Risk registers are an essential element of healthcare risk management. However, unless a framework is simple to use and consistently applied, the registers can produce a confused view of the risks your business faces or disengage staff from using them. Proactive risk identification is part of a culture of quality, safety and candour. Being open and honest about the risks in healthcare allows everyone to know what needs to be focused on and where investment needs to be made.
Here are my top tips to ensure organisations and their staff can maximise effective risk management:
1. Adopt an easy-to-use risk register: I often see two columns with the terms ‘inherent’ and ‘residual’ on registers being used inconsistently, frequently due to confusion about what the terms mean and therefore how to score the risks. The register needs to address the following factors:
• What is the initial risk score? Dispense with the term ‘inherent’ and its various definitions. Evaluate the risk as it stands.
• What controls do you currently have in place?
• Are the controls effective? And how do you know? This needs to be more than a ‘belief’; it must be based on verifiable evidence (assurance). A simple ‘rule of thumb’ helps staff to understand this: for every control is there a related ‘test’ that shows how well it’s working?
• Where are the gaps in control? Your action plan needs to address these.
• What is your current risk score, and has it improved? That is, are the actions you are taking reducing the risk?
• What is your target risk score? The term ‘residual’ is also used inconsistently, so aim for the risk score target. This will either be the lowest you can bring the risk score down to or the lowest that your organisation is willing to tolerate.
So that’s three risk score columns – initial, current and target, which will provide a much clearer understanding of progress.
2. Provide clear definitions: One person’s ‘Possible’ may be another person’s ‘Likely’ – much depends on each individual’s perspective, which is why it’s important to provide clear definitions and to discuss the risks with others to get a ‘sense check’. Remember, the consequence should reflect the most likely outcome, and not the worst case scenario.
3. Encourage a collaborative culture: One of my previous blogs centred on creating a culture of candour – support staff by encouraging openness and a willingness to admit where things have, or could go wrong, to help keep the organisation aligned and improve quality and safety as a result.
4. Be SMART with your action planning:
• S - Specific – what is required to be done by and by whom. If you’re allocating an action to someone, what’s your organisation’s process for letting them know?
• M- Measurable – how are you going know it’s been done? What needs to be in place to close off this action?
• A- Achievable – if actions aren’t able to be delivered within the organisation then is there a way to transfer the risk externally to deal with it?
• R– Realistic - can the required actions realistically be achieved within available resources? Think about adding a column to describe the investment needed to make it happen.
• T– Time – set deadlines for completion.
Instead of viewing the risk register as a compliance requirement, it should act as a living and breathing document that provides a roadmap for continuous improvement and forms part of a toolkit of effective risk management.
I'm Caroline White, Risk Control Director for International Healthcare at CNA Hardy, and I have over 25 years’ experience in the Healthcare sector. Follow CNA Hardy’s blog series on LinkedIn.
_________________________________
Any content, views, opinions and/or responses are solely the personal views, opinions and responsibility of myself and do not necessarily reflect the opinions of my employer CNA Hardy. Neither I nor my employer, CNA Hardy, warrants the accuracy, completeness or usefulness of the information available on this LinkedIn page. Nothing contained in or provided through this LinkedIn page is intended to constitute advice. Any reliance you place on such information is strictly at your own risk. I may include links to other web pages, but these links are not an endorsement of those pages.