Hazard Analysis template: the 32 columns of the rmForge ISO 14971 workbook

A Hazard Analysis template is a fixed set of columns that every hazard row has to fill in. rmForge ships one: 32 columns in the same order on every Hazard Analysis, with six reference sheets beside them. This page says what belongs in each column and why.

Written for regulatory and quality engineers at medical device companies.

How a row reads

A row is a chain: a hazard, the events that expose someone to it, the hazardous situation, and the harm. The numbers sit inside that chain, so each probability stands next to what it measures. The groups below are jobs, not blocks of neighboring letters.

Hazard identification

These columns say what can go wrong, and to whom, before any number is assigned.

• Column A, Risk ID. Sequential identifier in the form HZ-0001. It names the row in a review, in a requirement, and in the next revision.
• Column B, General Hazard. The high level hazard category, from the controlled vocabulary in Annex C of ISO 14971, the International Organization for Standardization standard for risk management of medical devices.
• Column C, Specific Hazard. The specific hazard inside that category, from the same vocabulary. A fixed list, rather than a fresh name each time, keeps two analyses of one device comparable.
• Column D, Use Classification. Intended use, misuse, or abnormal use, per IEC 62366-1, the International Electrotechnical Commission standard for usability engineering of medical devices.
• Column E, Foreseeable Sequence of Events. The causal chain from the initiating event to the hazardous situation, one to four steps, stopping before the harm.
• Column F, N/F. Normal or fault condition. Normal is the device as designed. Fault is a single component failure. Every row is one or the other, never both.
• Column H, Hazardous Situation. The circumstance in which a person is exposed to the hazard, per Section 3.4 of ISO 14971.
• Column I, Cause. One of Design, Hardware, Software, Process, Packaging, Labeling, or User.
• Column K, Harm. The injury to a person, or the damage to property, per Section 3.3 of ISO 14971.
• Column L, IMDRF Code. The code for the harm in the adverse event terminology of the International Medical Device Regulators Forum (IMDRF), taken from the harm library or found by the harm's name in the published list. When the name is not in the list, an artificial intelligence (AI) model picks the published term for the same injury, or the closest broader one: check those codes against your own coding. Blank when no published term fits.
• Column M, FDA Code. The same harm under United States Food and Drug Administration (FDA) numbering, as it appears in FDA adverse event reporting. Blank when the IMDRF Code is blank.

Risk estimation before controls

Six columns carry the estimate. Three are judgments, two are lookups, one is a flag.

• Column G, P1. The probability that the hazardous situation arises at all, 1 to 5 against the probability scale on the Scales sheet.
• Column J, P2. The probability that harm follows once the situation exists, on the same scale.
• Column N, S. Severity of the harm, 1 to 5 against the severity scale on the Scales sheet.
• Column O, Po. The probability that harm occurs, 1 to 5, read off the P1 by P2 table on the Risk Region sheet, never multiplied. It is a live lookup that recomputes when you edit P1 or P2.
• Column P, Risk Level. Low, Medium, High, or Unacceptable, read off the Severity by Po table, and also live. In the table rmForge ships, a harm at Severity 4 or 5 never lands in Low, so it always calls for a risk control.
• Column Q, Essential Performance. For medical electrical equipment under Section 4.3 of IEC 60601-1: Y or N, or TBD (to be determined) where the essential performance step left a row undecided. N/A (not applicable) on a device that is not medical electrical equipment, and on the Low rows of one that is. It lives on the hazard rows, not a separate sheet.

Nothing there is multiplied, and no Risk Priority Number is produced. Multiplying ordinal scores lets a rare severe harm and a frequent minor one collapse to one number, hiding the row a patient is most exposed to. Both tables are explained on the Hazard Analysis subject page.

Risk control

A risk control that never becomes a requirement may never be built into the device. It cannot be verified, so the harm it was meant to prevent can still reach the patient.

• Column R, Risk Control Measure Option Categories. The categories from the Section 7 hierarchy of ISO 14971: design, protective measures, process control, and information for safety. Risk Control Measure is shortened to RCM below.
• Column S, RCM Requirements. Each proposed control written as a product requirement with measurable acceptance criteria. There is no separate product requirement column. This is it.
• Column T, Implementation. The design output that implements each control: a drawing, a code module, a label file.
• Column U, Verification. The activity that proves it: a test protocol, an inspection procedure, an analysis report.

rmForge proposes at least one Risk Control Measure for every row, including Low rows, with its implementation and verification.

Residual risk after controls

These nine columns record the risk once the controls are verified. rmForge starts the revised harm as the row's own harm and New Risk at N. Your team fills in the revised P1, P2 and severity, and the revised Po and Residual Risk follow from them.

• Column V, Rev P1. The revised probability of the hazardous situation once the controls are in place. Reads TBD until filled.
• Column W, Rev P2. The revised probability of harm once the controls are in place. Reads TBD until filled.
• Column X, Revised Harm. The harm after the control. rmForge fills it with the row's harm; change it when the control changes which harm results, such as a fail safe dropping the device to a lower energy mode.
• Columns Y and Z, Revised IMDRF Code and Revised FDA Code. The codes of the revised harm, copied from the harm's own codes; blank where the harm has none. When your team changes the revised harm, update or clear these codes.
• Column AA, Rev S. The revised severity after the controls. Reads TBD until filled.
• Column AB, Rev Po. The revised probability that harm occurs, a live lookup off Rev P1 and Rev P2. Blank until both are filled.
• Column AC, Residual Risk. The risk level after the controls, a live lookup off Rev S and Rev Po. Blank until both are filled.
• Column AD, New Risk. Y when the control introduces a new risk that needs its own row, N otherwise. A control that trades one harm for another is not finished until that harm has a row.

Links to the Failure Mode and Effects Analysis

• Columns AE and AF, DFMEA Cross-Ref and PFMEA Cross-Ref. The rows of a Design Failure Mode and Effects Analysis (FMEA) or a Process FMEA that cite this hazard. Blank until that FMEA exists, and None when no row of it traces here.

The six reference sheets beside the rows

The rules have to travel with the rows, or a reviewer six months later cannot check a number.

• Cover Page. Document identifier and revision, device name, the analyst and approver lines your team signs, the methodology statement, row counts by risk level, and a benefit risk statement.
• Risk Region. Both lookup tables in full, with what each of the four levels calls for. ISO 14971 leaves acceptability to the manufacturer's own risk management plan, so check these against yours.
• Scales. The severity and probability scales, 1 to 5 each, with a label and description per value. It also carries the software rule: a cause of software with severity 4 or 5 locks P1 at 5, under IEC 62304.
• Column Descriptions. The same 32 columns with a description of each, so the workbook explains itself.
• Hazard Questionnaire. The hazard identification questions answered for your device, adapted from ISO/TR 24971, with the evidence and references. It doubles as a design review record.
• Disclaimer. The statement that the workbook is a draft for engineering review, and the acknowledgment record.

The hazard rows print on Tabloid paper sideways; the reference sheets on Letter.

What you can take away

The structure, and nothing more. There is no blank file to download here, because none exists. The 32 columns are filled in with you during a working session, from your Instructions for Use (IFU) and your product requirements.

The output is a draft. It requires qualified cross functional review and approval by your team, and rmForge does not determine regulatory compliance or guarantee that a submission is accepted.