Skip to main page content
U.S. flag

An official website of the United States government

Dot gov

The .gov means it’s official.
Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.

Https

The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

Access keys NCBI Homepage MyNCBI Homepage Main Content Main Navigation
. 2018 Jul 24;18(1):578.
doi: 10.1186/s12913-018-3400-7.

Development of an enterprise risk inventory for healthcare

Ana Paula Beck da Silva Etges  1   2   3 , Veronique Grenon  4   5 , Ming Lu  4 , Ricardo Bertoglio Cardoso  6 , Joana Siqueira de Souza  6 , Francisco José Kliemann Neto  6 , Elaine Aparecida Felix  7
Affiliations

Development of an enterprise risk inventory for healthcare

Ana Paula Beck da Silva Etges et al. BMC Health Serv Res. .

Abstract

Background: The first phase of an enterprise risk management (ERM) program is the identification of risks. Accurate identification is essential to a proactive and effective ERM function. The authors identified a lack of such risk identification in the literature and in practical cases when interviewing the chief risk officers from healthcare organizations. A risk inventory specific to healthcare organizations that includes detailed risk scenarios and risk impacts currently does not exist. Thus, the objective of this research is to develop an enterprise risk inventory for healthcare organizations to create a common understanding of how each type of risk impacts a healthcare organization.

Method: ERM guidelines and data from 15 interviews with chief risk officers were analyzed to create the risk inventory. The identified risks were confirmed through a survey of risk managers from a range of global healthcare organizations during the ASHRM conference in 2017. Descriptive statistics were developed and cluster analysis was performed using the survey results.

Results: The risk inventory includes 28 risks and their specific risk scenarios. Cyberattack was ranked as the principal risk by the participants, followed by sentinel events and risks associated with human capital management (organizational culture, use of electronic medical records and physician wellness). The data analysis showed that the specific characteristics of the survey participants, such as the length of time working in risk management, the size of the organization, and the presence of a school of medicine, do not impact an individual's opinion of the importance of the risks identified. A personal background in risk management (clinical or enterprise) was a characteristic that showed a small difference in the perceived importance of the risks from the proposed risk inventory.

Conclusions: In addition to defining specific risk scenarios, the enterprise risk inventory presented in this research can contribute to guiding the risk identification phase of an ERM program and thereby support the development of a risk culture. Patient data security in hospitals that operate with high levels of technology is fundamental to delivering high quality and safe care to patients. At the top of the risk ranking, the identification of cyberattacks reflects the importance that healthcare risk managers place on this risk by allocating time and other resources. Exploring opportunities to improve cyber risk management and evaluating the benefits of using the risk inventory at the beginning of the risk identification phase in an ERM program are suggestions for future studies.

Keywords: Enterprise risk management; Healthcare; Healthcare management; Risk analysis; Risk identification; Risk inventory.

PubMed Disclaimer

Conflict of interest statement

Authors’ information

APBSE, Msc. Eng.: is a Researcher at the National Health Technology Assessment Institute (CNPq, Brazil), is a Professor at the School of Technology of PUCRS (Brazil), and serves as a consultant in Brazil for projects focused on measuring the economic impact of risks, assessing health technologies and developing models to improve companies’ ability to make strategic decisions.

VG, Actuary: is a fully trained actuary and serves as the Managing Director of Guy Carpenter & Company, LLC.

ML, Data Scientist: serves as a Data Scientist at The Risk Authority Stanford.

RBS, Msc. Eng.: is a researcher and a PhD student in the Industrial Engineering Program at The Federal University of the South of Brazil (UFRGS).

JSS, PhD. Msc. Eng.: serves as a Professor in the Industrial Engineering Program at The Federal University of the South of Brazil (UFRGS) and also conducts research focused on enterprise risk management.

KFN PhD. Msc. Eng.: serves as a Professor in the Industrial Engineering Program at The Federal University of the South of Brazil (UFRGS) and also conducts research focused on cost management and economic analysis.

EAF PhD. Msc. MD.: serves as a Professor in the School of Medicine at The Federal University of the South of Brazil (UFRGS) and also conducts research focused on clinical and enterprise risk management.

Ethics approval and consent to participate

All interviewees (the 15 managers in the first interviews and the 53 participants) were invited to participate and agreed to have their data analyzed.

This research was conducted by the Industrial Engineering Department of the Federal University from the South of Brazil, which approved the conduct of the research.

Consent for publication

Not applicable.

Competing interests

The authors declare that they have no competing interests.

Publisher’s Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Figures

Fig. 1
Fig. 1
Research methods
Fig. 2
Fig. 2
Risk inventory survey example
Fig. 3
Fig. 3
Risk ranking according to the 53 participants
Fig. 4
Fig. 4
Type of risk management and time working in risk management
Fig. 5
Fig. 5
Differences between participants from hospitals with fewer and more than 1000 employees
Fig. 6
Fig. 6
Differences between participants working in organizations with and without a school of medicine
Fig. 7
Fig. 7
Agree x disagree - risk inventory confirmation
See this image and copyright information in PMC

References

    1. Damodaran A. Gestão estratégica do risco. 2008.
    1. Aven E, Aven T. On the need for rethinking current practice that highlights goal achievement risk in an Enterprise context. Risk Anal. 2015;35:1706–1716. doi: 10.1111/risa.12375. - DOI - PubMed
    1. Committee of Sponsoring Organizations of the Treadway Commission. COSO Enterprise Risk Management: Integrating with Strategy and Performance. 2017; June.
    1. Woodruff JM. Consequence and likelihood in risk estimation: a matter of balance in UK health and safety risk assessment practice. Saf Sci. 2005;43:345–353. doi: 10.1016/j.ssci.2005.07.003. - DOI
    1. Card AJ, Ward JR, Clarkson PJ. Trust-level risk evaluation and risk control guidance in the NHS east of England. Risk Anal. 2014;34:1469–1481. doi: 10.1111/risa.12159. - DOI - PubMed