Risk management: ISO 14971, IEC 31010, FMEA, FTA, HAZOP

Hugues Orgitello updated 7 Oct 2026 17 min read

A certifier rarely asks for "an FMEA". It asks for a risk management process, defined by a process standard (ISO 14971 for medical devices, ISO 26262 for road vehicles, ISO 12100 for machinery, ARP4761A for aircraft systems), fed by analysis techniques documented in their own IEC method standards (IEC 60812 for FMEA, IEC 61025 for FTA, IEC 61882 for HAZOP) and chosen with the help of the IEC 31010 catalogue. This guide reads ISO 14971:2019 clause by clause against Annex I of the EU MDR, counts what IEC 31010:2019 actually contains, checks the editions and dates of every standard cited, and lists the claims the texts contradict, including several that this page used to make.

Standards map

Editions checked against the IEC online catalogue, the Official Journal, eCFR and the publishers on October 7, 2026.

Layer	Standard	Edition and date	Scope
Process, medical	ISO 14971:2019	Third edition, December 2019	Risk management process for medical devices, whole lifecycle
EU harmonised version	EN ISO 14971:2019 + EN ISO 14971:2019/A11:2021	Listed for the MDR by Decision (EU) 2022/757	European amendment adapting the standard to the MDR and IVDR requirements
Process guidance, medical	ISO/TR 24971:2020	Technical report, 2020	Guidance on applying ISO 14971
Process, generic	ISO 31000:2018	2018	Generic risk management principles and process
Techniques catalogue	IEC 31010:2019	Edition 2.0, June 13, 2019, double logo with ISO	42 techniques described in Annex B, replaces the 2009 edition
FMEA, FMECA	IEC 60812:2018	Edition 3.0, August 10, 2018	FMEA planning, execution, documentation, replaces the 2006 edition
FTA	IEC 61025:2006	Edition 2.0, December 13, 2006, stability date 2029	Fault tree analysis, deductive
ETA	IEC 62502:2010	2010	Event tree analysis, inductive
HAZOP	IEC 61882:2016	Edition 2.0, March 10, 2016	Guide word driven risk identification, replaces the 2001 edition
Automotive functional safety	ISO 26262:2018	Second edition	HARA, ASIL, safety lifecycle
Automotive SOTIF	ISO 21448:2022	2022	Safety of the intended functionality
Automotive cybersecurity	ISO/SAE 21434:2021	2021	TARA for road vehicles
Aviation	SAE ARP4761A (EUROCAE ED-135)	December 2023, supersedes ARP4761 of 1996	AFHA, PASA, SFHA, PSSA, SSA, ASA and the analysis methods
Machinery	ISO 12100:2010, ISO 13849-1:2023, IEC 62061:2021		Risk assessment and risk reduction, safety functions
OT cybersecurity	IEC 62443-3-2		Security risk assessment, zones and conduits
Automotive FMEA	AIAG and VDA FMEA Handbook	June 2019	7-step approach, Action Priority, FMEA-MSR

An electronics or embedded software project picks one process spine per target market, then picks techniques. The method standards (60812, 61025, 61882) tell you how to perform and document a technique; they do not tell you what risk is acceptable for your product. That comes from the process standard and the sector rules.

Dated changes, 2019 to 2027

Date	Event	Source
June 13, 2019	IEC 31010:2019 edition 2.0 published, replacing the 2009 edition and increasing the number of techniques	IEC catalogue
June 2019	AIAG and VDA FMEA Handbook released, Action Priority replaces RPN	AIAG
December 2019	ISO 14971:2019 third edition published	ISO
December 23, 2019	FDA recognizes ISO 14971:2019 in full (recognition number 5-125)	FDA recognized standards database
2020	ISO/TR 24971:2020 published as companion guidance	ISO
2021	EN ISO 14971:2019/A11:2021 adopted by CEN and CENELEC	Decision (EU) 2022/757, recital 4
May 11, 2022	Decision (EU) 2022/757 adds EN ISO 14971:2019 and A11:2021 as entry 16 of the MDR list (OJ L 138, May 17, 2022); Decision (EU) 2022/729 does the same for the IVDR list (OJ L 135, May 12, 2022)	Official Journal
January 18, 2023	ICH Q9(R1) on quality risk management reaches Step 4	ICH
December 2023	SAE ARP4761A published, superseding ARP4761 (1996)	SAE
February 2, 2024	FDA publishes the QMSR final rule (89 FR 7496)	Federal Register
August 30, 2024	FAA issues AC 25.1309-1B, System Design and Analysis	FAA
February 2, 2026	QMSR takes effect: 21 CFR Part 820 incorporates ISO 13485:2016 by reference	Federal Register, eCFR
January 20, 2027	Machinery Regulation (EU) 2023/1230 applies and Directive 2006/42/EC is repealed	Official Journal

