ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
A hazardous situation is the term in ISO 14971:2019 that most risk management files get wrong, because it sits between two words everyone thinks they already understand. Clause 3.4 defines a hazard as a potential source of harm; clause 3.3 defines harm as injury or damage to the health of people, or damage to property or the environment; and clause 3.5 defines a hazardous situation as a circumstance in which people, property or the environment is exposed to one or more hazards. The three are linked by a sequence of events — the chain of things that has to happen for a hazard to become an exposure and an exposure to become an injury — and Annex C of the standard exists to explain the relationship. Getting it right decides whether the risk analysis is analysable at all: probability is estimated for the exposure and for the harm, not for the hazard; risk controls act on the sequence of events; and clause 4.5 requires the file to trace every identified exposure to its analysis, evaluation, controls and residual risk. This guide sets out the three definitions with the standard’s own logic, the sequence-of-events model with worked examples, how the model drives risk estimation and control, the errors that collapse the three terms into one, and how to write the hazard analysis worksheet so a reviewer can follow it.
| Term | ISO 14971:2019 definition | What it is in practice | What it is not |
|---|---|---|---|
| Hazard (3.4) | Potential source of harm | Energy, a substance, a biological agent, a function, a piece of information — something that can hurt someone if they are exposed to it | A failure mode, a cause, an event |
| Hazardous situation (3.5) | Circumstance in which people, property or the environment is exposed to one or more hazards | The state of affairs at the moment exposure occurs — a patient connected to a device delivering the wrong dose; a user touching a live conductor | The hazard itself; the eventual injury |
| Harm (3.3) | Injury or damage to the health of people, or damage to property or the environment | The clinical outcome — burn, infection, overdose, delayed treatment, death | A device malfunction; a complaint |
A hazard is always present in a device that has it — a battery is an energy hazard whether or not anything goes wrong. The situation is the circumstance that exposes someone to it; the harm is what the exposure does. Our guide to the ISO 14971 risk management file covers where this distinction breaks files.
Between hazard and exposure lies a sequence of events — one or more — that has to occur; between exposure and harm lies another that decides whether exposure results in injury and how severe. Annex C of the standard sets this out, and ISO/TR 24971 clause 5 builds the probability estimate on it: P1 is the probability that the exposure occurs (the first sequence), P2 the probability that it leads to harm (the second), and the probability of harm is their product.
| Hazard | Sequence of events | Hazardous situation | Harm | Severity |
|---|---|---|---|---|
| Electrical energy | Insulation degrades over lifetime → protective earth connection lost → user touches enclosure during use | User in contact with an energised enclosure | Electric shock; burn; ventricular fibrillation | Serious to catastrophic |
| Infusion pump software (dose calculation) | Unit-conversion defect in firmware → clinician enters weight in pounds → software treats it as kilograms | Patient receiving 2.2 × the intended dose | Overdose; organ toxicity | Critical |
| Biological — microorganisms | Reusable instrument reprocessing instruction ambiguous → inadequate cleaning → residual bioburden → sterilisation ineffective | Patient tissue in contact with a contaminated instrument | Infection | Serious |
| Information — incorrect diagnostic result | Reagent lot degraded in storage → calibration passes on stale calibrator → false negative | Clinician acting on an incorrect result | Delayed treatment; disease progression | Critical |
| Mechanical — moving parts | Guard removed for cleaning → interlock defeated → device restarted | User’s hand in the path of a moving component | Crush injury; amputation | Critical |
The same hazard produces different exposures by different sequences, and the same exposure can lead to different harms of different severities — which is why the worksheet lists hazardous situations, not hazards, as its unit of analysis. Annex A of ISO/TR 24971 gives the question list for finding the hazards and the characteristics related to safety that start these sequences; our guide to ISO/TR 24971 covers the guidance.
