Two ISO standards. One regulation. Distinct purposes.
ISO 31000 sets the universal grammar for enterprise risk management. ISO 14971 prescribes a lifecycle process specific to medical devices. FDA 21 CFR Part 117 is binding U.S. law for human food. Each answers a different question — and each demands a different evidentiary footprint.
STANDARD 01 — ISO 31000
Risk Management — Guidelines · 2018
A non-certifiable, guidance-based standard issued by the International Organization for Standardization. ISO 31000 establishes a universal vocabulary, set of principles, framework, and process for managing risk across any organization — regardless of size, sector, or activity.
The 2018 revision deliberately shortened the document to emphasize integration with strategy and decision-making. It treats risk as “the effect of uncertainty on objectives” and applies equally to financial, operational, strategic, reputational, and compliance risk.
| Type | Scope | Core Output | Authority |
|---|---|---|---|
|
Guideline • Non-certifiable |
Enterprise-wide | ERM Framework | ISO (Voluntary) |
STANDARD 02 — ISO 14971
Medical Devices — Risk Management · 2019
The international standard specifying terminology, principles, and a full lifecycle process for risk management of medical devices, including software as a medical device (SaMD) and in vitro diagnostics (IVDs). The 2019 third edition strengthened requirements around benefit-risk analysis, production and post-production activity, and overall residual risk.
Recognized by the U.S. FDA and harmonized with EU MDR/IVDR via EN ISO 14971:2019/A11:2021. Companion guidance is provided in ISO/TR 24971:2020.
| Type | Scope | Core Output | Authority |
|---|---|---|---|
| Requirement Standard | Medical Devices • IVD • SaMD | Risk Management File | FDA-recognized • EU MDR |
Risk is now at the center of every FDA quality system
FDA expects risk-based decisions in every regulated industry. For devices, the QMSR brings ISO 13485’s risk requirements into law. Drug makers apply ICH Q9(R1). Food facilities build their food safety plans on hazard analysis. JJCC Group builds the program and the file that proves it.
ISO 31000 REQUIREMENTS — GUIDANCE
01
Medical devices
ISO 14971:2019 (with ISO/TR 24971:2020), required in practice by ISO 13485 and the QMSR
02
Drugs and biologics
ICH Q9(R1) quality risk management, with Parts 210/211
03
Food
Part 117 hazard analysis and risk-based preventive controls; HACCP for juice and seafood
04
Dietary supplements
Part 111 controls, with risk-based supplier and testing decisions
05
Tobacco
Health risk assessments for PMTAs; process risk for manufacturing
06
Enterprise risk
ISO 31000:2018 (voluntary, any organization)
ISO 14971 REQUIREMENTS — PRESCRIPTIVE
01
Risk management process
A documented, top-management-approved process applied across the entire device lifecycle.
02
Risk management plan
Per-device plan covering scope, responsibilities, acceptability criteria, verification activities, and post-production information collection.
03
Risk analysis
Intended use, reasonably foreseeable misuse, hazard identification, hazardous situation identification, and risk estimation.
04
Risk evaluation & control
Compare estimated risk against acceptability criteria; apply control measures in order — inherent safety by design, protective measures, information for safety.
05
Residual & overall residual risk
Evaluate every residual risk and the overall residual risk against benefit; document the benefit-risk determination.
06
Production & post-production
Systematically collect and review information from production, the supply chain, users, complaints, and the state of the art; feed it back into the file.
07
Risk Management File & Report
Maintain a traceable file containing every artefact; produce a Risk Management Report prior to release of the device.
ISO 31000 · ISO 14971 · 21 CFR 117.
