Residual risk is the risk remaining after all feasible risk control measures have been applied to a medical device. Defined in ISO 14971, it represents harm potential that persists once mitigations are in place. A device can proceed to market only if each residual risk is acceptable or if the device’s medical benefits outweigh the remaining risk.
What is residual risk in medical devices?
Residual risk is not the opening estimate in a hazard analysis. It is what remains after your team has done everything technically feasible to reduce harm. ISO 14971, the principal international standard for medical device risk management, defines residual risk as the risk remaining after protective measures have been implemented.
No device achieves zero residual risk. The objective is to reduce each identified risk to an acceptable level and then evaluate whether the total burden of residuals is justified by the device’s intended medical purpose. The manufacturer defines the acceptability threshold in its risk management plan before hazard analysis begins.
Residual risk is assessed at two levels. Individual hazardous situations are evaluated after controls. The overall residual risk, covering all hazardous situations together, is assessed separately to ensure the device’s aggregate risk profile is acceptable.
Why residual risk matters in medical device development
Residual risk is the final gate in the risk management process. If overall residual risk is unacceptable, the device cannot be released to market, regardless of how advanced development is.
Regulatory scrutiny is substantial. Under EU MDR 2017/745, Annex I requires manufacturers to document residual risks and disclose them to users through the Instructions for Use (IFU). FDA expects complete residual risk documentation in the Design History File (DHF) under 21 CFR Part 820. Notified Bodies and FDA reviewers flag incomplete or unconvincing residual risk evaluations regularly. They are a common driver of audit nonconformances and regulatory rejections.
The business case is also clear. Finding unacceptable residual risk late in development forces redesign or additional risk controls. Both cost time and money that earlier integration of risk management would have avoided.
How residual risk is evaluated under ISO 14971
The evaluation follows from the broader risk control sequence in ISO 14971. Risk controls are applied in priority order: first, eliminate or reduce the hazard through design; second, add protective measures; third, provide information for safety through warnings, labeling, and the IFU. After each control is implemented, the risk is re-estimated. That post-control estimate is the residual risk for that hazardous situation.
Two distinct evaluations are required:
Individual residual risk
Each hazardous situation is assessed against the acceptability criteria in the risk management plan.
Overall residual risk
The cumulative effect of all individual residuals is evaluated. A device where every individual risk is acceptable can still have an unacceptable overall profile.
When residual risks cannot be reduced further, the manufacturer must perform a risk-benefit analysis. This involves demonstrating that the clinical benefits of the device’s intended use outweigh the remaining harm potential. Clinical evidence, published literature, and post-market performance data all support this analysis. ISO 14971:2019 requires a documented conclusion that overall residual risk is acceptable before a device is released.
Common challenges and best practices
Vague acceptability criteria
Risk criteria must be defined before hazard analysis, not after. Criteria set retroactively to justify existing risk estimates are a red flag in audits.
Missing re-estimation after controls
Every control must be assessed for its actual effect. Teams that document controls without updating probability or severity estimates are skipping a core ISO 14971 requirement.
No overall evaluation
Individual residual risk assessments do not replace the overall residual risk evaluation. Both are required. Omitting the overall step is among the most common risk management nonconformances.
Generic IFU disclosures
EU MDR requires disclosure of specific residual risks, not boilerplate warnings. Vague IFU language that does not reference identified hazardous situations fails this requirement.
Best practice is to run risk management as a live engineering activity from early design. Residual risk decisions should shape design choices, not be documented after the fact.
How SJML helps with residual risk
SJML integrates ISO 14971 risk management from concept through design transfer, covering hazard identification, FMEA, risk control implementation, and residual risk estimation for both individual risks and overall risk. The QARA team produces DHF-ready risk files aligned to FDA 21 CFR Part 820, EU MDR, and MDSAP requirements. For Class II and III devices, risk management is coordinated with IEC 62366 usability engineering and IEC 62304 / IEC 81001-5-1 software risk requirements. SJML also supports legacy risk file remediation to bring older files in line with ISO 14971:2019.
Frequently asked questions
Inherent risk is the estimated risk before any controls are applied. Residual risk is what remains after all feasible controls have been implemented. ISO 14971 requires manufacturers to document both and confirm that residual risk has been reduced as far as reasonably practicable before evaluating acceptability.
Acceptability is defined by criteria set in the risk management plan before hazard analysis starts. If individual residual risks satisfy those criteria and overall residual risk is acceptable given the device’s medical benefits, the device may proceed. If not, further controls or a documented risk-benefit analysis are required.
Overall residual risk is the cumulative harm potential remaining after all controls have been applied across all hazardous situations. ISO 14971 requires this separate evaluation because a device where each individual residual risk is acceptable can still present an unacceptable aggregate risk profile when all risks are considered together.
The manufacturer must apply additional controls to reduce risk further or, where further reduction is not feasible, perform a risk-benefit analysis demonstrating that the medical benefits of the intended use outweigh the remaining harm. If neither condition is met, the device should not be released.
Related terms
- ISO 14971
- Risk-Benefit Analysis
- Risk Control
- FMEA
- Design History File (DHF)
