The ISO 12971 standard on risk management for medical devices describes risk analysis tools such as PHA, FTA, FMEA, HAZOP, and HACCP but does not provide the depth needed to use the tools correctly.