COMPARISON
Three frameworks, three different legal weights, three different hazard models. Side by side, the contrasts make implementation choices easier — and reveal where the requirements overlap.
| Attribute | ISO 31000:2018 | ISO 14971:2019 | 21 CFR Part 117 (FSMA) |
|---|---|---|---|
| Legal status | Voluntary guideline. Not certifiable. No third-party audit. | Voluntary standard, but FDA-recognized consensus standard and required by EU MDR/IVDR. | Federal regulation. Mandatory for covered facilities. Enforced by FDA inspection. |
| Risk concept | “Effect of uncertainty on objectives” — strategic, operational, financial, reputational. | Combination of probability of harm × severity of harm to patient, user, or environment. | Known or reasonably foreseeable biological, chemical, physical, radiological hazards in food. |
| Hazard analysis methodology | Generic; tools chosen by organization (SWOT, bowtie, FMEA, scenario analysis). | Structured: intended use, hazards, hazardous situations, sequence of events, harm. | HACCP-derived: hazard ID, evaluation, preventive controls, monitoring, corrective action, verification. |
| Required output | Framework, policy, process records—format at the organization’s discretion. | Risk Management Plan, Risk Management File, Risk Management Report. | Written Food Safety Plan signed by owner/operator; monitoring & verification records. |
| Qualified personnel | Competent staff; no formal credential specified. | Persons with appropriate knowledge & experience; risk management responsibility defined. | Preventive Controls Qualified Individual (PCQI) — FSPCA-recognized training or equivalent. |
| Record retention | Not specified; per organization’s own procedures. | Throughout device lifecycle plus post-market surveillance period. | Minimum 2 years on-site; reasonably accessible for FDA inspection. |
| Audit consequence | Reputational; no penalty for non-conformance. | Loss of CE mark, FDA 483 observations, market access blocked. | FDA 483, warning letters, civil penalties, injunction, criminal referral. |
| Lifecycle scope | Organizational lifecycle; ongoing review. | Concept → design → production → post-market → end-of-life. | Receiving → processing → packaging → storage → distribution; reanalysis every 3 years. |
Which standard for which industry?
A direct mapping of the five FDA-regulated sectors most often asked about — drugs, medical devices, dietary supplements, food, and tobacco — and the standards each is expected, or required, to comply with.
Drugs & Pharmaceuticals
Regulated under 21 CFR 210/211 (cGMP) & ICH Q9. ISO 31000 informs enterprise risk; 14971 generally does not apply unless combination product.
- ISO 31000 (ERM)
- ICH Q9 (Quality Risk)
- 21 CFR 117 (excluded)
Medical Devices
ISO 14971 is the de facto global expectation. Required for CE mark; FDA recognizes it as consensus standard for premarket submissions.
- ISO 14971 (required)
- ISO 13485 (QMS)
- ISO 31000 (ERM)
Dietary Supplements
Primarily 21 CFR 111 (cGMP for Dietary Supplements); facilities also doing food-related activities fall under 21 CFR 117 hazard analysis.
- 21 CFR 111 (cGMP)
- 21 CFR 117 (where applicable)
- ISO 31000 (ERM)
Food (Human)
21 CFR Part 117 is mandatory: written Food Safety Plan, hazard analysis, preventive controls, supplier verification, recall plan, PCQI.
- 21 CFR 117 (required)
- FSSC 22000 / SQF / BRCGS
- ISO 31000 (ERM)
Tobacco
Regulated under Family Smoking Prevention & Tobacco Control Act and 21 CFR 1100–1143. Not under 117. ISO 31000 used for enterprise risk and PMTA submissions.
- 21 CFR 117 (n/a)
- 21 CFR 1100–1143
- ISO 31000 (ERM)
A four-phase path to defensible compliance.
Whichever framework applies, the implementation rhythm is consistent: establish context, identify and analyze, treat and document, monitor and improve.
01
Establish context:
scope, criteria and risk acceptability policy.
02
Identify and analyze:
hazards, hazardous situations, severity and probability.
03
Control and document:
risk controls, verification and residual risk.
04
Monitor and improve:
postmarket and production data feed back into the file.
The documents that prove compliance.
Auditors and inspectors do not assess intent — they assess records. Below: the documents every organization should be prepared to produce, organized by framework.
For ISO 31000
Framework • Voluntary- Risk Management Policy approved by top management
- Risk Management Framework document
- Organizational context analysis (PESTEL / stakeholder map)
- Risk appetite & tolerance statement
- Risk criteria and evaluation matrix
- Risk register with owners and treatments
- Risk treatment plans
- Roles, responsibilities & authority matrix
- Communication & consultation records
- Monitoring, review & KRI reports
- Management review minutes
- Training & competence records
For ISO 14971
Risk Management File- Risk Management Plan (per device)
- Intended use & reasonably foreseeable misuse statement
- Hazard, hazardous situation & harm list
- Risk analysis records (FMEA / FTA / etc.)
