The core principles that drive decision-making for prioritizing and mitigating risk are likely embedded deep in most risk managers’ brains, but as with many other bits of knowledge a review of the basics can be both reinforcing and refreshing. Our day-to-day work keeps us so busy we may not have the opportunity to provide basic education to organizational leaders, members of our department, physicians and staff about exactly what risk management is. Reinforcing these principles can help demonstrate how a robust risk management program supports achievement of the organization’s mission and vision.
The five basic risk management principles of risk identification, risk analysis, risk control, risk financing and claims management can be applied to most any situation or problem. One doesn’t realize that these principles are actually applied in daily life over and over until examples are brought to light. Using everyday examples in education programs as a way of introducing the principles, and then transitioning to scenarios and problems faced in patient care and healthcare operations, can be an effective teaching tool when promoting the contributions that risk management makes to the organization’s success.
Risk identification is just what it sounds like – what risks are presented to me/my patient/my organization with the scenario in front of me? Using the everyday example of riding in or driving a car, one might identify the risk of having an accident due to poor maintenance of the car, failure to keep gas in the tank, speeding or driving under the influence. Other identified risks may be the risk of damaging property – either the car itself or someone else’s property. There is a risk of financial loss if there isn’t proper liability insurance in place, or if one gets a speeding ticket, and so forth.
The analysis of the risks identified begs one to ask, what is the worst that could happen? Put another way, how often could these adverse events happen (frequency), and if it does happen, what’s the worst it could be (severity)? In our car scenario, the worst that could happen is someone loses their life. Additional analysis may determine the risk of being in an auto accident is low because the driver is never on the highway, only drives in good weather during daylight, on roads with speed limits of 30 miles per hour or less, in a well-maintained car, etc. As one can see, the analysis part of the risk management process should take the individual through several of these "what if" questions to help arrive at potential frequency and severity of an event.
Risk control offers opportunities for risk avoidance, risk prevention and risk reduction. The risk avoidance technique in our car example would be to not own a car or ride in a car. In reality, a minimal amount of risk still exists in that one could be hit by a car as a pedestrian, but in some scenarios, risk can be completely avoided. Risk prevention aims to reduce the frequency or likelihood of the event or loss. This might mean preventing car breakdowns by following maintenance and inspection schedules, keeping air in the tires and gas in the tank and following all driving laws. Risk reduction aims to lower the severity of a particular loss that has already occurred, for example ensuring property damage to another person’s vehicle is repaired quickly so the time they are without a car is limited. The risk control program implemented will consider the various strategies already in place, and may introduce new techniques based on the findings of the analysis activity.
The fourth principle, risk financing, is a way to finance losses that the risk control techniques implemented did not stop from happening. In our example, even with all the proper maintenance on the car, safe driving, etc. an accident may still occur. By having appropriate automobile insurance, funds are generated by the insurance company to pay for the losses, or in this case, damage to the car.
The fifth principle is claims management. When a loss occurs, a claim may be filed to recover damages. In the car example, a claim may be filed with the driver at fault’s insurance company to recover for the damage that occurred. If the driver at fault was not insured, a different course of action may be necessary to hold the driver personally responsible for paying for the damage.
When educating others in the organization about risk management, using an example such as the one outlined above can help make sense of what they may otherwise think of as a bit of a mystery. Engaging the audience with photos of scenarios can help start the conversation and enlist their feedback by posing different questions. Bring the education closer to home by using a healthcare example and walking through the five steps. For example, the scenario of a patient coming through the emergency department who needs to go directly to the operating room provides many points to discuss with risk identification, analysis and control. This also offers an opportunity to discuss the risk financing in place through the professional liability program and an employee’s obligations for reporting adverse events and near misses.
Using the claims management principle, elements of medical negligence can be presented and applied to a potential adverse outcome scenario. While the first application of the five risk management principles may not be perfect, continuing to apply them in an educational framework in as many situations as possible will help to reinforce the understanding of how risk management works.
As healthcare risk management programs continue to evolve into an enterprise risk model, these basic principles still apply. Integrating each of the five elements into the decision-making process to manage uncertainty in the organization while adding value and maximizing opportunity to meet the mission and vision will continue to ensure the backbone of the risk management program remains intact.
Ann D. Gaffey, RN, MSN, CPHRM, DFASHRM, SVP, Healthcare Risk Management and Patient Safety