Risk analysis is part of Design Control System and one of the aspects regulatory agencies look for is the integration of risk management to complaint handling. Establishing a risk management file is critical and more importantly is establishing a feedback loop from post market surveillance (e.g. product complaints, complaint investigations, adverse events, track and trending, etc.) to risk management so that decisions about risk mitigations/ controls can be evaluated by actual market performance. I believe this may be one of the challenges in the medical device industry. Recently, Meridian Medical Technologies, Inc. a Pfizer Company that manufactures EpiPen received a warning letter related to several aspects such as failure to properly perform complaint investigations and loop back into the design control system.
https://www.fda.gov/ICECI/EnforcementActions/WarningLetters/2017/ucm574981.htm