This article provides an example of how to manage a compliant risk management system. In this example, we're going to consider a product that is comprised of:
2 devices; and
1 accessory.
Each device and accessory needs to be subject to risk management.
A risk management process may be implemented for each device/accessory, and cycles of risk management will need to occur throughout its lifetime.
For each cycle of risk management, one or more risk analyses may be conducted:
For each risk analysis, new risks may be identified for which new risk controls are required. Each risk analysis concludes with an evaluation of the overall residual risk (of the device or accessory), to check it is still acceptable.
As always, we aim to ensure you have the means to provide the necessary data to demonstrate a compliant risk management system. Specifically, we want:
to make risk management more accessible and understandable;
to provide clarity on the data required to implement and maintain a compliant risk management system;
to enable you to conduct cycles of risk management per device or accessory (or feature!); and
to enable you to conduct cycles of risk management for specific lifecycle stages.