ISO 14971 in practice

ISO 14971:2019 is a process standard. It does not tell you which hazards your device has or which matrix to use; it tells you what the process must contain and what must be recorded in the risk management file. In the EU, the MDR sets the legal requirement directly: Article 10(2) obliges every manufacturer to "establish, document, implement and maintain a system for risk management as described in Section 3 of Annex I". The harmonised EN version of ISO 14971 gives a presumption of conformity under Article 8 for the requirements it covers.

Clause by clause, against MDR Annex I

ISO 14971:2019 clause	What it requires	Matching MDR Annex I text
4.1 Risk management process	A documented process covering the whole lifecycle	Section 3: "a continuous iterative process throughout the entire lifecycle"
4.2 Management responsibilities	Top management defines and documents a policy for establishing criteria for risk acceptability	Section 1: risks acceptable "when weighed against the benefits", "taking into account the generally acknowledged state of the art"
4.4 Risk management plan	One plan per device, with acceptability criteria and verification activities	Section 3(a): "establish and document a risk management plan for each device"
4.5 Risk management file	Traceability for each identified hazard	Annex II technical documentation
5 Risk analysis	Intended use, reasonably foreseeable misuse, characteristics related to safety, hazards and hazardous situations, risk estimation	Section 3(b) and 3(c)
6 Risk evaluation	Compare each estimated risk with the criteria of the plan	Section 3(c)
7.1 Risk control option analysis	Priority order: inherently safe design and manufacture, then protective measures, then information for safety	Section 4: safe design and manufacture, then protection measures "including alarms if necessary", then information for safety and, where appropriate, training
7.3 Residual risk evaluation	Each residual risk evaluated against the criteria	Section 4: "the residual risk associated with each hazard ... is judged acceptable"
7.4 Benefit-risk analysis	Only when a residual risk is not acceptable and further control is not practicable	Sections 1 and 8
7.5, 7.6	Risks arising from risk control measures, completeness of risk control	Section 4
8 Evaluation of overall residual risk	All residual risks taken together, against the benefits of the intended use	Section 4: "as well as the overall residual risk is judged acceptable"
9 Risk management review	Before commercial distribution, review that the plan was implemented; record the results as the risk management report	Annex II technical documentation
10 Production and post-production activities	Collect and review production and post-production information and act on it	Section 3(e) and 3(f), post-market surveillance (Annex III)

Acceptability criteria and "as far as possible"

ISO 14971:2019 leaves the acceptability criteria to the manufacturer, under a policy set by top management. Many manufacturers express them as a consequence and likelihood matrix (IEC 31010:2019 describes this technique in B.10.3, and ALARP and SFAIRP in B.8.2). For the EU, check the policy against MDR Annex I Section 2: "reduce risks as far as possible means the reduction of risks as far as possible without adversely affecting the benefit-risk ratio". A matrix that stops risk reduction because a risk is "low enough" or because further reduction is costly does not read the same way as that sentence. CEN and CENELEC adopted the European amendment A11:2021 to adapt EN ISO 14971:2019 to the requirements of the MDR (Decision (EU) 2022/757, recital 4). Section 4 also requires manufacturers to "inform users of any residual risks".

Benefit-risk, individual and overall

Clause 7.4 is not a step that every residual risk goes through. It is the route for a residual risk that fails the plan criteria when further risk control is not practicable: the manufacturer may then gather data and literature to decide whether the benefits of the intended use outweigh it. Clause 8 is mandatory: the overall residual risk is evaluated with all residual risks together, against the benefits. ISO/TR 24971:2020 is the companion guidance for these steps.

IEC 31010, the techniques catalogue

IEC 31010:2019 is guidance, not a requirements standard. It covers planning, applying and reviewing a risk assessment (clause 6), selecting techniques (clause 7, with a characterisation table in Annex A) and, in Annex B, a summary of each technique with references to the documents that describe it in detail. It was prepared by IEC technical committee 56 (Dependability) with ISO/TC 262 (Risk management).

