The best place to start is the traditional risk matrix. The underlying concept of ISO 14971:2007 is to estimate risk (the output of Risk Analysis in Clause 4), evaluate the estimate against the acceptability criteria (in Clause 5), and determine the need for risk reduction (by applying Clause 6). In addition, after risk reduction, evaluate the residual risk estimate (in Clause 6.4) against the acceptability criteria to determine the need for additional risk reduction measures.