Failure Modes and Effects Analysis (FMEA) is a systematic method used to identify potential failure modes, their underlying causes, and resulting effects within a product, process, or system. IEC 60812:2018 describes how FMEA is planned, performed, documented, and maintained.
A Hazard Analysis or Risk Analysis is a complementary tool used to map identified hazards through their associated risk control measures, verification activities, and assessments of residual risk. The Hazard Analysis methodology aligns with ISO 14971:2019, the international standard of medical device risk management, which emphasizes comprehensive and traceable risk control throughout the product lifecycle.
FMEA and Hazard Analysis differ in purpose, structure, and application. FMEA is a bottom-up technique focused on analyzing component-level failures and quantifying risk using Severity, Occurrence, and Detection scores. In contrast, Hazard Analysis is a top-down documentation framework that maps hazards to mitigations and supports traceability across regulatory documentation. While FMEA enhances reliability by identifying potential failures early, Hazard Analysis ensures product safety and compliance by demonstrating that all hazards are addressed and properly controlled.
ISO 14971 plays a foundational role in risk management for medical devices, mandating structured and traceable documentation of all risk-related activities. FMEA and Hazard Analysis have a complementary relationship within this framework. FMEA systematically identifies and prioritizes potential failure modes and their associated risks, while Hazard Analysis ensures that identified hazards are effectively mitigated, verified, and traceably documented. Together, FMEA and Hazard Analysis support full compliance with ISO 14971 throughout the product lifecycle.
Quality Management System (QMS) software simplifies and centralizes risk management by embedding tools like FMEA and Hazard Analysis into broader quality management workflows. By integrating these tools with CAPAs, audits, and change control processes, QMS software creates a continuous improvement framework that enhances traceability, improves efficiency, and supports regulatory compliance.
SimplerQMS is a fully validated cloud-based QMS software designed specifically for the life sciences industry. SimplerQMS offers integrated risk management features aligned with ISO 14971 and other regulatory standards. QMS software streamlines documentation, enhances audit readiness, and centralizes quality processes to improve efficiency and ensure compliance.
Book a free demo to learn how SimplerQMS can support your organization to enhance compliance and operational efficiency.
What is FMEA (Failure Modes and Effects Analysis)?
Failure Modes and Effects Analysis (FMEA) is a systematic methodology used to identify potential failure modes in systems, products, or processes. FMEA helps assess the causes and consequences of these failures to prioritize and reduce risks.
The international standard IEC 60812:2018 defines best practices for planning, performing, documenting, and maintaining FMEA. The standard also includes its extended form, Failure Modes, Effects, and Criticality Analysis (FMECA).
IEC 60812:2018 describes FMEA as a proactive tool to identify potential failures, evaluate their consequences, and support preventive decision-making. Following the methodology outlined in IEC 60812:2018 ensures consistent and reliable failure analysis across industries.
There are five main types of FMEA commonly used in quality management as listed below.
- Design FMEA (DFMEA): Analyzes potential failure modes in a product’s design, such as issues with components, functions, or materials, helping to ensure a more robust and reliable design.
- Process FMEA (PFMEA): Focuses on identifying risks within manufacturing or assembly processes that could negatively impact product quality or lead to production inefficiencies.
- System FMEA (SFMEA): Evaluates complex systems to detect potential failures between subsystems early in the design phase, supporting the development of high-quality, integrated systems.
- Software FMEA (SWFMEA): Targets software-related risks, analyzing coding errors, logic flaws, and interface problems that could affect overall system performance and product quality.
- Service FMEA: Assesses risks within service delivery processes to maintain consistent, high-quality customer experiences and operational excellence.
The FMEA process consists of several key elements that help identify, assess, and mitigate potential failures in products and processes.
- Failure Mode (What Could Go Wrong): A failure mode is a specific way in which a product, system, or process could fail to meet its intended function
- Effect (the Impact of the Failure): The effect describes the outcome or consequence of a failure mode.
- Cause (Why the Failure Might Occur): A cause is an underlying reason for the failure mode, such as design flaws, process variation, or human error.
- Severity (S): Severity measures the seriousness of the failure’s effect.
- Occurrence (O): Occurrence represents how frequently a particular cause of failure is expected to happen.
