ISO 14971 vs FMEA
The risk-management standard vs one analysis tool used within it.
What a comparison is not
A comparison is SPEQ’s reading of how two published documents differ. Neither is the right answer, it is not a determination of which applies to you, and neither is summarised in a way that replaces reading it.
ISO 14971 is the standard for the medical-device risk-management process — a complete lifecycle from risk analysis through evaluation, control, residual-risk evaluation, and post-production monitoring, with defined benefit-risk criteria. FMEA is one analysis technique that can support parts of that process. Treating FMEA as if it were the whole of risk management is a common and consequential mistake.
| ASPECT | ISO 14971 | FMEA |
|---|---|---|
| What it is | A complete risk-management process (standard) | A bottom-up failure-analysis tool |
| Scope | Whole lifecycle: analysis → control → residual → monitoring | Identifying failure modes and their effects |
| Hazard focus | Hazards, hazardous situations, harm; benefit-risk | Component/process failure modes |
| Top-down vs bottom-up | Requires hazard-driven (top-down) thinking too | Bottom-up (starts from failures) |
| Relationship | The governing process | One tool that may feed it |
Follow ISO 14971 as the governing risk-management process for a medical device — it requires hazard identification, risk evaluation against defined criteria, control, residual-risk and benefit-risk evaluation, and post-production monitoring.
Use FMEA as one supporting tool within that process — useful for systematically analysing failure modes, but not a substitute for the top-down, hazard-driven analysis and benefit-risk evaluation ISO 14971 requires.
ISO 14971 is the process; FMEA is a tool. FMEA is bottom-up (starts from failures) and can miss hazards that do not stem from a component failure, and it does not by itself deliver the benefit-risk conclusion or residual-risk evaluation ISO 14971 requires. Use FMEA to support the analysis, but run the full ISO 14971 process — a risk file built only on an FMEA is a frequent finding.
ISO 14971 vs FMEA: frequently asked questions
Common questions on how ISO 14971 and FMEA differ and when each applies.
Is FMEA the same as ISO 14971 risk management?
No. ISO 14971 is the complete device risk-management process (hazard analysis, risk evaluation, control, residual-risk and benefit-risk evaluation, post-production monitoring). FMEA is one bottom-up analysis tool that can support parts of it but does not fulfil the whole process on its own.
Why is FMEA alone insufficient for ISO 14971?
Because FMEA is bottom-up — it starts from component or process failures and can miss hazards that do not arise from a discrete failure (e.g., use error, foreseeable misuse). It also does not deliver the top-down hazard analysis, benefit-risk conclusion, or residual-risk evaluation ISO 14971 requires.
Can I use FMEA within ISO 14971?
Yes — FMEA is a legitimate, widely used tool to support risk analysis within an ISO 14971 process. The key is that it supplements, rather than replaces, the standard’s full requirements, including hazard-driven analysis and overall benefit-risk evaluation.