ISO 14971 Risk Management Files: What Distributors Get Asked For

A risk management file is the document set that shows how a manufacturer identified what could go wrong with a device, what was done about it, and how the residual risk was judged acceptable. It is not a certificate and it does not expire, which is exactly why it causes confusion when a distributor is asked for one.

Distributors get asked for it by hospitals, by their own regulators and occasionally by insurers. The questions are always the same: does a file exist, does it cover this product, and does it cover the configuration being supplied. Answering those three is what the exercise is about.

What the File Actually Contains

A file normally contains the risk management plan, the hazard and risk analysis, the evaluation of risk for each identified hazard, the measures taken to reduce risk, and the assessment of residual risk against defined criteria. It also contains the link between risks and the verification evidence that shows the measures work.

Beyond the analysis, the file includes production and post-production information: how complaints and field data feed back into the assessment, and how often the assessment is reviewed. That section is what makes the file a living document rather than an artefact produced for an approval.

For a buyer, the practical point is that the file is a manufacturer document. A distributor cannot create one, and a supplier who offers to produce one on request is describing a different activity from risk management.

The Three Questions To Ask

The first question is whether a file exists for the device family. That is a simple yes or no, and the answer should come with a document reference and a revision date rather than a verbal assurance.

The second is whether it covers the specific model and variant being supplied. Manufacturers often maintain one file per family, and variants that introduce new hazards, such as a different power supply or a new accessory, should be reflected. Where a variant is covered by an addendum, the addendum should be identified.

The third is whether it covers the configuration shipped to this market. A unit supplied with different accessories, a different language package or a different fixing kit is a different configuration, and the risk analysis should reflect what is actually in the box. The registrations and reporting duties that follow from that distinction are covered in our notes on EUDAMED registration roles.

Why Distributors Are Asked

Hospitals ask during procurement and during audits, because risk documentation is part of their own quality system. Regulators ask when a device is being placed on the market or when an incident is reported. Insurers ask when a clinical incident leads to a claim.

In each case the distributor is the party in front of the question, and the distributor usually does not hold the document. That is why the practical arrangement is to agree at the order stage what documentation the manufacturer will provide, in what form, and within what time.

The obligations that sit with the distributor rather than the manufacturer should be equally explicit. Post-market surveillance, vigilance reporting and the maintenance of complaint records are all distributor-visible duties, and the plans that support them are described in our article on post-market surveillance plans.

Checking the File Without Reading It All

A distributor rarely has the technical background to assess the analysis, and does not need it. Four checks cover most of the ground: the file names the product and the revision; the risk criteria are stated rather than implied; there is a clear link from each significant hazard to a verification activity; and there is a section describing how production and field information feeds back.

Where a check fails, the correction is a supplier conversation rather than a distributor task. A file with no stated criteria, or one whose hazards do not link to evidence, is a documentation gap that the manufacturer should close, and the request should be specific about what is missing.

Keeping a summary of what was received, with dates and document references, is enough for most distributor purposes. The summary is also what makes the next request faster, because the same document can be produced for the next hospital question without reopening the conversation with the factory.

Where It Fits With Everything Else

The risk management file sits alongside the test reports, the declarations and the labelling as part of the technical documentation set. It is not a substitute for any of them, and it is not usually the first document a hospital asks for, but it is the one that tends to be missing when a compliance review gets deeper than the paperwork.

For a manufacturer supplying through distributors, the efficient arrangement is a documentation pack issued with the product and updated on a defined cycle. That approach reduces the per-order effort to a reference check, and it makes the distributor relationship easier because the documentation question is answered before it is asked.

Market-specific rules apply on top of the documentation set. In the United States, device classification and reporting requirements are collected in 21 CFR, where US medical device rules sit, and the responsible parties should be identified in the supply agreement rather than assumed. Our https://sanyangmedical.com/solutions/oem-odm-localization/ programmes include a documentation pack per model, which is what turns a compliance enquiry into a file retrieval.

Pertanyaan Umum

Video: Inspection & Quality Control in Manufacturing Promo

If documentation requests keep arriving without warning, the fix is a pack issued with the product rather than assembled per enquiry. Our OEM and localization programme includes a documentation pack per model, and the registration duties that sit around it are covered in our EUDAMED registration notes.