- Detection (D): Detection refers to the likelihood that the failure will be identified before reaching the end user.
- Risk Priority Number (RPN): RPN is a crucial metric for prioritizing risk mitigation actions.
The goal of FMEA is to identify potential failure modes, trace them to their root causes, and evaluate their possible effects. By systematically identifying and evaluating potential failure modes, FMEA helps organizations identify high-priority risks, implement preventive measures, and improve system reliability.
How to Conduct an FMEA?
Conducting an FMEA involves a methodical, step-by-step approach designed to uncover, assess, and prioritize actions to mitigate risk. The following steps outline the standard FMEA procedure.
- Define the Scope: Identify the product, process, or system that will undergo FMEA analysis. Clearly outlining the scope ensures that the evaluation remains focused and aligned with business or project objectives.
- Build a Cross-Functional Team: Assemble a cross-functional team with expertise in relevant areas such as design, manufacturing, quality, and operations to ensure a comprehensive evaluation.
- Review the Process, Product, or System: Use tools like process flow diagrams or system maps to visualize how the product or process works. Break it down into components or phases for detailed examination.
- Identify Functions and Requirements: Clearly define the intended functions and performance requirements for each product component, system feature, or process step. Understanding what the product or process must achieve helps in identifying critical failure points.
- Identify Potential Failure Modes: For each component or process step, list all possible failure modes. Use brainstorming sessions, historical data, team expertise, and technical documentation to compile a comprehensive and accurate list.
- List the Effects of Each Failure Mode: Determine the consequences of each identified failure mode. Consider impacts on product performance, customer satisfaction, safety, compliance, and operational efficiency.
- Assign Severity Ratings (S): Rate the seriousness of the potential effects for each failure mode, typically on a scale from 1 (least severe) to 10 (most severe). This helps quantify the impact of each failure.
- Determine the Causes of Each Failure Mode: Identify and record the potential causes or contributing factors behind each failure mode. Causes may include human error, material defects, environmental conditions, or machine wear. A clear understanding of possible causes is critical for effective corrective and preventive actions.
- Assign Occurrence (O) Ratings: Estimate the likelihood of each potential cause of failure occurring using a 1-10 scale. A higher rating reflects a greater probability that the cause will lead to failure.
- Identify Existing Controls: Document the existing controls or preventive measures currently in place to detect or prevent each failure mode or its causes. These controls could include inspection procedures, design standards, testing protocols, process monitoring systems, and others.
- Assign Detection (D) Ratings: Evaluate the ability of current controls to detect the failure before it reaches the end user. A rating of 1 indicates high detectability, while a 10 means the failure is unlikely to be detected. Detection ratings highlight the need for better monitoring or preventive measures.
- Calculate the Risk Priority Number (RPN): Multiply the Severity (S), Occurrence (O), and Detection (D) ratings to obtain the Risk Priority Number (RPN = S × O × D). This value helps prioritize the failure modes based on overall risk. The higher the RPN, the more urgent the need for action.
- Prioritize Actions Based on RPN: Rank the failure modes by their RPN and determine which ones demand immediate action. Focus on addressing failure modes with the highest RPN values first to reduce the most critical risks.
- Implement Risk Mitigation Actions: Develop and implement corrective or preventive actions aimed at reducing the Severity (S), Occurrence (O), or Detection (D) scores. Assign responsibility for each action, establish deadlines, and document progress to ensure accountability and effective follow-up.
- Re-evaluate and Update the FMEA: After implementing changes, re-evaluate the affected failure modes by updating their S, O, and D ratings. Keep the FMEA document current to reflect design updates, process improvements, and any newly identified failures. Regular updates ensure that the FMEA remains an effective, living document for proactive risk management.
When to Use FMEA?
FMEA should be used both proactively and reactively. Proactively, FMEA is used during design, development, and process planning to prevent risks. Reactively, FMEA is used after failures to analyze causes and improve existing processes.
FMEA plays a critical role in regulated industries like life sciences, to ensure risk control and patient safety. For example, a medical device manufacturer developing a wearable glucose monitor may use Design FMEA to address potential risks such as sensor errors, battery failure, or disrupted data transmission to a patient’s smartphone.
What is the Hazard Analysis?
