Risk Management for Medical Device Software According to ISO 14971
Identify Hazards. Analyze Software Risks. Implement Controls. Build Safer Medical Devices.
This course is certified by Exemplar Global.
Medical device software plays a critical role in ensuring patient safety, regulatory compliance, and device performance. Whether software is embedded within a medical device or delivered as standalone Software as a Medical Device (SaMD), manufacturers must establish and maintain an effective risk management process throughout the product lifecycle in accordance with ISO 14971.
This instructor-led course provides practical guidance on applying ISO 14971:2019, ISO/TR 24971, and IEC/TR 80002-1 to medical device software. Participants learn how to identify hazards, analyze software-related risks, evaluate hazardous situations, implement risk controls, document risk management activities, and maintain traceability from development through post-market surveillance.
In this training course, you will:
- Learn how to implement and maintain a risk management process throughout the lifecycle of your products in your organization.
- Know how to create risk analyses for medical device software.
- Be aware of the requirements for the risk management process.
Testimonial:
- “The instructor's deep knowledge and practical expertise made complex risk management concepts easy to understand and apply.”
Important: TÜV SÜD tests and certifies through its Notified Bodies medical devices and their manufacturers. TÜV SÜD Akademie GmbH offers trainings in the field of medical devices.
The neutrality and independence of the conformity assessment procedures carried out by TÜV SÜD must be maintained. In the interest of our customers, hence the seminars of TÜV SÜD Akademie do not contain any product-specific, process-related or company-specific content or solutions that could fulfill the function of individual consulting.
In case of any questions or uncertainties, please do not hesitate to contact us at [email protected].
This course is intended for:
- Software Developers and Software Engineers
- Software Architects
- Systems Engineers
- Product Development Engineers
- Medical Device Design Engineers
- Quality Assurance Professionals
- Risk Management Specialists
- Regulatory Affairs Professionals
- Cybersecurity Professionals involved in medical devices
- Project Managers
- Product Managers
- Clinical and Application Specialists
- Medical Device Manufacturers
- Suppliers and Service Providers supporting medical device software
- Consultants working with medical device development and compliance
The following topics are covered in this training course:
- Introduction to medical device software risk management
- Lessons learned from the Therac-25 case study
- Risk management fundamentals and terminology
- Hazards, hazardous situations, harm, and sequences of events
- Faults, errors, failures, and software causes
- ISO 14971:2019 requirements and framework
- ISO/TR 24971 guidance
- IEC/TR 80002-1 application to medical device software
- Risk management planning and risk management files
- Risk analysis and risk estimation
- Qualitative and semi-quantitative risk evaluation methods
- Risk acceptance criteria and matrices
- Risk control option analysis
- Benefit-risk and residual risk evaluation
- Production and post-production information
- Traceability and change management
- Software safety classification concepts
- System context and interface analysis
- Software architecture risk analysis
- Third-party software (SOUP) considerations
- IT security and cybersecurity-related risks
- Usability and foreseeable misuse
- Fault Tree Analysis (FTA)
- Preliminary Hazard Analysis (PHA)
- Software FMEA and Process FMEA
- Practical exercises and case studies
Medical device software has become a key component of modern healthcare technologies. Whether operating as standalone software, software within a medical device, or software interacting with connected systems and infrastructure, failures can lead to significant safety risks. Effective risk management is therefore a fundamental requirement for both regulatory compliance and patient protection.
This course provides a comprehensive understanding of the risk management principles and requirements established by ISO 14971:2019 and ISO/TR 24971, with particular emphasis on their application to medical device software through IEC/TR 80002-1. Participants learn how risk management integrates with the software lifecycle and supports compliance with medical device regulatory expectations.
Through real-world case studies such as the Therac-25 incidents, practical examples, group exercises, and instructor-led discussions, participants explore software hazards, fault conditions, hazardous situations, harm, foreseeable misuse, usability considerations, IT security concerns, software architecture risks, third-party software components (SOUP), and production and post-production information.
The course introduces proven risk analysis techniques including fault tree analysis (FTA), preliminary hazard analysis (PHA), software FMEA, process FMEA, event analysis, system-context analysis, and software interface analysis. Participants learn how these techniques are used to identify software causes, estimate risks, develop effective risk control measures, and evaluate residual risk.
By the end of the course, participants will be able to establish and maintain a compliant risk management process, prepare risk management documentation, conduct software-focused risk analyses, evaluate benefit-risk relationships, and create risk management reports that support regulatory submissions and product lifecycle management.
Upon completion of this course participants will be able to:
- Explain fundamental risk management concepts and terminology defined in ISO 14971.
- Establish a medical device software risk management framework.
- Create and maintain risk management plans and risk management files.
- Identify hazards, hazardous situations, harms, and sequences of events.
- Analyze software-related causes and failure mechanisms.
- Apply risk estimation and risk evaluation methodologies.
- Utilize FTA, PHA, Software FMEA, and event-tree approaches.
- Analyze software systems, architecture, interfaces, user interactions, and operating environments.