What Annex B contains

Annex B group	Techniques described	Count
B.1 Eliciting views from stakeholders and experts	Brainstorming, Delphi, nominal group technique, structured or semi-structured interviews, surveys	5
B.2 Identifying risk	Checklists and taxonomies, FMEA and FMECA, HAZOP, scenario analysis, SWIFT	5
B.3 Sources, causes and drivers of risk	Cindynic approach, Ishikawa (cause and effect diagram)	2
B.4 Analysing controls	Bow tie, HACCP, LOPA	3
B.5 Consequences and likelihood	Bayesian analysis, Bayesian networks and influence diagrams, business impact analysis, cause-consequence analysis, ETA, FTA, human reliability analysis, Markov analysis, Monte Carlo simulation, privacy impact analysis (DPIA)	10
B.6 Dependencies and interactions	Causal mapping, cross impact analysis	2
B.7 Measures of risk	Toxicological risk assessment, value at risk, conditional value at risk	3
B.8 Evaluating significance of risk	ALARP and SFAIRP, F-N diagrams, Pareto charts, reliability centred maintenance, risk indices	5
B.9 Selecting between options	Cost/benefit analysis, decision tree analysis, game theory, multi-criteria analysis	4
B.10 Recording and reporting	Risk registers, consequence/likelihood matrix, S-curves	3
Total		42

Two consequences for a dossier. First, the risk matrix and ALARP are techniques in this catalogue, not requirements of ISO 14971. Second, STPA is not among the 42, so a dossier using it should cite its own reference.

Selection logic

The right technique is the one that fits the question, the data available and the maturity of the design. In practice: brainstorming, checklists and SWIFT in concept phase; FMEA when the architecture or the process steps exist; FTA on the most severe top events once the design is detailed; HAZOP when design intent and sequences are defined; Bayesian or Markov models when dependencies and repair matter.

FMEA and FMECA

IEC 60812:2018 (edition 3.0) applies to hardware, software, processes including human action, and their interfaces. Its foreword lists what changed from the 2006 edition: generic normative text; informative examples for safety, automotive, software and service processes; tailoring; reporting formats including a database information system; alternative ways of calculating risk priority numbers; a criticality matrix method; and the relationship with other dependability methods. When failure modes are prioritised, the analysis is called FMECA, and the prioritisation "can be based on a ranking of the severity alone".

Variants

Variant	Scope	Typical use
System FMEA	Functions, architecture, interfaces	Concept and architecture phase
Design FMEA	Components, sub-assemblies, design choices	Detailed design, board level
Process FMEA	Manufacturing and assembly steps	Industrialisation, production
FMEA-MSR	Monitoring and system response	Automotive, AIAG and VDA handbook
Software FMEA	Software functions and their failure modes	Embedded software, alongside other analyses

RPN versus Action Priority

The classic risk priority number is RPN = Severity x Occurrence x Detection. Its known weakness is that different triplets give the same number and that a good detection score can lower the rank of a severe failure mode. The AIAG and VDA FMEA Handbook (June 2019) answered this by replacing RPN with Action Priority tables. IEC 60812:2018 took another route: it keeps RPN, adds alternative calculations and a criticality matrix, and lets the analyst rank on severity alone. Choose one method per project, write it in the plan, and keep the severity scale identical across all worksheets.

Frequent errors

• Severity scale changing between worksheets, so priorities cannot be compared across the dossier,
• Detection credited for tests that have not been performed,
• Occurrence estimated without looking at field returns of similar products,
• FMEA started after design freeze, too late to influence choices,
• Actions not traced to a design change and to verification evidence.

FTA, ETA and cut sets

Fault tree analysis (IEC 61025:2006, edition 2.0, which replaced the 1990 edition and added the quantitative and reliability aspects) is deductive: from a top event, the analyst decomposes causes through logic gates down to basic events. Event tree analysis (IEC 62502:2010) is inductive: from an initiating event, it follows the branches of success or failure of each barrier.