Risk Analysis or Hazard Analysis is a structured tool used to document and track the relationships between identified hazards, control measures, verification activities, and residual risks. Hazard Analysis plays a vital role in compliant risk management processes, particularly in the medical device and life sciences industries, where regulatory compliance and patient safety are critical.
The international standard ISO 14971:2019 provides a framework for applying risk management to medical devices, and the Hazard Analysis aligns closely with its principles. The ISO 14971:2019 standard emphasizes a systematic approach to identifying hazards, assessing associated risks, implementing control measures, and evaluating residual risks. As part of this approach, the standard requires clear traceability among risk-related elements, making the Hazard Analysis an essential component of compliant documentation and decision-making processes.
A typical Hazard Analysis includes several key elements as listed below.
- Identified Hazard: The potential source of harm.
- Hazardous Situation: The circumstances in which people, property, or the environment are exposed to one or more hazards.
- Potential Harm: The possible injury or damage that could result from the hazardous situation.
- Control Measures: Actions implemented to eliminate or reduce the risk associated with the hazard.
- Verification Methods: Techniques or procedures used to confirm the effectiveness of the control measures.
- Residual Risk: The remaining risk after control measures have been applied.
- Supporting Documentation: References such as design inputs, testing protocols, and clinical evaluations that provide traceability throughout the risk management process.
The primary objective of the Hazard Analysis is to provide full visibility and control over risk-related information. Hazard Analysis provides an auditable trail from hazard identification to risk resolution, supporting regulatory compliance and enhancing product safety. Furthermore, it facilitates cross-functional collaboration among teams and improves the efficiency and accuracy of the risk management process.
As products evolve or regulations change, the matrix helps teams quickly identify impacted areas and ensure that appropriate mitigations are in place.
How to Build a Hazard Analysis Matrix?
Building a Hazard Analysis Matrix requires a systematic approach to ensure complete traceability from hazard identification through to verification and final disposition.
To build a Hazard Analysis Matrix follow the steps below.
- Define the Objective and Scope: Clearly establish the purpose of the matrix. Define the system, product, or process being analyzed, along with the boundaries and lifecycle stages the matrix will cover.
- Identify Hazards: Gather all relevant hazard information from sources such as hazard analyses, failure studies, regulatory guidance, and lessons learned from previous projects. Document each hazard that could lead to a hazardous situation or cause harm to users, patients, or the environment.
- Assign Unique Hazard IDs: Allocate a distinct identifier for every hazard. Unique IDs improve traceability, avoid duplication, and facilitate clear referencing during cross-functional reviews and audits.
- Describe Hazards and Analyse Risk: Provide a clear, concise description of each hazard. For each hazard analyze risk by evaluating the severity of potential harm and the likelihood of occurrence. This sequence helps prioritize hazards and determine the level of control effort required.
- Link to Risk Controls and Requirements: Connect each hazard to specific safety requirements, design control or procedural safeguard intended to mitigate the risk. These controls may include design specifications, engineering controls, software safeguards, alarms, protective barriers, or documented procedures.
- Map to Verification Activities: Identify the methods used to verify that risk control measures have been implemented and are effective. For instance, design verification, design validation, process, and test method qualifications are examples of methods that may be used to confirm control measures have been implemented correctly and are effective.
- Track Mitigation Status and Ownership: Record the implementation status of each mitigation action (planned, in progress, or completed) and assign a responsible owner for each task. This ensures accountability and facilitates follow-up during design reviews or audits.
- Structure the Matrix for Clarity: The Matrix needs to be structured using a clear tabular format and includes consistent column headers.
- Maintain and Update Regularly: Keep the matrix up to date by revisiting it whenever new hazards are identified, design or process changes occur, post-market data reveals new risks or the status of mitigation and verification activities evolve. Treat the matrix as a living document that accurately reflects the current state of the product’s risk profile.
- Conduct Periodic Reviews and Audits: Review the matrix at defined intervals or during formal design reviews to identify gaps, verify traceability, and confirm that all hazards are properly managed. Periodic audits reinforce regulatory compliance and overall product safety.