- Evaluate risks associated with SOUP and third-party components.
- Develop and verify risk control measures.
- Assess overall residual risk and perform benefit-risk analysis.
- Integrate production and post-production information into risk management activities.
- Prepare compliant risk management reports and documentation.
As participant, you will be able to:
- Understand the requirements of ISO 14971:2019, ISO/TR 24971, and IEC/TR 80002-1.
- Apply risk management throughout the medical device software lifecycle.
- Identify hazards, hazardous situations, foreseeable misuse, and software-related causes of harm.
- Perform software-focused risk analyses using structured methodologies.
- Apply fault tree analysis (FTA), preliminary hazard analysis (PHA), and software FMEA techniques.
- Analyze software architecture, interfaces, system context, and third-party software risks.
- Address usability, cybersecurity, interoperability, and operational environment considerations.
- Develop appropriate risk control measures and verify their effectiveness.
- Evaluate residual risks and perform benefit-risk assessments.
- Build and maintain a compliant risk management file.
- Improve traceability between hazards, risks, controls, validations, and residual risks.
- Support regulatory compliance and product safety throughout production and post-production activities.
- The contents of the training course correspond to the current status of revision/harmonization.
- The course deals with internationally valid standards and is also suitable for implementation abroad.
- Included in the course price is the standard ebook "Quality Management and Risk Management for Medical Devices" (ISO 13485 and ISO 14971).
- This training course is part of a modular training programme. After successful participation in the advanced courses, you can acquire this recognized qualification:
- Specialist Medical Software – TÜV
This highly interactive instructor-led training combines:
- Expert-led presentations
- Real-world case studies
- Guided software risk management exercises
- Group discussions
- Hazard identification workshops
- Risk analysis exercises
- FTA and FMEA examples
- Practical software risk assessment scenarios
- Knowledge checks and quizzes
- Open question-and-answer sessions
The course emphasizes practical application of ISO 14971 principles to real medical device software development projects.
Participants who attend at least 90% of the total training duration will receive a Certificate of Attendance from TÜV SÜD Academy.
While no prior risk management experience is mandatory, participants will benefit from:
- Basic understanding of medical devices or Software as a Medical Device (SaMD)
- Familiarity with software development concepts
- Basic knowledge of quality management systems or product development processes
- Awareness of regulatory requirements applicable to medical devices is helpful but not required
Does the course focus specifically on software?
Yes. The course focuses on applying ISO 14971 risk management principles specifically to medical device software and Software as a Medical Device (SaMD).
Does the course cover ISO 14971:2019?
Yes. The course explains ISO 14971:2019 requirements and ISO/TR 24971 guidance.
Is IEC/TR 80002-1 covered?
Yes. A significant portion of the course addresses application of ISO 14971 to medical device software through IEC/TR 80002-1.
Will I learn how to conduct a software risk analysis?
Yes. Participants learn multiple approaches including FTA, PHA, Software FMEA, event analysis, and system-context analysis.
Does the course include practical exercises?
Yes. The course includes exercises, workshops, examples, and group activities.
Is cybersecurity discussed?
Yes. The training includes IT security, software security risks, and security-related hazards.
Does the course cover usability-related risks?
Yes. Foreseeable misuse, user scenarios, and usability considerations are addressed.
Are risk management files discussed?
Yes. Participants learn the structure and required contents of risk management files and plans.
Does the course cover residual risk evaluation?
Yes. Participants learn residual risk assessment and benefit-risk analysis approaches.
Is post-market surveillance included?
Yes. Production and post-production information, complaints, adverse events, and feedback loops are covered.
Train with Industry Experts
Learn from specialist instructors at TÜV SÜD Academy—recognized leaders with deep expertise in their fields. For over 35 years, our global network of 2,500+ trainers has delivered practical, real-world knowledge that you can apply immediately.
Our courses are continuously updated to reflect the latest regulatory changes and industry best practices, ensuring you gain relevant, up-to-date skills with every session.
This course is certified by Exemplar Global.
TÜV SÜD has achieved Exemplar Global Accreditation as a Recognized Training Provider. This accreditation confirms our commitment to providing the highest quality services and demonstrates our expertise in our industry. As a professional, it's important to have recognition for your skills and knowledge. Exemplar Global Accreditation provides this recognition, giving you a competitive edge in the marketplace. With over 30 years of experience building certification programs, Exemplar Global is the leading authority in accreditation for the conformity community. As a student of an Exemplar Global Recognized Training Provider (RTP) course, you are eligible to receive:
- Access to Exemplar LINK
- 12-months of exclusive benefits including:
- One self-coaching assessment
- Extended learning content
- Complimentary access to online events, online magazine, newsletters, and low-cost professional liability insurance
- Access to an exclusive LinkedIn Community
- The chance to look into alternatives for employment and career advancement
- A TÜV SÜD / Exemplar Global Graduate Certificate
At TÜV SÜD, we believe in maximizing your career and providing you with the tools you need to succeed. Our Exemplar Global Accreditation is a testament to our commitment to excellence and our commitment to helping you succeed.