Combined ISO 9001 and 13485 Integrated Risk Management Procedure Template

One risk management procedure covering quality management system risk and medical device product risk — written as a finished working document, not an outline.

Combining them is not a matter of merging two spreadsheets, because the standards genuinely differ in more places than the obvious one.

ISO 9001 requires opportunities to be determined. ISO 13485 has no opportunity concept anywhere in the standard. ISO 9001 requires actions proportionate to the impact on conformity; ISO 14971 requires risk reduced as far as possible and then judged against benefit. Those are different tests and they can produce different answers about the same exposure.

Scope determination comes first

Section 2.0 resolves, per product line, whether you are in general scope, device scope, or uncertain — with uncertain defaulting to device scope pending a documented determination. That last category is where most contract manufacturers, component suppliers and software providers actually sit, and it is usually resolved in about an hour once somebody asks the question.

The interface separate systems do not have

A process risk that could reach a device should change a probability estimate in a risk management file. In two disconnected systems there is no route by which it ever does. Section 7.13 is that route, running in both directions, and it is one field on a form.

The procedure also keeps the two records apart. A notified body reviewing a risk management file will not accept it interleaved with business risk. Share the process; keep the records separate; link them with a flag.

Appendix D is why this variant exists

Eleven genuine divergences, each with what ISO 9001 says, what ISO 13485 and ISO 14971 say, which position was adopted as the house standard, and what was rejected and why — followed by a sign-off table of decisions to confirm before adoption. It is the part a buyer cannot easily assemble alone, and it is what a certification body will ask about.

What is in it

• Section 2.0 — scope determination first, three-way per product line, with uncertain defaulting to device scope pending a documented determination.
• Two distinct rating scales, deliberately different in length so a rating cannot be transcribed between them by accident.
• Section 7.13 — the device-reach flag, the single interface two separate systems do not have, running in both directions.
• Section 7.12 — risk routes owned by other procedures, covering contract review, the supplier change-notification agreement, and the retrospective product assessment, with both standards' clauses cited.
• The seven risk-based determinations ISO 13485 requires in proportion to risk, indexed with their rationales.
• Hazardous situation analysis on the device side — hazard, sequence of events, hazardous situation and harm kept distinct.
• Opportunity applied across the quality scope, held in the register and never in the risk management file, because ISO 13485 has no opportunity concept.
• Benefit-risk and overall residual risk, judged for the device as a whole rather than summed from the parts.
• Figure 1 — process interaction map covering both scopes.
• A records table with no blanks, with device retention set separately from quality management system retention.
• Appendix A — the registers and the file, kept separate and linked by flag. Appendix B — treatment plan with a cross-system field. Appendix C — desk-level work instruction with a worked example following one exposure through both systems.
• Appendix D — the integration decision record: eleven divergences, eleven decisions, one sign-off table.
• Appendix E — criteria and plan worksheet. Appendix F — the QMSR and the regulatory overlay.

Specification

Who it is for

Quality and regulatory leaders at organizations holding both ISO 9001 and ISO 13485, contract manufacturers running general industrial and device lines on shared assets, and consultants supporting dual-certified clients. Particularly useful for suppliers who sit inside a customer's device quality system by contract and are not certain whether they are in device scope.

Other options in this family

If this is not the right combination

Every variant covers one certification combination, so you buy the one document that matches your certificates rather than assembling it from singles.

• ISO 13485 only — device product risk alone, if you do not hold ISO 9001
• ISO 9001 only — quality management system risk alone
• IMS — ISO 9001, ISO 14001 and ISO 45001 — if your system reaches environmental and safety rather than devices

The full documentation package

This procedure is one document in a wider system. If you are building or rebuilding the whole documentation set rather than filling a single gap, the packages below collect the procedures and guides, and work out considerably cheaper than buying them individually.

• ISO 9001 and ISO 13485 package — the combined quality and device documentation set — the direct match for this procedure
• ISO 13485 procedure templates and guides — the device set on its own
• ISO 9001 procedure templates and guides — the quality management system set on its own