Usually the quality management system establishes the guidelines to periodically perform a risk assessment. This risk assessment is performed by people who are qualified to perform such activities; an engineer familiar with the device, a quality representative that performs CAPAs and NCRs on said device, and someone from the complaints department that is familiar with the device/complaints. Each person brings in a new perspective and information from what they’ve worked on through the year to brainstorm about new risks, existing risks, etc.

Periodically assessing risk ensures a good product and that the risk levels, as defined by the quality system, are maintained within control. If something breaks through the acceptable risk criterion, then there are internal actions taken that seek to mitigate the risk.