Risk Management
What to master
Risk items test whether you can identify, rate, and treat risk systematically. Start with the definition: risk is the combination of the likelihood of an event and its consequences - any framework, whether ISO 31000 or an internal matrix, reduces to that product. The generic cycle: establish context, identify, analyze, evaluate against criteria, treat, then monitor and communicate.
Treatment options are avoid, reduce (mitigate), transfer (insurance, contract), and accept - plus share for partnerships. For medical devices, ISO 14971 defines the vocabulary chain (hazard → hazardous situation → harm) and requires a control hierarchy: inherently safe design first, then protective measures, then information for safety.
Tools: FMEA (DFMEA/PFMEA) is bottom-up and inductive, scoring severity, occurrence, and detection to produce RPN = S × O × D. Fault tree analysis is top-down and deductive, using AND/OR gates and minimal cut sets. HAZOP uses guide words on a process line. A risk matrix maps likelihood against severity for prioritization.
The traps: RPN thresholds are arbitrary, so a high severity should trigger action regardless of how low the RPN is; detection controls do not reduce severity (adding inspection lowers the D ranking only); and severity scales are typically anchored at 1 and 10, so FMEA teams often rank severity first, then occurrence.
Worked example. A PFMEA line has S = 8, O = 4, D = 3, giving RPN 96. Adding a mistake-proofing fixture lowers detection to D = 2, so RPN = 64. If severity had been 9, the team would act regardless of the RPN - safety and regulatory harm outrank arithmetic.