FTA in practice

FTA identifies the minimal cut sets, the smallest combinations of basic events that produce the top event. A cut set of size one is a single point of failure. With basic-event probabilities, FTA quantifies the top event, which is how aircraft system safety assessments show compliance with numerical objectives. FAA AC 25.1309-1B (August 30, 2024) gives the commonly accepted ranges, per flight hour:

Failure condition	Required probability	Range in AC 25.1309-1B
No safety effect	No probability requirement
Minor	May be probable	Probable: on the order of 1 x 10⁻³ or less, but greater than on the order of 1 x 10⁻⁵
Major	No more frequent than remote	On the order of 1 x 10⁻⁵ or less
Hazardous	No more frequent than extremely remote	On the order of 1 x 10⁻⁷ or less
Catastrophic	Extremely improbable	On the order of 1 x 10⁻⁹ or less

The AC states that meeting these numbers "provides some, but not necessarily sufficient, evidence" of compliance. The safety assessment process itself is described in SAE ARP4761A (December 2023), which splits the old single FHA into aircraft and system level assessments and lists FTA, dependence diagrams, Markov analysis, FMEA and FMES, zonal safety analysis, particular risk analysis and common mode analysis among its methods.

Frequent errors

• Basic events missing, which makes the top-event probability optimistic,
• Independence assumed between events that share a cause (power supply, software module, sensor),
• Failure rates unsourced, taken from a reliability handbook without saying which one and why,
• Tree not updated when the design or the component selection changes.

HAZOP and structured what-if

IEC 61882:2016 calls HAZOP "guide word-driven risk identification". Its introduction notes that the technique originated in the process industries and that the standard gives guidance across many industries; its worked examples include an automatic train protection system, a piezo valve control system and a procedural HAZOP for a train stabling yard horn procedure. The 2016 edition aligned its terminology with ISO 31000:2009 and ISO Guide 73:2009 and added an improved procedural HAZOP case study.

Method

The system is divided into parts. For each part the team states the design intent, then applies guide words: NO or NOT, MORE, LESS, AS WELL AS, PART OF, REVERSE, OTHER THAN, and for time and sequence guide words such as EARLY, LATE, BEFORE and AFTER. Each meaningful deviation is examined for causes, consequences, existing protection and actions. The standard stresses the examination session, in which "a multi-disciplinary team under the guidance of a study leader systematically examines all relevant parts of a design or system". It also rejects using the name HAZOP for checklist-based variants.

Frequent errors

• Parts too coarse, which hides intermediate deviations,
• Design intent not written for each part, so the guide words have nothing to apply to,
• One engineer instead of a team, which removes what the method relies on,
• No traceability from HAZOP actions to design changes or verification.

STAMP and STPA

STAMP (System-Theoretic Accident Model and Processes), developed by Nancy Leveson at MIT, treats accidents as the result of inadequate control rather than chains of component failures. Its hazard analysis method, STPA, is described in the STPA Handbook (Leveson and Thomas, March 2018): define the purpose of the analysis, model the control structure, identify unsafe control actions, then identify loss scenarios. The handbook lists four ways a control action can be unsafe: not providing it leads to a hazard; providing it leads to a hazard; providing it too early, too late or in the wrong order; and, for continuous actions, applying it too long or stopping it too soon.

STPA is useful where software and interactions drive the risk, for example in industrial robotics, ISO 10218 and 15066. It complements FMEA and FTA rather than replacing them.

Sector overlays

Sector	Risk approach	Key references
Medical	ISO 14971 process within an ISO 13485 QMS	MDR Annex I, IVDR Annex I, 21 CFR Part 820 (QMSR), ISO 14971
Automotive functional safety	HARA, ASIL determination	ISO 26262, ISO 21448
Automotive cybersecurity	TARA	ISO/SAE 21434, UN R155, R156
Aviation	AFHA, SFHA, PSSA, SSA, common cause analyses	ARP4761A, ARP4754, AC 25.1309-1B, DO-178C and DO-254
Machinery	Risk assessment and risk reduction, PL or SIL for safety functions	ISO 12100, ISO 13849-1 and IEC 62061, Directive 2006/42/EC and Regulation 2023/1230
Process and E/E/PE systems	LOPA, SIL determination	IEC 61511, IEC 61508
Industrial cybersecurity	Zones and conduits, security risk assessment	IEC 62443-3-2
Pharmaceutical quality	Quality risk management	ICH Q9(R1)

Each sector defines its own integrity or acceptability scale (ASIL, DAL, PL, SIL, or the manufacturer criteria under ISO 14971). A product sold into several sectors can share the same FMEA and FTA backbone, but the acceptability argument has to be written separately for each process standard.

