Benefit-Risk Analysis: The Complete ISO 14971 Clause 7.4 Guide

A benefit-risk analysis under ISO 14971:2019 is the step a manufacturer takes when a risk cannot be brought within its own acceptability criteria and the device is still worth making. Clause 7.4 applies it to an individual residual risk: if the residual risk is not judged acceptable using the criteria in the risk management plan and further risk control is not practicable, the manufacturer may gather and review data and literature to determine whether the benefits of the intended use outweigh that residual risk — and if they do not, the risk remains unacceptable. Clause 8 applies the same analysis to the overall residual risk of the device once all risk control measures are in place. The 2019 edition made the concept explicit by defining benefit for the first time (3.2): a positive impact or desirable outcome of the use of a medical device on the health of an individual, or a positive impact on patient management or public health. Under EU MDR the analysis is not optional at all — Annex I requires every risk to be acceptable when weighed against the benefits, and the clinical evaluation must support the benefit-risk determination. This guide sets out when each analysis is required, what benefit means and how it is evidenced, how to structure the analysis so a reviewer can follow it, how MDR and FDA treat it, and the errors that turn a benefit-risk analysis into a rationalisation.

Where benefit-risk analysis sits in the process

Two points the sequence enforces. Benefit-risk is reached only after risk control has been exhausted — a manufacturer cannot skip to it because a control is expensive. And the plan’s criteria come first: the analysis is a justified exception to them, recorded as such. Our guide to the ISO 14971 risk management plan covers the criteria the exception is measured against, and risk acceptability criteria covers how they are set.

What benefit means, and how it is evidenced

Benefit is characterised by its type, magnitude, probability (the proportion of patients who experience it) and duration, and by the population and conditions of use in which it occurs — the same attributes the risk side carries. The analysis compares like with like: a benefit that accrues to most users for years is weighed against a harm of stated severity and probability, not against a label claim.

Structuring the benefit-risk analysis

1. State the residual risk precisely. The hazardous situation, the harm, its severity and estimated probability after all practicable risk control, and why further control is not practicable — with the evidence that it was considered.
2. State the intended use and the population. The benefit belongs to the intended use as defined in the file (5.2), for the patient population and use conditions stated; a benefit outside the intended use does not count.
3. Characterise the benefit. Type, magnitude, probability, duration, with the clinical data and literature that support each attribute and their quality.
4. Consider the alternatives. What the patient’s outcome would be without the device or with alternative treatments and devices — the state of the art (3.28) is the comparator, and a benefit already available with lower risk is not a benefit of this device.
5. Weigh, and record the judgement. Who decided, against what reasoning, that the benefit outweighs the risk; the uncertainty in both sides; the conditions on which the conclusion depends.
6. Disclose. A residual risk accepted on benefit-risk grounds is a significant residual risk to be communicated in the accompanying documentation (8), and the file records what was disclosed.
7. Re-evaluate post-production. Clause 10 information — complaints, field data, literature — can change either side; the analysis is reopened when it does.

Benefit-risk analysis under EU MDR and FDA

Our guide to EU MDR covers the regulation; the practical consequence is that in the EU the benefit-risk analysis is written for every device, not only when a risk fails the plan’s criteria.

Errors that turn a benefit-risk analysis into a rationalisation

• Reaching for it too early. A benefit-risk analysis used instead of a practicable risk control fails clause 7.1’s option analysis and MDR’s as-far-as-possible test.
• Benefit without evidence. A claimed benefit with no clinical data, literature or comparator is an assertion; reviewers ask for the source and its quality.
• Weighing the device against nothing. The comparator is the state of the art and the alternatives, not the absence of treatment.
• Population drift. A benefit demonstrated in one population used to justify a risk in a broader intended use.
• No disclosure. A risk accepted on benefit grounds that does not appear in the instructions for use as a significant residual risk.
• Never reopened. Post-production data that changes the probability of harm without the analysis being revisited under clause 10.

Frequently asked questions

When is a benefit-risk analysis required under ISO 14971?
Under clause 7.4, when an individual residual risk is not acceptable by the risk management plan’s criteria and further risk control is not practicable; and under clause 8, when the overall residual risk is not acceptable by the plan’s method and criteria. Under EU MDR, in practice for every device, because Annex I makes acceptability a benefit-risk judgement.

What counts as a benefit?
ISO 14971:2019 clause 3.2: a positive impact or desirable outcome of the use of a medical device on the health of an individual, or a positive impact on patient management or public health — characterised by type, magnitude, probability and duration for the intended population.

Can a benefit-risk analysis make an unacceptable risk acceptable?
Yes, that is its function — but only where the evidence shows the benefits of the intended use outweigh the residual risk; if they do not, clause 7.4 states the risk remains unacceptable. The risk is then disclosed as a significant residual risk.

How does EU MDR change the analysis?
MDR requires risks to be reduced as far as possible and acceptable when weighed against benefits, with the clinical evaluation supporting the benefit-risk determination; EN ISO 14971:2019/A11:2021 Annex ZA records where MDR goes beyond the standard’s own acceptability language.

Who performs the analysis?
The risk management team with clinical input, under the responsibilities and authorities the plan assigns; the plan (4.4) must define who is authorised to accept residual risk.

Where this leaves you

Write the benefit-risk analysis as the last step it is: exhaust practicable risk control first, state the residual risk and the intended use precisely, evidence the benefit by type, magnitude, probability and duration against the state of the art, record who weighed it and why, disclose the risk, and reopen the analysis when post-production data moves either side — because under ISO 14971 it is the justified exception to your own criteria, and under MDR it is the test every risk has to pass.

References

• ISO 14971:2019 — Medical devices — Application of risk management to medical devices — Clauses 3.2, 7.3–7.6 and 8.
• ISO/TR 24971:2020 — Guidance on the application of ISO 14971 — Guidance on benefit-risk analysis and overall residual risk.
• Regulation (EU) 2017/745 on medical devices — EUR-Lex — Article 2(24), Article 61, Annex I and Annex XIV.

More on ISO 14971

• Benefit-risk analysis — you are here
• ISO 14971: the risk management file and where files break
• Risk acceptability criteria and the matrix
• The ISO 14971 risk management plan
• Post-production information under ISO 14971
• ISO/TR 24971: the guidance

The benefit-risk analysis template, the overall residual risk evaluation record, the risk management report and the significant residual risk disclosure register are in the ISO 14971 Toolkit, or start with the free templates.