Risk management involves:

the process of minimizing risk to an organization by developing systems to identify and analyze potential hazards to prevent accidents, injuries, and other adverse occurrences, and by attempting to handle events and incidents which do occur in such a manner that their effect and cost are minimized. Effective risk management has its greatest benefits in application to insurance in order to avert or minimize financial liability. "MeSH 2009"

The International Organization for Standardization (ISO) identifies the following principles of risk management:

Risk management should:

• create value – resources expended to mitigate risk should be less than the consequence of inaction, or (as in value engineering), the gain should exceed the pain
• be an integral part of organizational processes
• be part of decision making process
• explicitly address uncertainty and assumptions
• be a systematic and structured process
• be based on the best available information
• be tailorable
• take human factors into account
• be transparent and inclusive
• be dynamic, iterative and responsive to change
• be capable of continual improvement and enhancement
• be continually or periodically re-assessed

For medical devices, risk management is a process for identifying, evaluating and mitigating risks associated with harm to people and damage to property or the environment. Risk management is an integral part of medical device design and development, production processes and evaluation of field experience, and is applicable to all types of medical devices. The evidence of its application is required by most regulatory bodies such as FDA. The management of risks for medical devices is described by the International Organization for Standardization (ISO) in ISO 14971:2007, Medical Devices—The application of risk management to medical devices, a product safety standard. The standard provides a process framework and associated requirements for management responsibilities, risk analysis and evaluation, risk controls and lifecycle risk management.

The European version of the risk management standard was updated in 2009 and again in 2012 to refer to the Medical Devices Directive (MDD) and Active Implantable Medical Device Directive (AIMDD) revision in 2007, as well as the In Vitro Medical Device Directive (IVDD). The requirements of EN 14971:2012 are nearly identical to ISO 14971:2007. The differences include an Annex that refers to the new MDD and AIMDD, the requirement for risks to be reduced as low as possible, and the requirement that risks be mitigated by design and not by labeling on the medical device (i.e., labeling can no longer be used to mitigate risk).

Typical risk analysis and evaluation techniques adopted by the medical device industry include hazard analysis, fault tree analysis (FTA), failure mode and effect analysis (FMEA), hazard and operability study (HAZOP), and risk traceability analysis for ensuring risk controls are implemented and effective (i.e. tracking risks identified to product requirements, design specifications, verification and validation results etc.)

FTA analysis requires diagramming software. FMEA analysis can be done using a spreadsheet program. There are also integrated medical device risk management solutions.

Through a draft guidance, FDA has introduced another method named "Safety Assurance Case" for medical device safety assurance analysis. The safety assurance case is structured argument reasoning about systems appropriate for scientists and engineers, supported by a body of evidence, that provides a compelling, comprehensible and valid case that a system is safe for a given application in a given environment. With the guidance, a safety assurance case is expected for safety critical devices (e.g. infusion devices) as part of the pre-market clearance submission, e.g. 510(k). In 2013, FDA introduced another draft guidance expecting medical device manufacturers to submit cybersecurity risk analysis information. "Wikipedia"