Your risk file was finished the day you wrote it. That is the problem.

Risk management in ISO 13485:2016 sits in §7.1, Planning of product realization. The requirement is short. You document one or more processes for risk management in product realization. You keep records of your risk management activities, under §4.2.5. A note in the clause points to ISO 14971, the risk management standard for medical devices, for guidance.

But risk does not stop at §7.1. It runs through the whole standard.

• §4.1.2 asks you to take a risk-based approach to controlling the processes in your quality system.
• §7.4.1 asks that your supplier controls be proportionate to the risk the supplied product carries.
• §8.2.1 says feedback, including complaints and field information, serves as a potential input into risk management.

That last link is the one that matters most here. ISO 14971 frames risk management as a life cycle activity. You identify hazards, estimate and evaluate risk, control it, and decide whether what remains is acceptable. Then you keep watching. Information from production and from the market comes back in, and the file is reviewed against it.

A risk file is not a design document you file away. It is a living record of what you know about how a device could cause harm, and what you are doing about it.

Risk is where a quality system shows whether it is connected. Complaints come in. Do they reach the risk file? A supplier changes a component. Does anyone ask what it does to risk? A CAPA closes. Was the risk file updated?

Each of those is a thread that leads back to one document. If the file has not changed in three years, while complaints and field data kept arriving, the gap is visible on the first page.

The Heatmap finding for this area reads: "Risk file not updated post-market." This is a common shape for the gap. The file was done properly once, at launch or at first import. Then the market started talking, and the file stopped listening.

This area carries a weight of 14 on the Heatmap, one of the heaviest of the nine. Risk sits under almost every other decision in your system.

"Is there a documented risk management process applied across the product life cycle?"

What "we do this" sounds like: "Yes, we did a risk assessment for each product."

What you could put on the table: your Risk Management SOP. It defines how you identify hazards, estimate and evaluate risk, decide on controls, and judge what remains acceptable. It names your acceptability criteria. It says what triggers a review after launch, such as a complaint, a field safety notice or a change. It covers the whole life of the product, not just its arrival.

"We did a risk assessment" describes an event. The standard wants a process that keeps running.

"Do you maintain a risk management file per product or product family?"

What "we do this" sounds like: "We have the manufacturer's risk documents."

What you could put on the table: a file for each product or product family. It holds the hazards, the risk estimates, the controls and the verification that each control works. If you distribute or import, it may lean on the manufacturer's risk documentation. That is reasonable, and the file should say so. But it should also cover the risks you add yourself: storage, transport, temperature, labelling, mix-ups, and how you handle returns.

The manufacturer's file covers the device. It cannot cover what happens in your warehouse.

"Is the risk file updated with post-market data (complaints, field events) on a defined cycle?"

What "we do this" sounds like: "We'd update it if something serious happened."

What you could put on the table: a defined review cycle in your SOP, such as yearly per product family, plus event triggers. A dated review note in each file. The note lists the complaints, returns, field data and CAPAs considered in that period. It records whether any new hazard appeared, whether any frequency changed, and what was decided. If nothing changed, the note says so, with a signature.

"If something serious happened" means the file only moves after harm. The point of the cycle is to see the pattern first.

• A Risk Management SOP covering the full product life cycle
• Documented risk acceptability criteria
• A risk management file for each product or product family
• For distributed or imported products, the manufacturer's risk documents you rely on, plus your own handling risks
• Risk controls with evidence that each one was put in place and works
• A defined post-market review cycle, plus the events that trigger an early review
• Dated review notes showing which complaints, returns, field data and CAPAs were considered
• A link from complaints and CAPA records back to the risk file entry they affect
• Records of each review, kept under your records procedure

The file is a launch document. It was written once, signed and filed. Nobody has opened it since.

Complaints and risk live in different worlds. Complaints go to customer service. The risk file sits with quality. Nothing connects them.

"The manufacturer handles risk." For the device design, often true. For your storage, transport and labelling, it is not. Those risks are yours.

No acceptability criteria. Hazards are listed, risks are scored, but nobody wrote down what level is acceptable. So no score ever triggers action.

No trigger, no review. The SOP says "review periodically". Periodically never arrives.

The scoring is a spreadsheet nobody trusts. Ratings were guessed at launch and never tested against what the market reported. Real complaint data is the best calibration you have.

SAHPRA is rolling out mandatory ISO 13485:2016 certification, or the latest version, in five phases. This is set out in its MD01 notice dated 18 September 2025.

• Phase 1, Preparation (1 April 2025): holders declared a certificate. No evidence was asked for.
• Phase 2, Renewals (1 June 2025): manufacturers and distributors or importers.
• Phase 3, Companies already holding a certificate (1 April 2026): holders "will be requested to submit". SAHPRA describes the requirement as mandatory.
• Phase 4, Amendments (1 June 2027).
• Phase 5, All new applications (1 April 2028).

The type of device also shapes your licence. Under MCC Position Statement 9.106 (2017), manufacturers, distributors and wholesalers of non-sterile, non-measuring Class A devices need not apply for a licence until further notice. Sterile or measuring Class A devices need one.

When an inspector visits, your licence is what is at stake. The inspector's job is to see evidence, not intentions. A risk file with a recent, dated review note that names real complaints is evidence. A file untouched since launch is an intention.

I carry the same SAHPRA licence you do. In twenty years in risk, I never saw a company fail because it wasn't compliant. I saw them fail because they couldn't prove it.

Set a timer for 60 minutes. Pick one product family. Your highest-volume one is a good start.

1. 10 minutes. Open its risk file. Note the date of the last change.
2. 20 minutes. Pull every complaint and return for that family from the last 12 months. List them in one column.
3. 20 minutes. For each one, find the hazard in the file it relates to. If there is none, mark it "new". If it happens more often than the file assumed, mark it "frequency".
4. 10 minutes. Write a one-page review note. Date it, list what you considered, list the "new" and "frequency" marks, and say what you will do next. Sign it.

You now have a post-market review on file, dated this week. That one page changes the answer to the third Heatmap question.