MDSAP Audit Approach (MDSAP AU P0002) C1-T7: Top management commits to and owns risk management planning across the product life cycle, with documented methods, acceptability criteria and post-market updating of risk files

What does C1-T7 require?

Management must commit to and be responsible for overall risk management planning: documented policies, procedures and practices for analysing, evaluating and controlling risk to the product over its whole life, criteria for risk acceptability, adequate resources and qualified people, ongoing review of how effective risk management is, and mechanisms for updating each risk management file in the post-market phase. Auditors follow a device's risk management file into production, purchasing and post-market processes to check that mitigations (inspections, supplier requirements, process controls) are in place and that complaints, nonconformities and vigilance trigger file reviews. Clauses: ISO 13485:2016 7.1; TG(MD)R Sch 1 Pt 1 EP 2; RDC 665/2022 Arts 18 to 20; MO169 Arts 5-2 and 26.