A Practical Guide to Applying a Risk-Based Approach in Your Quality Management System


The FDA's new QMSR took effect on February 2, 2026, and it brings a deep change in mindset: the adoption of ISO 13485 as the basis for US regulation. One of the key clauses that has now become mandatory, and not just a recommendation, is the requirement for a risk-based approach across every level of the quality management system.

But what does that really mean, and how do you put it into practice, not only in your documentation but also day to day?
In this practical guide you will find an organized workflow, practical examples and tips for building risk-based thinking into every key QMS process.

What is a risk-based approach?

In ISO 13485:2016, "risk" is defined as risk to the safety or performance of the medical device, or to meeting regulatory requirements. A risk-based approach is now required across every level of the quality management system, not only in design and development but also in supplier selection, training, software, CAPA, change control and, in fact, every significant QMS process.

This approach is more than nice words, though. It requires the following:

  • Defining acceptance criteria

  • Documenting decisions and actions

  • Matching the depth of control to the level of risk

  • Using day-to-day judgment based on the risk level of the process or the deviation

Where in the quality management system do you apply risk-based thinking?

According to the standard and the guidance, this thinking is especially needed in the following areas:

  • Critical processes (such as CAPA, product release and document control)

  • External processes (suppliers, services, outsourcing)

  • Validation of software and measuring equipment

  • Employee training and effectiveness checks

  • Handling of deviations/nonconformities and FSCAs

  • Internal audit planning

  • Post-market surveillance

How do you put it into practice? Recommended steps:

Step 1: Map processes and risks

  • Draw up a table of the key processes in the quality management system

  • For each process, define the possible risks (improper use, regulatory failure, human error)

  • Set a risk level based on severity X probability

Step 2: Define acceptance criteria and matching controls

  • Define metrics (KPIs) for how the process performs

  • Decide what counts as "success" and what counts as failure (for example, 100% of CAPAs investigated)

  • Set a proportional response, so that a critical process gets tighter control

Step 3: Document and build it into your documents

  • Build risk considerations into the relevant procedures and forms (CAPA, change management, audits, etc.)

  • Update validation plans, change forms and audit plans accordingly

  • In forms, it is important to add dedicated risk fields rather than settle for general comments

Step 4: Monitor, measure and keep improving

  • Check how effective it is in practice. Are CAPAs handled on time according to their risk level? Is training effectiveness being checked?

  • Add trend analysis and management reports that show risk levels over time

  • Make management adjustments accordingly (including prioritization in work plans)

Practical examples

CAPA by risk level:
Critical deviation → handled within a week, approved by the quality manager
Minor deviation → handled within a month, periodic review

Employee training:
Training for production staff → sensitive process → individual effectiveness assessment required
Administrative training → non-critical process → basic documentation is enough

Risk-based supplier control:
Critical supplier → periodic audit, validation required
Non-critical supplier → sample checks, annual evaluation only

Internal audits:
Design process → process with regulatory implications → audit every 6 months
Logistics process → audit once a year

Key tips for building in a risk-based approach smoothly

  • Do not work with complicated formulas. Simple tables do an excellent job.

  • Consult the people who own the processes. They know the processes and the risks best.

  • Make sure this approach reaches all the way down to how forms are filled in, not only management meetings.

  • Build this approach in from the planning stage of every new process.

In summary

A risk-based approach is a requirement, not a recommendation. 

Applied correctly, it becomes a powerful management tool that lets the organization focus on what really matters and improve its level of quality systematically. 

A one-time investment in implementing risk principles wisely will pay off in improved processes, fewer failures, compliance with regulatory requirements, and an easier life at your next audit or inspection.