RISK MANAGEMENT POLICY
Page 1 of 7
Reviewed October 2016
Policy Applies to:
CEO and Executive will facilitate compliance with this policy with the
Board of Directors
Mercy Hospital staff
Credentialed Specialists
Allied Health Professionals, Contractors, Students, Visitors and Patients.
Related Standards
AS/NZS ISO 31000:2009 Risk Management – Principles and guidelines
EQuIP Criterion 2.1.2 – Integrated Organisation-wide Risk Management
Framework ensures that Corporate and Clinical Risks are Identified,
Minimised and Managed
NZS [Link] 2.3 Health and Disability Services Standards: Quality and risk
management systems
Health Quality Safety Commission (HQSC); Reportable Events Policy March
2012
Hazard Analysis Critical Control Point (HACCP) Food Safety Programme –
New Zealand Food Safety Authority
Rationale
Mercy Hospital will minimise and manage the inherent risks involved in
providing healthcare services.
Objectives:
To identify actual and potential risks associated with all aspects of Mercy
Hospital’s operation.
To prioritise each identified risk using a standardized tool
To develop and implement action plans to mitigate each risk appropriately
To ensure a robust system is in place to report, monitor and review each risk
Definitions:
Risk:
The effect of uncertainty on objectives
IS0 31000 states:
“a risk is a future event and not something that is currently happening, but it
could….there is no guarantee that it will happen but it is likely to be subject to a
probability which we can predict. It will also have a cause and a consequence”
RISK MANAGEMENT POLICY
Page 2 of 7
Reviewed October 2016
Risk Categories:
Risk at Mercy Hospital will be categorized as one of the following: Clinical; Infra-structure
Operational; Corporate governance; Environmental
Risk Management:
Coordinated activities to direct and control an organization with regards to risk
Risk Assessment:
Risk assessment is a process that is used to identify the level of risk utilizing a likelihood
and consequence matrix.
Likelihood: the state or fact of something’s being likely; probability
Consequence: a result or effect, typically one that is unwelcome or unpleasant
Likelihood x Consequence (Table 1) = Level of Risk
Implementation:
All policies and processes support risk mitigation at Mercy Hospital
Heads of Departments are responsible for identification and active review of
the Departmental Hazard Registers in conjunction with their Health & Safety
Infection Control (HSIC) representatives. Significant risks are elevated to the
appropriate Executive member for assessment and discussion at the weekly
Executive meeting.
The CEO manages an Organisational-wide Risk Register. Items on this
Register require action and review at specified intervals according to the risk
identified.
The CEO (or designate) has responsibility to notify Mercy’s insurer where the
level of risk (ref: Table 1) is deemed to be ‘Severe’
Risk assessment is standardised using appendix 1.
Review is managed according to the level of risk and the control measures in
place – each review is documented on the Risk Register
Education is provided for staff to ensure the risk assessment and management
procedures are disseminated, discussed and applied consistently via HODs,
HSIC representatives, incident reports, completion of action plans, feedback
and meeting minutes
Evaluation
Current Action plans for the Organizational-wide Risk Register are reviewed
at Executive, Quality and Risk Advisory Committee and Board of Directors
Meetings monthly.
RISK MANAGEMENT POLICY
Page 3 of 7
Reviewed October 2016
All other Organizational-wide risks are reviewed at the date specified on the
Register.
Completion of actions relating to Incidents and / or Complaints, feedback via
staff, meeting minutes and patient questionnaire all contribute to risk
evaluation.