- Risk evaluation against acceptability criteria
- Risk control measures & verification of effectiveness
- Residual risk evaluation & benefit-risk analysis
- Overall residual risk evaluation
- Risk Management Report (pre-release)
- Production & post-production information procedures
- Cybersecurity risk records (per Annex F, ISO/TR 24971)
- Change-control linked risk reassessments
For 21 CFR 117
Food Safety Plan- Written Food Safety Plan signed & dated by owner/operator
- Hazard analysis (biological, chemical, physical, radiological)
- Process, food allergen, sanitation & supply-chain controls
- Monitoring procedures & monitoring records
- Corrective action procedures & records
- Verification & validation activities
- Supplier approval & verification records
- Recall plan
- Environmental monitoring records (where applicable)
- PCQI training certificates & employee training records
- Reanalysis of the Food Safety Plan (≤3 years)
- All records retained ≥2 years, on-site or reasonably accessible
From the first gap assessment to the moment your inspector signs off.
JJCC Group provides end-to-end risk management and regulatory compliance services across all three frameworks. We work with FDA-regulated manufacturers, importers, processors, and emerging brands — building the documents, training the people, and standing beside you during audits and inspections.
001 — Gap Assessment
Regulatory Diagnostic
A structured gap analysis against ISO 31000, ISO 14971, 21 CFR 117, 21 CFR 111, and parallel international standards. We deliver a quantified findings register, prioritized remediation plan, and executive-ready briefing within four to six weeks.
002 — Framework Build
Risk Management System Design
Custom-built ERM frameworks (ISO 31000), device-specific Risk Management Files (ISO 14971), and Food Safety Plans (21 CFR 117) — written, version-controlled, signed-off, and ready to defend under inspection.
003 — Hazard Analysis
HACCP & Preventive Controls
End-to-end hazard analysis delivered by qualified specialists, including PCQI-led food safety hazard analysis, FMEA and FTA for devices, and integrated enterprise-level risk assessments for boards and executives.
004 — Documentation
Document & Record Architecture
We author every document the standard expects — policies, plans, registers, SOPs, monitoring forms, validation protocols, training matrices — and structure them inside a controlled document system that survives turnover and audit.
005 — Training
PCQI & Risk Management Training
Role-based training programs for PCQI, HACCP teams, risk owners, internal auditors, and executive leadership. FSPCA-aligned curricula, ISO 14971/24971 deep-dives, and tailored workshops for cross-functional teams.
006 — Audit & Inspection
Mock Audits & FDA Readiness
Mock FDA inspections, supplier audits, notified-body readiness reviews, and on-site representation. We rehearse your team for the questions that will be asked — and the records that will be demanded.
007 — Post-Market
Surveillance & Continuous Improvement
Post-production information collection, complaint trending, CAPA management, environmental monitoring programs, and structured periodic reanalysis — keeping your risk file alive instead of frozen at release.
008 — Integration
Multi-Standard Harmonization
For organizations subject to more than one framework (a combination product manufacturer; a food and supplement co-packer), we design a single, harmonized risk management system that satisfies every applicable standard without redundant work.
009 — Advisory
Fractional Risk & Quality Leadership
Embedded fractional Quality, Risk, and Regulatory leadership for emerging companies — a senior practitioner at the table during the months when full-time hire isn't yet justified but expert decisions still must be made.
Let's build the file
before the inspector asks for it.
Risk management plan · Hazard analysis · FMEA (design, process, use) · Risk management report · Benefit-risk analysis · Food safety plan hazard analysis · Risk procedures and training
Testimonial
What our clients say about JJCC
Professional, knowledgeable team guided us through FDA registration and complete product listing accurately and efficiently.
Risk Management Standards. The questions, answered.
Have a different question?
We probably have an answer.
JJCC Group works with FDA-regulated manufacturers, importers, and emerging brands on ISO 31000, ISO 14971, and 21 CFR Part 117 compliance — from first gap assessment to inspector sign-off.
