonably practicable — take the Accept Risk transition and record the justification.

Result The risk carries both its initial and residual scores, the acceptance decision is recorded with its rationale, and the audit trail shows the full hazard-to-acceptance history.

Note If a linked requirement or design element later changes, the risk is flagged suspect according to your trace rule set — keeping your risk file honest as the system evolves.

Where to go next

To connect risk to the rest of the thread, see Linking risk.

Was this helpful?