ISO 14971 requires top management to define and document a policy for establishing criteria for risk acceptability. Here are 5 elements and best practices to consider when establishing your policy.