Tiny Tentacles of Risk
“There are little, tiny tentacles of risk in each [facet] of the company”
- Christie Johnson, Prodct
The FDA’s new Quality Management System Regulation (QMSR), set to replace the longstanding Quality System Regulation (QSR) in 2026, is a seismic shift for MedTech companies. It aligns FDA requirements with ISO 13485:2016 and underscores the importance of ISO 14971:2019, reinforcing a risk-based approach to quality management. But beyond the technical updates, the QMSR sends a clear message: risk management isn’t just about compliance—it’s about culture.
Enzyme’s March 4, 2025 post “Tiny Tentacles of Risk” highlights this shift and features insights from Christie Johnson, co-founder at Prodct Studio.
Christie emphasizes that risk management shouldn’t be a standalone function—it needs to be deeply woven into every aspect of a company’s operations, from product development to post-market activities.
Learn More
The Culture Shift: Risk is Everyone’s Job
One of the biggest takeaways from Christie’s conversation with Enzyme is the FDA’s expectation that companies move beyond viewing risk management as a compliance task. Instead, risk-based thinking needs to be part of leadership, decision-making, and daily work at every level.
She points to Comment No. 27 in the FDA’s final QMSR rule, which makes it clear: the FDA expects medical device companies to embrace a culture of quality as a foundational principle for ensuring patient safety. That means leadership—CEOs, CTOs, R&D heads—shouldn’t just approve risk management files. They need to be actively engaged in risk reviews, decision-making, and approvals.
Want to dig deeper? Here are some resources to help you understand these expectations:
↗ Intersection of ISO 13485 and ISO 14971 under FDA QMSR
↗ IMDRF Guidance on Implementing Risk-Based Thinking in QMS
Risk Files Shouldn’t Collect Dust
A static risk management file isn’t going to cut it under QMSR. As Christie puts it, risk management needs to be a living, breathing process—something teams actually reference and update as products evolve. If risk management is tucked away in a binder or limited to one person’s desk, it’s a sign the company isn’t ready for the FDA’s new approach.
A risk management file should be a daily tool, not just a document. Regular updates and cross-functional input ensure it stays relevant, guiding decisions and improving product safety.
For companies looking to rethink how they manage risk, here are some practical tools and strategies:
↗ Look outside our industry for ideas - Dynamic Risk Management in Finance
↗ Templates for Integrating Risk into Design and Development
Building a Risk-Conscious Team
One of Christie’s favorite strategies for getting teams to take risk management seriously is to get out of the boardroom. When you remove people from their usual setting, you often get more honest conversations about what’s really preventing quality and risk management from being embedded in the organization.
More importantly, employees need to feel safe speaking up about risk. If people fear repercussions for raising concerns, problems will go unreported until they turn into something bigger and more expensive.
Here’s how you can start making risk an everyday conversation:
↗ Harvard Business Review: Psychological Safety and High Performing Teams
↗ Why risk practitioners must build empathy muscle
Compliance Is Just the Beginning
The article makes an important point: the FDA isn’t going to issue 483 observations just because a company lacks a quality culture. But if a team isn’t collaborating on risk management, that will show up in other ways—disorganized files, poor cross-functional engagement, and last-minute scrambling when audits happen. If only one person’s name appears on all risk-related documents, it raises a red flag. Risk management should involve engineering, R&D, manufacturing, customer support, and leadership.
Take Action Now
The QMSR transition isn’t just about tweaking procedures—it’s about shifting how companies think about risk. By embedding risk awareness into company culture now, MedTech teams won’t just meet regulatory expectations—they’ll build safer, stronger products in the process.
For a more in-depth look at these insights, read the full post on Enzyme’s site: www.enzyme.com/blog/qmsr-and-risk
At Prodct, we work with MedTech startups and growing companies to build scalable, risk-aware quality systems.
