Part of Curriculum level 3 - guidance
Module 3.2 - Clinical risk management activities throughout the product lifecycle
This module covers the full set of clinical risk management activities and their placement across the digital system lifecycle, from initial concept through to decommissioning. Participants will be able to plan clinical risk management (CRM) activities at the right time and to the right depth.
This module will provide:
- The standard CRM activities — hazard identification, risk analysis, evaluation, control, monitoring, incident management
- When each activity is appropriate in the lifecycle
- Plans and integrates CRM activities into lifecycle phases
- Applies CRM activities in practical scenarios
- Works systematically and proportionately
- Avoids ad hoc or informal risk management
Learning outcome 2
Demonstrates understanding of key CRM activities across the lifecycle.
Content guidance
1. Phases of clinical risk management, including outputs
Risk analysis: scoping, hazard identification, initial risk assessment.
Risk evaluation: Risk assessment including initial and residual, training, controls assurance.
Risk controls: monitoring, incident management, change control.
Repeating these activities throughout the lifecycle of the product: Development, deployment and decommissioning.
Incident management and ongoing monitoring.
2. Sequencing and proportionality
Avoiding box-ticking — CRM commensurate to the system risk profile.
Iterative re-assessment when scope or evidence changes.
Last edited: 16 July 2026 9:45 am