ISO 14971 covers which critical activity in medical device risk management?

• A. Identifying, evaluating, and manufacturing risks in products.
• B. Post-market surveillance requirements for devices.
• C. Quality management system documentation.
• D. Identifying, evaluating, controlling, and monitoring risks throughout the product lifecycle.

Answer: (D)

ISO 14971 sets up a continuous risk management process for medical devices that covers the entire lifecycle—from concept and design through production, use, and post-market monitoring. The standard requires you to identify potential hazards, evaluate the associated risks, implement and validate risk controls, and then continuously monitor how those controls perform to keep residual risk at an acceptable level as the device is used in the real world. This lifecycle, iterative approach is why the option describing identifying, evaluating, controlling, and monitoring risks throughout the product lifecycle is the best match. Other choices touch on related ideas—like post-market activities alone, or quality management documentation or manufacturing risks—but they don’t capture the full, ongoing risk management process across the device’s life.