Risk Management
Identify risks before they become audit findings.
Living risk registers tied to real records — every deviation, change, and supplier score feeds your risk picture automatically.
A Risk Register Updated Once a Year Is a Liability, Not a Control.
Most risk registers live in a spreadsheet: scored once, filed, and reopened the week before an audit. Mitigations are described but never verified. Residual risk is a number nobody recalculates when a deviation proves the estimate wrong.
Inspectors have moved on. ICH Q9 and ISO 14971 both frame risk management as a living process — and a register with a twelve-month-old modified date is evidence it is not one.
What ICH Q9 and ISO 14971 Require From a Risk File
ICH Q9 requires risk assessment, control, communication, and review as a continuing cycle across the product lifecycle. ISO 14971 requires a risk management file for every device — hazards, estimations, controls, verification of implementation and effectiveness, and residual risk evaluation. Both expect production and post-market data to feed back into the file.
A spreadsheet meets the letter of neither. Kintavo meets both by construction — assessments link to the deviations, CAPAs, and changes that test them, and review cycles are scheduled, not remembered.
The old way, retired.
This is the actual screen.
Risk That Stays Current Because It Is Connected.
A deviation closes with a root cause pointing at a manual pipetting step. Kintavo flags the linked risk assessment for review; the quality engineer rescores the hazard and adds a control — a revised SOP plus competency training. Both are linked records, so when either slips, the risk file knows. At the annual review, nothing needs reconstructing: the file has been living all year.
Part of one connected system.
Risk Management shares the same data model, AI engine, and audit trail as the other eighteen modules — so its records see, and are seen by, everything else in your quality system.
Risk Management FAQ
Does Kintavo support FMEA?
Yes — FMEA, preliminary hazard analysis, and custom house methods. Scales, matrices, and acceptability thresholds are configured to match your SOPs, not the other way around.
Can risk assessments link to other quality records?
Yes, and that is the point: controls link to the SOPs, training, maintenance, and QC records that implement them, and deviations against those records flag the assessment for review.
How does this support ISO 14971?
The risk management file is maintained as a living record — hazard identification, estimation, controls with verification, residual risk acceptance under signature, and production data feeding review.
Can we migrate our existing risk register?
Yes. Your current register loads as the baseline file with scores and mitigations intact; linkage to live records is added as you go.