The table below shows the tabular format of the matrix structure used for risk analysis.
| Hazard ID | Hazard (source of harm) | Hazardous situation (cause) | Harm | Unmitigated | Control measures | Verification of control measures | Mitigated | Risk Management activity | ||||
| Severity | Probability | Risk Level | Severity | Probability | Residual Risk level | |||||||
| Blood Glucose meter_001 | Inaccurate glucose reading | The device gives incorrect readings due to sensor error or test strip defect | An incorrect insulin dose was administered | 5- critical | 3 – Possible | High | Calibration checks, strip quality assurance, internal QC algorithms | An incorrect insulin dose administered | 3 – Moderate | 1 – Rare | Medium | Design verification and supplier controls |
| Infusion Pump_004 | Occlusion in tubing | Tubing is kinked or blocked during infusion. | Underdosing patient | 4 – Major | 3 – Possible | High | The pressure sensor detects occlusion; an alert is triggered. | Alarm test protocol; sensor calibration | 2 – Minor | 1 – Rare | Low | Design verification and alarm validation |
When to Use Hazard Analysis?
A Hazard Analysis should be used throughout the product lifecycle. Hazard Analysis systematically links identified hazards to corresponding risk controls, verification activities, and residual risk assessments. Hazard Analysis is especially valuable in life sciences, particularly in the medical device industry, during the design and development phases to ensure compliance with standards like ISO 14971.
For example, a company manufacturing a digital thermometer may use a Hazard Analysis to trace the hazard of incorrect temperature readings to a risk control such as sensor calibration and verify the control through routine accuracy testing. However, a Hazard Analysis alone is not sufficient for full risk management. It should be complemented by additional documentation such as clinical evaluations, usability testing, and benefit-risk analysis to fully comply with regulatory requirements.
What Are the Key Differences Between FMEA and Hazard Analysis?
The key differences between FMEA and Hazard Analysis lie in a range of factors including their purpose, scope, structure, risk assessment methodology, regulatory role, and application throughout the product lifecycle. Understanding these differences is essential for effective risk management in life science industries such as medical devices, pharmaceuticals, and biotechnology.
1. Purpose and Scope
FMEA is a bottom-up risk assessment method aimed at identifying potential failure modes at the component or process level. FMEA assesses how these failures impact system performance and reliability.
Hazard Analysis is a top-down risk management tool. It focuses on documenting and assessing known hazards and tracing them to corresponding risk controls, implementation actions, verification activities, and residual risks.
For instance, in the case of a defibrillator, FMEA would examine what happens if a capacitor fails and how it impacts device function. Hazard Analysis would document the hazard of “unintended shock” and connect it to a design control (e.g., a lockout mechanism) along with the test verification that confirms its implementation and effectiveness.
2. Document Structure and Focus
FMEA is typically presented in a tabular format organized by components or process steps. It includes columns for potential failure modes, causes, effects, severity, occurrence, detection ratings, and the calculated Risk Priority Number (RPN).
Hazard Analysis is structured around hazard traceability. It links each identified hazard to associated design inputs, risk controls, implementation actions, and verification results, ensuring full traceability and documentation throughout the risk management process.
For example, an FMEA table for a pump may list “seal leakage” as a failure mode. The Hazard Analysis would trace the broader hazard of “fluid leakage” to specific design controls such as seal material selection and link them to verification testing.
3. Risk Assessment Methodology
FMEA uses a quantitative approach, assigning severity, occurrence, and detection scores to calculate an RPN. This score prioritizes risks for mitigation.
Hazard Analysis determines the risk level for hazards based on severity and probability of harm emphasizing the completeness and traceability of risk control implementation and effectiveness.
For example, FMEA might identify “battery failure” as a high-priority risk based on its RPN score, focusing on the likelihood of component-level failure and its detectability. In contrast, a Hazard Analysis would address the broader hazard of “power loss,” which could result from battery failure, power supply interruptions, or software errors.
Hazard Analysis evaluates the probability and severity of hazardous situations stemming from such events to determine overall risk. It also documents applicable risk controls and their verification evidence, ensuring traceability across the device lifecycle.
4. Standards and Regulatory Context
FMEA is governed by IEC 60812:2018, which offers a guideline for analyzing failure modes and effects.
Hazard Analysis aligns with ISO 14971:2019 emphasizing comprehensive hazard identification, risk assessment, control implementation, and residual risk verification in medical device risk management.
During product development, the team may follow IEC 60812 for performing FMEA and use ISO 14971 to structure and maintain the Hazard Analysis for audit readiness.
