ISO 7101 Risk Management Procedure Template

A complete, editable ISO 7101:2023 risk management procedure for Clauses 6.1.2 and 6.1.3 — written as a finished working document, covering clinical and non-clinical risk in one process.

Most healthcare risk work is split. Clinical incidents go one way. Facilities, supply, staffing and information risk go another. Neither route sees the whole picture, and the register that reaches the board is usually a merge of two lists built on different scales. ISO 7101 asks for one system covering both.

Clause 6.1.3 is unusually specific

Most management system standards leave the method to you. This one does not. It names what the system must contain, and each named item is a thing an auditor can ask to see.

• A documented system covering clinical and non-clinical risks and opportunities
• Environmental risks, and unforeseen circumstances such as war, labor strikes and epidemics
• A register of risks and opportunities
• A risk criterion stating how much risk is acceptable against each type of objective

That last one is where most organizations stop. A scoring matrix is not a risk criterion. A criterion states the amount of risk you accept, for a stated type of objective, decided in advance. Section 5.3 of this procedure walks you through setting them, and records the result where an auditor will look.

Harm is defined, not implied

In a clinical setting, severity cannot be left to judgment. This procedure defines the harm bands in plain terms, including the band that requires immediate response and investigation, and asks you to confirm or replace the list with your own. The point is that two people rating the same event reach the same answer. Without written bands they will not.

Written to be read by the people who use it

Healthcare procedures are used by people under time pressure who did not write them. This document is built for that. Front matter and guidance notes are held to a plain reading level and short sentences. The procedure body keeps the precision the standard requires, but nothing is longer than it needs to be.

What is in it

• Seventeen numbered sections and five appendices, in the architecture used across every MSI procedure
• Fourteen procedure steps from trigger through to the release gate, covering both clinical and non-clinical routes
• Around two hundred and forty bracketed decisions — each one a choice the standard leaves to you, with the question stated rather than a blank to fill
• Eleven MSI notes recording what happens in practice, at the point it matters
• Section 5.0 — setting the program, the harm bands and the risk criteria, before anybody scores anything
• Section 10.0 — a process interaction map showing what feeds this procedure and what consumes from it
• Section 14.0 — a maturity ladder, nine elements with four levels each, described as observable behavior
• Section 15.0 — a clause cross-reference mapping each obligation to the section that satisfies it
• Appendix A — the registers, built to work as the release gate rather than as a report about the work
• Appendix B — the mitigation plan and effectiveness record
• Appendix C — a desk-level work instruction with worked examples
• Appendix E — a program and criteria worksheet for the decisions you make once
• Appendix F — measuring risk awareness culture, which is the part of ISO 7101 most organizations assert rather than evidence

Specification

Who it is for

Quality and risk leads in hospitals, clinics, long-term care and other healthcare organizations working toward or holding ISO 7101:2023, and the consultants supporting them. Particularly useful where clinical and non-clinical risk are managed by different people on different scales, and where the register exists but the risk criterion behind it has never been written down.

Other options in this family

If this is not the right combination

Every variant covers one certification combination, so you buy the one document that matches your certificates rather than assembling it from singles.

• ISO 9001 only — quality management system risk and opportunity, where the standard requires no register and the obligation arrives at 4.4.1 instead
• ISO 13485 only — device risk on ISO 14971, for healthcare organizations that also manufacture
• ISO 45001 only — job hazard identification, for the staff safety side of the same organization

The full documentation package

This procedure is one document in a wider system. If you are building or rebuilding the whole documentation set rather than filling a single gap, the package below collects the procedures and guides, and works out considerably cheaper than buying them individually.

• ISO 7101:2023 procedure templates and guides — the complete healthcare quality management system documentation set — the direct match for this procedure