MDSAP Audit Approach (MDSAP AU P0002) C5-T8-T9: Apply risk management throughout design with defined acceptability criteria, evaluate and communicate residual risk, and confirm through verification or validation that risk controls work

What does C5-T8-T9 require?

Risk management must be defined and carried out for product and process design, with acceptability criteria set and met throughout, residual risks evaluated and, where appropriate, communicated to users (labelling, service documents, advisory notices), and a benefit-risk analysis where a risk cannot be brought to an acceptable level. Design verification or validation must show that risk control measures actually control or reduce the risk. Brazil: a continuous life-cycle risk management process must identify hazards in normal and fault conditions including human factors, estimate, evaluate and control risks and check the effectiveness of controls (RDC 848/2024; RDC 665/2022 Arts 18 to 20). Clauses: ISO 13485:2016 4.2.1, 7.1, 7.3.3, 7.3.4, 7.3.6, 7.3.7; TG(MD)R Sch 1 Pt 1 EP 2, Sch 3 Pt 1 cl 1.4(5)(c); CMDR 10, 11, 15, 16; MO169 Arts 26, 31, 32, 34, 35-1.