| Process step | Which element it acts on | Consequence |
|---|---|---|
| 5.4 Hazard identification | Hazards and hazardous situations, via reasonably foreseeable sequences of events | The worksheet needs a row per exposure, with its sequence |
| 5.5 Risk estimation | P1 for the exposure, P2 for the harm, severity of the harm | Probability is never estimated for a hazard; a hazard has no probability |
| 6 Risk evaluation | The estimated risk per exposure against the plan’s criteria | Acceptability is judged per exposure-and-harm pair |
| 7.1 Risk control option analysis | The sequence of events: inherently safe design removes the hazard or breaks the first sequence; protective measures break the first or second; information for safety acts on the second | The control’s effect is stated as a change to P1, P2 or severity |
| 7.5 Risks arising from controls | New hazards or new sequences introduced by a control | A new row, not a footnote |
| 4.5 File traceability | Every identified hazardous situation | The trace runs from the exposure, not from the hazard or the failure mode |
| 10 Post-production | New hazards, new sequences, changed P1 or P2, changed severity | Field data updates the sequence model |
Our guide to risk acceptability criteria covers the scales P1, P2 and severity are scored against.
| Column | Content | Source |
|---|---|---|
| ID | Unique per exposure row | File traceability (4.5) |
| Hazard | From the Annex A question list and the characteristics related to safety | 5.3, 5.4 |
| Initiating cause and sequence of events | The reasonably foreseeable chain, including use error | 5.4; IEC 62366-1; FMEA outputs |
| Hazardous situation | The exposure, stated as a circumstance | 5.4 |
| Harm and severity | The injury and its severity level from the plan’s scale | 5.5 |
| P1, P2, probability of harm | Estimated with the plan’s units and sources | 5.5; ISO/TR 24971 clause 5 |
| Risk and evaluation | Against the plan’s criteria | 6 |
| Risk control measures | Each one, with the element it changes (P1, P2, severity) and its priority class | 7.1 |
| Verification of implementation and effectiveness | Reference to the evidence | 7.2 |
| Residual risk and evaluation | P1, P2, severity after control; acceptability; benefit-risk reference if used | 7.3, 7.4 |
| New risks from the control | Cross-reference to the new row | 7.5 |
| Disclosure | Whether a significant residual risk is communicated in the accompanying documentation | 8 |
Our guide to benefit-risk analysis covers the column that is filled in when the residual risk still fails the criteria.
What is a hazardous situation in ISO 14971?
Clause 3.5: a circumstance in which people, property or the environment is exposed to one or more hazards — the moment of exposure, reached by a sequence of events from the hazard, and from which a further sequence leads to harm. Probability is estimated for the exposure (P1) and for harm following it (P2).
What is the difference between a hazard and a hazardous situation?
A hazard is a potential source of harm — energy, a substance, information — that is always present; the situation is the circumstance that exposes someone to it. Electrical energy is a hazard; a user touching an energised enclosure is the exposure; electric shock is the harm.
Where does the sequence of events fit?
Between hazard and exposure, and between exposure and harm. ISO 14971:2019 Annex C explains the relationship; ISO/TR 24971 builds the P1 × P2 probability estimate on it, and risk controls are described by which part of the sequence they break.
Is a failure mode a hazard?
No. A failure mode is a cause in a sequence of events. FMEA outputs feed the hazard analysis but do not replace it; the file must identify hazards and exposures and trace from the exposure.
Does every exposure have to be traceable?
Yes. Clause 4.5 requires the risk management file to provide traceability for each identified hazardous situation to the risk analysis, risk evaluation, implementation and verification of risk control measures, and the residual risk evaluation.
Build the hazard analysis on the hazardous situation: find the hazards with the Annex A questions, construct the reasonably foreseeable sequences of events including use error, state each exposure as a circumstance, estimate P1 and P2 and the severity of the harm, and describe every control by which element it changes — because the file is traced from the exposure, probability belongs to it and not to the hazard, and a worksheet that collapses the three terms cannot be verified, controlled or defended.
The hazard analysis worksheet with the sequence-of-events, P1 × P2 and control-effect columns, the hazard identification checklist, the risk control verification record and the traceability matrix are in the ISO 14971 Toolkit, or start with the free templates.
September 21, 2026
September 20, 2026
September 20, 2026
September 19, 2026
September 19, 2026