Documentation chain

A complete risk file establishes traceability from hazard to verification:

1. Hazards and hazardous situations (intended use, reasonably foreseeable misuse, electrical, mechanical, thermal, software, cybersecurity, biological where relevant),
2. Risk estimation for each hazardous situation,
3. Risk control measures, allocated to design requirements, in the priority order of the process standard,
4. Verification of implementation and effectiveness of each control measure (test, analysis, inspection),
5. Residual risk evaluation for each hazard,
6. Overall residual risk evaluation, with benefit-risk where the process standard requires it,
7. Risk management report recording the review of the plan,
8. Production and post-production information fed back into the file at each review.

Each link should reference the next by document number and version, so an auditor can follow a hazard from identification to the verification evidence and to the field data that confirm or contradict the estimate.

Integration into the certification dossier

The risk file sits next to design controls, verification and validation, manufacturing and post-market surveillance. See QMS overview (ISO 9001, AS 9100, ISO 13485, TL 9000), laboratory and measurement safety, IEC 61010 and, for connected products, the Cyber Resilience Act (CRA), whose reporting obligations apply from September 11, 2026 and full application from December 11, 2027.

A common pattern in a medical device file: ISO 14971 plan and report at the top, a design FMEA on the electronics feeding the device-level analysis, FTA on the most severe top events, HAZOP or STPA on the embedded control sequences and user interaction, and a traceability matrix from each control measure to a requirement and to its verification evidence.

Claims the texts contradict

Claim	What the text says
"ISO 14971 is harmonised under the MDR since Decision 2021/1182."	The July 2021 list did not contain it. EN ISO 14971:2019 with A11:2021 was added as entry 16 by Decision (EU) 2022/757 of May 11, 2022.
"ISO 14971 underpins GSPR 1 to 4."	Risk management runs through Sections 1 to 5 and 8 of MDR Annex I: Section 2 defines "as far as possible", Section 3 the risk management system, Section 4 the control priority, Section 5 use error, Section 8 side effects.
"Each residual risk undergoes a benefit-risk analysis, in the ALARP zone."	ISO 14971:2019 clause 7.4 applies when a residual risk is not acceptable and further control is not practicable. ALARP is a technique described in IEC 31010:2019 B.8.2, not a zone defined by ISO 14971, and MDR Annex I Section 2 uses "as far as possible".
"The risk management report must be signed by top management, otherwise it is a formal nonconformity."	Clause 4.2 gives top management the acceptability policy. Clause 9 requires a review before commercial distribution, documented as the risk management report. No signature by top management is required by that clause.
"The QMSR replaced Part 820 and references ISO 14971."	The QMSR amends 21 CFR Part 820 and incorporates ISO 13485:2016 and clause 3 of ISO 9000:2015. ISO 14971 is not incorporated; it is an FDA recognized consensus standard (5-125).
"IEC 31010 catalogues some thirty techniques, including STAMP/STPA."	Annex B of IEC 31010:2019 describes 42 techniques in ten groups. STPA is not one of them.
"IEC 61882:2016 documents a software extension of HAZOP used in EN 50128."	The standard is a generic application guide whose 2016 changes were terminology alignment and a procedural HAZOP case study. Its examples include control systems, but it does not define a software HAZOP.
"ARP4761 (1996); minor failure conditions 1E-3 per flight hour."	ARP4761A superseded it in December 2023. AC 25.1309-1B says minor failure conditions may be probable and sets no numerical objective for them.
"The AIAG and VDA handbook replaces SAE J1739 and VDA 4."	AIAG describes it as harmonising the AIAG 4th edition FMEA manual and VDA Volume 4.
"Pharma and radioactive: ICH Q9."	ICH Q9 is a pharmaceutical quality guideline, revised as ICH Q9(R1), Step 4 on January 18, 2023.

