I agree that #4 “Risk management is not a lifecycle process” and that it is a mistake to think that once the development process is completed that the risk management documentation ends. I agree with @smk45 that it should be treated as a “living” document. As Dr. Simon discusses in lecture there should risk management documents in DHF: Risk Management Plan, Risk Analysis, and Risk Management Questionnaire.

Risk Management Plan-tells you how you are going to handle risks and what level of risks you will accept. This allows the rules to be set on how to deal with risks.
Risk Analysis-Lists the risks and tells you how you will mitigate them
Risk Management Questionnaire- Gives you questions to brainstorm and helps you to list the risks. This is what ISO wants you to look at.

I found an article shows that you could call this a Risk Management file (RMF) and can be structured and organized by an individual product or for a product family. It contains evidence of:

-Risk Management Plan
-Risk Analysis
-Risk Evaluation
-Risk Controls
-Evaluation of Overall Risk Acceptability
-Risk Management Report
-Production and Post-Production Risks

Again the Risk documentations should be a living document and should be used as a tool as for production and post-production and can be helpful to document CAPAs, complaints, etc.

https://blog.greenlight.guru/iso-14971-risk-management