A risk is an unplanned, unintentional event that could potentially complicate or degrade your healthcare organization’s service. They are inevitable on some level and come in many, often unpredictable, forms.
New staff or procedures are inherently riskier until they gather familiarity in your organization. Surgeons and doctors can get sick like anyone else and miss work. Oversights in paperwork will cause delays with material stocking and prescription fulfillment. Ideally, none of these things would ever happen, but we live in a human world where we must anticipate the unexpected.The risk management process sets out to find the likelihood of certain risks, the severity of their impact, and their relationship to expenses, timelines, and the quality of care that you provide. An effective structure can help identify the underlying causes of operational risks and direct your organization to anticipate or circumvent them.
In other words, you can be preventative rather than merely reactive—exactly how healthcare prefers to operate.
Use a Risk Breakdown Structure
In essence, a Risk Breakdown Structure (RBS) is a flowchart that groups all risks faced by an organization or project into structured categories. The categories are then broken down into levels, each with their own smaller component risks.
Implementing an RBS in healthcare is all about tracing connections between the broader risk areas and root causes of negative impacts on service quality, time, and cost in your daily operations and initiatives. The risk hierarchy follows their interrelationships through a forking tree from macro to micro (e.g., Internal Risk Sources→ Technology→ Information System→ Managing Antivirus).
Traditional risk management processes aim to identify risks and assess probability/impact, but simple lists fail to show the interconnections between those risks. A hierarchical structure (as in RBS) changes a list into a map—a structure that shows collateral impacts on the rest of the project and the broader scope of your operations. This has certain advantages, such as:
- Contextualizing the type of impact a small incident has on the organization.
- Enumerating the underlying sources of risk that affect broad categories like “Finances.”
- Tracking patterns of risk dependencies and correlations between risks.
- Enabling risk response development to focus on root problems and high-risk branches.
The RBS hierarchy is roughly analogous to the commonly used work breakdown structure (WBS). In a WBS, all work required on a project is given a systematic structure. Both models follow higher level categories down to finer level tasks, actions, or details.
It’s possible for the RBS to keep breaking categories down into parcels with progressively narrower focuses on specific sources of risk as far as makes sense. Typically, one RBS template is selected for the entire healthcare organization, and certain risk branches will naturally apply to some departments and services more than others.
The completed RBS, therefore, serves as a checklist. When managing a project, initiative, or service, the individual in charge can refer back to the comprehensive RBS map for your organization and check off only the risks applicable to their given project.
However, relying solely on the total number of applicable risks is misleading. What will separating a task with many minor risks look like compared to one with few significant risks? They must be compared and weighted to become valuable in decision making.
Prioritize Risks on Your RBS
Identified risks can be assigned scores from 1-5 for both their probability of occurrence and potential level of impact. Multiply those scores together, and you’ll have a risk score. This enables you to prioritize which risks deserve the most attention, resources, and preventative measures.
The way you structure your 1-5 spectrum of scores will be subjective and can differ between projects based upon the content of your RBS. Here are a few general considerations:
- Probability Rating: Low probability risks, with perhaps a 1 in 100 chance of occurrence, might be scored a 1. Very high probability (more than 1 in 2) could result in a score of 5. Choose ratios appropriate to the risks you anticipate.
- Impact Rating: Impacts can be on service cost, the time required, or quality/safety. Develop guidelines and a score spectrum for each. For example, a score of 1 might mean <1% cost impact, an extra day of time, or a quality decrease with no infection or actual harm. A 5 could mean >50% cost increase, an extra month of time, or potential for fatality.
- Generate a Risk Score: Multiply the ratings for probability and impact, and you’ll have a risk score between 1 and 25. This way you can see which risks are likely to affect you most, and rank them in priority.
- Multiple Impacts: It is not unusual for risks to impact more than one category of cost, time, and quality. It’s your choice whether to multiply the probability by the highest risk impact, or the average risk impact. Both are common methods.
To illustrate, consider a non-invasive surgery with a middling probability of infection (3). Such an infection might have a low impact on total time investment (1) and cost to the hospital (2), but a potentially high impact on patient care quality/health (4). The calculation using the highest risk and average risk methods would look like this:
- Highest Risk: Probability (3) x Health Impact (4) = Risk Score (12)
- Average Risk: Probability (3) x Average of Total Impact (7 ÷ 3 = 2.33) = Risk Score (7)
How you calculate risk scores can have substantial repercussions on evaluation and prioritization. Ultimately, your goal is for risk scores at the lowest level of your structure to helpfully inform decisions made higher up on the RBS hierarchy. Ratings will drive the focus of risk response development and resource allocation.
Learn, Manage, and Adapt
Once you’ve established your risk hierarchy and created a framework to rate probability and impact, the process of tracking information begins. The RBS provides a common language for analyzing risk-related data, rolling it up to management, and recording it for future reference.
Comparisons of risk exposure within one RBS area are possible across all projects and services since language and terms are now the same for each. Likewise, risks in different areas can be quantitatively compared due to the consistent framework.
A well-integrated RBS can become the most valuable tool for risk management in healthcare. By deconstructing possible risk sources into increasingly detailed layers of causality, management can see the impact of risks on objectives and use the data gathered on the RBS as a basis for action.