Frequent pitfalls

Pitfall	Consequence
Risk file produced once and not updated with production and post-production information	Estimates no longer match field data, against ISO 14971 clause 10 and MDR Annex I Section 3(e)
Acceptability criteria copied from another company or sector	Criteria not tied to the manufacturer policy required by clause 4.2
Matrix policy that stops reducing a risk once it is "acceptable"	Gap against "as far as possible" in MDR Annex I Section 2
FMEA with no link to design controls	The reviewer cannot follow a control measure to its verification
FTA with missing basic events or false independence	Top-event probability optimistic, common cause not mitigated
RPN letting a good detection score hide a severe failure mode	Severe risk insufficiently controlled
HAZOP by one person, or with parts too coarse	Deviations missed
Failure rates without a stated source	Quantitative result hard to defend
Individual residual risks never evaluated together	Clause 8 overall residual risk evaluation missing

Going further

• Industrial robotics, ISO 10218 and 15066: risk assessment for robot cells and collaborative operation
• Laboratory and measurement safety, IEC 61010: risk analysis for measurement and laboratory equipment
• QMS overview (ISO 9001, AS 9100, ISO 13485, TL 9000): quality system within which the risk file is maintained
• Cyber Resilience Act (CRA): cybersecurity risk assessment under the EU CRA
• Glossary: definitions of FMEA, FMECA, FTA, ETA, HAZOP, STPA, ASIL, DAL, SIL, PL, ALARP, GSPR

See also

• MDR: the EU Medical Device Regulation (2017/745)
• MDR class IIb and III: UDI, EUDAMED, NB, surveillance
• IVDR (EU) 2017/746: in vitro diagnostic medical devices
• FDA 510(k), De Novo and PMA: US medical devices
• ISO 26262: automotive functional safety
• IEC 61508: functional safety and SIL

Working on risk management file for product certification, ISO 14971 medical or sector overlays, FMEA, FTA, HAZOP, STPA integrated into the dossier for a real product? AESTECHNO can audit your design and certification plan. Get in touch

A 30-minute audit with AESTECHNO engineers.

AESTECHNO is the electronics design house that edits spilma. We help product teams scope their certification effort and avoid the common mistakes.

Book a free audit

Sources & references

1. ISO 14971:2019, Medical devices, Application of risk management to medical devices, ISO www.iso.org/standard/72704.html
2. ISO/TR 24971:2020, Guidance on the application of ISO 14971, ISO www.iso.org/standard/74437.html
3. Commission Implementing Decision (EU) 2022/757 amending Decision (EU) 2021/1182 (EN ISO 14971:2019/A11:2021 added for the MDR), European Commission eur-lex.europa.eu/eli/dec_impl/2022/757/oj
4. Commission Implementing Decision (EU) 2022/729 amending Decision (EU) 2021/1195 (IVDR), European Commission eur-lex.europa.eu/eli/dec_impl/2022/729/oj
5. Regulation (EU) 2017/745 on medical devices, Article 10 and Annex I, EUR-Lex eur-lex.europa.eu/eli/reg/2017/745/oj
6. 21 CFR Part 820, Quality Management System Regulation, eCFR www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-820
7. Medical Devices; Quality System Regulation Amendments, final rule (89 FR 7496), Federal Register www.federalregister.gov/documents/2024/02/02/2024-01709/medical-devices-quality-system-regulation-amendments
8. FDA recognized consensus standard 5-125, ISO 14971:2019, US FDA www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfStandards/detail.cfm?standard__identification_no=41349
9. IEC 31010:2019, Risk management, Risk assessment techniques, IEC webstore.iec.ch/en/publication/59809
10. IEC 60812:2018, Failure modes and effects analysis (FMEA and FMECA), IEC webstore.iec.ch/publication/26359
11. IEC 61025:2006, Fault tree analysis (FTA), IEC webstore.iec.ch/publication/4311
12. IEC 61882:2016, Hazard and operability studies (HAZOP studies), Application guide, IEC webstore.iec.ch/publication/24321
13. New AIAG and VDA FMEA Handbook (June 2019), Action Priority replaces RPN, AIAG blog.aiag.org/new-aiag-vda-fmea-handbook-and-trainings-available
14. STPA Handbook, Leveson and Thomas, March 2018, MIT Partnership for Systems Approaches to Safety and Security psas.scripts.mit.edu/home/get_file.php?name=STPA_handbook.pdf
15. AC 25.1309-1B, System Design and Analysis (August 30, 2024), US FAA www.faa.gov/documentLibrary/media/Advisory_Circular/AC_25.1309-1B.pdf
16. ARP4761A, Guidelines for Conducting the Safety Assessment Process on Civil Aircraft, Systems, and Equipment, SAE International saemobilus.sae.org/standards/arp4761a-guidelines-conducting-safety-assessment-process-civil-aircraft-systems-equipment
17. The ICH Q9(R1) Guideline reaches Step 4 of the ICH Process, ICH ich.org/news/ich-q9r1-guideline-reaches-step-4-ich-process