Quality system risk and device product risk — kept apart, decided together
A device maker certified to both standards carries two kinds of risk that are easy to merge and expensive to confuse: quality management system risk under ISO 9001 and product risk under ISO 13485 and ISO 14971. This QuickStart lists the decisions that keep the register and the risk management file apart while running them as one process, in the order that lets each one build on the last.
Six pages, thirty-one decisions, five stages.
Name the owners and the boundaries. Set the criteria. Set the routes in. Set the response. Set the rhythm and the records. Each stage depends on the one before it, and skipping ahead is the usual reason a half-finished system has to be redone.
What it is
A route through the
ISO 9001 + ISO 13485 Integrated Risk Management procedure — not a replacement for it. Every decision carries the section of the procedure where it is explained, so you read the reasoning before you decide rather than guessing and correcting later.It also carries two things that stand on their own:
- What “risk” means in a standard, against what it means in a boardroom. A side-by-side comparison — what risk is, how it is judged, where opportunity sits, what done looks like, who owns it and when it is looked at — because the gap between the two is where most findings in this area come from.
- What changed in the 2026 edition. One of the two standards moved. ISO 9001:2026, published 16 September 2026, splits Clause 6.1 into three subclauses and requires risks, and separately opportunities, to be analyzed and evaluated. ISO 13485:2016 did not move — hazardous situations, risk-based determinations, overall residual risk and the post-production loop stand as they were. The gap between them widened: opportunities stay in the quality register and never enter the risk management file.
The five stages
01 · Name the owners and the boundaries
Nothing is rated until someone owns it and every product line has a settled scope. In this variant the scope decision comes first, because it decides which of two systems an entry belongs to.
02 · Set the criteria
This is the stage that decides whether the procedure works: anchors written as outcomes, a stated horizon, and a threshold that obliges action. Clauses 6.1.2 and 6.1.3 of ISO 9001:2026 now ask you to analyze and evaluate against exactly these.
03 · Set the routes in
How entries reach the register, and how opportunities reach it separately. A register only knows what its routes bring it.
04 · Set the response
What happens to an entry once it is rated. The test is not whether an action was recorded. It is whether a process changed.
05 · Set the rhythm and the records
When the register is looked at again, what triggers it, and what exists afterward. The 2026 edition asks for records to be available, not merely retained.
Questions
Is this the procedure?
No. It is six pages that route you through a sixty-page procedure. It lists the decisions and points at the section where each is explained; it does not contain the explanation, the worked examples, the MSI notes or the registers. Adopting a risk process from this sheet alone would leave obligations unmet.
Then why buy it separately?
Most people should not. It is included free with the
ISO 9001 + ISO 13485 Integrated Risk Management procedure, and that is the better purchase. This standalone exists for the narrower case: you already have a risk procedure of your own and want the decision order, or you are scoping the work before committing budget.
Does it apply to the 2015 edition?
The stages and the decision order do. The clause references and section numbers are ISO 9001:2026 and ISO 13485:2016. If you are still certified to ISO 9001:2015, the procedure purchase includes a Transition edition marking every change, which is the more useful document for that situation.
What format is it?
Editable Microsoft Word (.docx).
Can you help us implement it?
Yes. Call MSI at
760-434-9141 to schedule a planning session.