Risk Management Audit - annually
Associated Documents
External
HB 228.2001 Guidelines for Managing Risk in Healthcare
EQuIP Standard 2.1 – Quality Improvement and Risk Management,
Criteria 2.1.1 and 2.1.2
Policy for the Management of Healthcare Incidents Draft Version 0.7,
NZ Health & Disability Sector Safety Improvement Programme
HB:2011, Risk Management-Guidelines on Risk Assessment
Techniques. Standards Australia/ Standards New Zealand
HQSC Reportable Events Policy
Health & Safety at Work Act 2015
Internal
Quality and Risk Advisory Committee Terms of Reference
Quality and Risk Frameworks and Plan
Emergency Plan
Fire Plan
Incident Management Policy
Complaints Policy
Delegation of Authorities Policy
Credentialing Policy
Hazard Management Policy
Health and Safety Policy
Process:
Risk Identification:
The following are examples to assist in identifying and categorizing risk:
1. Clinical
Patient care
Products
Infection control
Staff
Credentialed Specialists
RISK MANAGEMENT POLICY
Page 4 of 7
Reviewed October 2016
2. Infra-structure
Building maintenance
Equipment
Business continuity
Staff Health & Safety (Linked to Hazard Registers)
Disaster planning
3. Business Integrity
Integrity of financial systems
Interruption of IT systems/communication system failure
Political environment
Security of revenue lines (ACC, DHB contracts, Private insurance, Self
funding)
Business interruption
4. Corporate governance
Legislative compliance
Cultural aspects
Governance surety
Political environment
Mercy Ethos
Risk Assessment: Document the Level of Risk and assign a quantitative value
using Table 1
RISK MANAGEMENT POLICY
Page 5 of 7
Reviewed October 2016
Table 1: Level of Risk
Likelihood Consequences
Severe 5 Major 4 Moderate 3 Minor 2 Minimal 1
Hospital Operations Significant Some disruption Minor problem
survival is at severely time/resources possible easily handled
risk disrupted required to by normal day to
mitigate day processes
Almost
certain (e.g. Extreme Extreme Extreme High High
>90% chance of 25 20 15 10 5
occurring) 5
Likely
(e.g. between Extreme Extreme High High Moderate
50% and 90% 20 16 12 8 4
chance of
occurring) 4
Moderate
(e.g. between Extreme Extreme High Moderate Low
10% and 50% 15 12 9 6 3
chance of
occurring) 3
Unlikely
(e.g. between Extreme High Moderate Low Low
3% and 10% 10 8 6 4 2
chance of
occurring)) 2
Rare
(e.g. <3% High High Moderate Low Low
chance of 5 4 3 2 1
occurring) 1
Document required information on Appendix 1 ‘General Risk Assessment
Worksheet’.
This will form the background information required for discussion at Executive
meeting.
Executive will assign a Risk Rating utilising Table 3 and the risk will be entered
onto the Organisational Risk Register along with a documented review date.
Reporting requirements will be determined and undertaken as specified in Table
2.
RISK MANAGEMENT POLICY
Page 6 of 7
Reviewed October 2016
Table 2: Overall risk rating
Qualitative level of risk Quantitative level of risk Reporting requirements
Low 0-4 Manage within existing controls.
Monitor annually
Moderate 5-9 Manage within existing controls.
Monitor 6 monthly
High 10-15 Evaluate efficiency of existing controls.
Develop and implement additional control
mechanisms
Monitor quarterly
Extreme 16-25 Implement mitigation plan
Escalate/report to BOD
Monitor monthly or more frequently as deemed
appropriate
Risk Control: Document the Risk Control Rating using Table 3.
This table is a guide when considering risk control strategies – not all criteria will
necessarily be met for any given rating
Table 3: Risk Control rating
Rating Work Processes Staff Awareness Financial
Protection
Excellent All key work processes Comprehensive risk reporting at Comprehensive
documented and all levels. insurance in
monitored. Staff and Managers provide place.
Regular and timely reports of all
comprehensive audit of incidents/risks and take action to
work processes and legal prevent recurrence and minimize
compliance issues. liability.
Actions taken to address Actions taken are fully
risks identified through documented and monitored for
audit. effectiveness.
Mercy Hospital Staff and Managers work together
accredited to external to address risk issues, using a
standards. systems approach.
RISK MANAGEMENT POLICY
Page 7 of 7
Reviewed October 2016
Rating Work Processes Staff Awareness Financial
Protection
Continuous All permanent staff and managers
improvement actively managing their specific
methodologies used. risks.
Very Good Policies, protocols, Risks are reported, acted upon, Comprehensive
guidelines in place and and actions fully documented – insurance in
compliance is regularly but not monitored for place.
monitored. effectiveness in mitigating future
Actions taken to address risk.
issues. Most staff and managers actively
managing their specific risks.
Good Policies, protocols, Risks reported and actions taken – Adequate
procedures, guidelines in but not fully documented. insurance in
place but compliance is Risks managed in an ad hoc place.
monitored on an ad hoc fashion.
basis.
Adequate Policies, protocols, Risks reported and actions taken Adequate
procedures, guidelines in on serious risks. insurance in
place but compliance New staff orientated re risk place.
with these is management.
unknown/not
monitored.
Unacceptable Some policies, protocols, Risks not reported and actions not Inadequate
procedures, guidelines in taken to prevent recurrence in any insurance over
place, but staff not aware systematic fashion. or risk
of them. Most staff not aware of risk uninsured.
management.
Does this involve a Health and Safety hazard? Yes No (if yes forward copy to IPC/OH Nurse)
Reference:
Vector Consulting (Megan Hopper): November 4th 2015 @ DAAGroup seminar “Risk
Management”