5. Focus on Harm vs. System Performance
FMEA focuses on the impact of failure modes on system functionality, reliability, and performance.
Hazard Analysis evaluates risks based on their potential to cause harm to patients, users, or the environment, consistent with ISO 14971’s safety-oriented approach.
For instance, FMEA might examine the effect of a software glitch on the device’s output while Hazard Analysis would assess whether that glitch could lead to a hazard, such as incorrect dosage delivery, posing a patient safety risk.
6. Application in Life Sciences
Both FMEA and Hazard Analysis are extensively used across medical devices, pharmaceuticals, biotech, and in-vitro diagnostics to proactively manage risks and demonstrate regulatory compliance.
FMEA helps identify design and process-related failure modes, improving product reliability and patient safety.
Hazard Analysis ensures compliance with standards like ISO 14971 by linking hazards to control measures and verification activities for full traceability.
For example, in a pharmaceutical cleanroom, FMEA may identify the risk of HEPA filter failure, assessing the causes (e.g. degradation) and effects (e.g. reduced filtration efficiency). Hazard Analysis would trace the hazard “microbial contamination” to risk controls such as environmental monitoring, validated filter performance tests, and preventive maintenance. Hazard Analysis would verify the implementation and effectiveness of these controls to ensure patient safety.
7. Use in Compliance and Audits
FMEA supports internal decision-making and serves as supplementary evidence in risk management files.
Hazard Analysis is often a primary document in audits, providing detailed traceability and compliance proof per ISO 14971 standards.
During an ISO 13485 inspection, for instance, auditors may request the Hazard Analysis to verify comprehensive hazard management, while the FMEA may be reviewed to provide deeper insights into component-level failure modes and associated risk controls.
What Is the Relationship Between FMEA and the Hazard Analysis?
FMEA and Hazard Analysis are complementary tools in risk management. FMEA is used to systematically identify potential failure modes in a product or process and assess their impact. Hazard Analysis, on the other hand, links identified hazards to corresponding risk control measures, verification activities, and residual risks. Together, they provide a structured traceability across the risk management process.
In the context of medical device risk management, the relationship between FMEA and Hazard Analysis is both complementary and sequential. FMEA is typically conducted early in the development process to identify potential failure modes, assess their causes and effects, and prioritize them based on risk. The findings from FMEA often serve as input for populating the Hazard Analysis. The Hazard Analysis, in turn, takes a broader view—connecting each identified hazard to its risk control measures, verification steps, and residual risks. This traceability ensures that every hazard is addressed and mitigation efforts are documented and validated.
Together, FMEA and Hazard Analysis support compliance with ISO 14971, which requires a structured and traceable risk management process throughout the device lifecycle. By integrating FMEA into the Hazard Analysis, medical device manufacturers ensure both a detailed analysis of component-level risks and full traceability of safety measures at the system level. This approach demonstrates that the device is safe and effective for its intended use.
What Is the Role of QMS Software in Supporting Risk Management?
QMS software plays an essential role in supporting risk management by embedding risk-related capabilities into core quality processes. QMS software helps organizations to systematically identify, assess, mitigate, and monitor risks throughout the product lifecycle.
These capabilities do not function as an isolated module, they are integrated into broader quality workflows such as CAPAs, nonconformances, audits, and change controls, supporting a closed-loop risk management system that ensures traceability, compliance, and continuous improvement.
Key risk management features typically include tools for conducting structured risk assessments (e.g., FMEA), tracking risk control measures, evaluating residual risk, utilizing tools like Hazard Analysis, and maintaining full traceability of all related quality actions.
SimplerQMS provides QMS software for life science companies, including those in the medical device sector, with built-in risk management capabilities. These features are designed to help organizations efficiently manage and mitigate risks, while also supporting a wide range of quality processes such as document control, change management, CAPA and nonconformance handling, audit and supplier management, training, equipment maintenance, and more- all within a validated, cloud-based platform.
By using SimplerQMS, medical device companies can enhance compliance with regulatory requirements such as ISO 14971:2019, FDA 21 CFR Part 820, EU MDR, IVDR, and others.
Book a free demo to discover how SimplerQMS helps medical device companies maintain compliance and improve efficiency through integrated, automated QMS solutions.
