Closed Loop Risk Management

One of the biggest changes in the transition from the FDA’s regulations from the Quality System Regulation (QSR) to the Quality Management System Regulation (QMSR) is a larger focus on risk management.  In ISO 13485: 2016, risk management is integrated into many processes outside of product development including supplier management, training, software and production process validation and revalidation, incoming inspection, and purchasing. A recent warning letter issued by the FDA highlights one of the problems that some companies are having implementing an FDA QMSR compliant risk management process.

Olympus Medical Systems Corporation (MARCS-CMS 729208) October 7, 2026

During an inspection of the Shirakawa facility, it was noted that they “failed to identify and control known catastrophic hazards”. Catastrophic hazards including air embolism, arrhythmia, and patient death were identified during a health hazard evaluation, but these hazards were not controlled or included in the risk management file.

During an inspection of the Aomori facility, it was noted that they “failed to identify and assess known hazards in the risk management documentation and failed to establish risk control measures” for a manufacturing process even when an analysis of FDA Medical Device Reports (MDRs) identified risks associated with unintended cutting of blood vessels leading to patient bleeding.

These 2 findings are the result of not implementing and/or executing a closed loop risk management process. Many risk management processes are linear – they start with risk management planning, move through risk analysis, risk evaluation, and risk control and end with risk monitoring.

Image Credit: Cooperative Quality Solutions

A closed loop risk management process connects risk monitoring back to risk management planning and analysis. This forces comparison of risk monitoring data against the risk management file to identify any new or changing risks.

Image Credit: Cooperative Quality Solutions

In both instances cited in the FDA warning letter, a closed loop system that required a comparison of hazards and harms identified within health hazard evaluations and MDR analyses to the hazards and harms identified in the risk management file would have prevented these findings.

Closed loop risk management processes ensure that any new or different harms discovered as part of monitoring production and post-production data are contained within the risk management file and therefore ensure that the risk management file is complete, accurate, and up to date.

How Do I Implement a Closed Loop Risk Management Process?

Contact Cooperative Quality Solutions to discuss how to integrate closed loop risk management processes into your quality management system.