The Control That Everyone Trusts
A hospital pharmacy dispenses high-risk medicines through a computerised system. The key control is a pharmacist's second-check of dose calculations before dispensing. An internal review finds that the second-check is performed by the same pharmacist who did the first check in about 30% of cases, because the system allows a single login to be used for both steps when the pharmacy is busy. The pharmacy manager says the control is 'designed correctly' and the 30% figure reflects 'exceptional pressure, not a design flaw.' There have been no dispensing errors in the past two years. A new electronic prescribing module is being procured, and the vendor offers a 'second-check' feature that requires a different user login. The pharmacy manager argues the new feature is unnecessary because the current process works and the error rate is zero. The review also notes that the second-check is not documented, so there is no record of who performed it.
1. Evaluate the effectiveness of the second-check control as currently operated. Distinguish design effectiveness from operating effectiveness.
Read the worked answer
The control is designed plausibly but is not operating effectively, and the design itself has a gap.
Design effectiveness: the concept - an independent second check of high-risk calculations - is a sound control. But the design permits a single login to satisfy both steps. A control that can be satisfied by the same person performing both steps does not, by design, deliver independence. That is a design flaw, not merely an operating lapse. Independence is the control's whole point; if the system does not enforce it, the design is deficient.
Operating effectiveness: in 30% of cases the same pharmacist performed both checks. Those 30% of dispensings had no independent verification at all. The control was absent, not weak, for nearly a third of transactions. The manager's framing - 'exceptional pressure, not a design flaw' - conflates the trigger with the defect. Pressure explains why staff took the shortcut; it does not make the shortcut safe. If the process only works when nobody is busy, it does not work.
The zero-error record is not evidence of effectiveness. Two years without a detected error is consistent with (a) the control working, (b) errors occurring but not being detected, or (c) errors being detected and not recorded. Without documentation of who performed each check, the organisation cannot distinguish these. The absence of recorded errors is not the same as the absence of errors.
Documentation gap: an undocumented control cannot be tested, audited, or defended. If a serious dispensing error occurred, the pharmacy could not demonstrate that a second check took place.
2. Should the hospital buy the vendor's enforced second-check feature? Justify your answer and describe any residual controls needed.
Read the worked answer
Yes - the feature addresses the specific design defect identified. The argument that it is unnecessary because the error rate is zero does not hold: the zero is unverified and the control is known to be bypassed 30% of the time. Buying a feature that enforces independence converts an unreliable manual control into a reliable automated one. That is a proportionate response to a high-severity risk in a high-risk medicine process.
Justification points:
- It removes the single-login bypass, which is the root cause of the 30% failure.
- It creates an audit trail of who performed each check, making the control testable.
- The cost is likely small relative to the severity of a high-risk medicine error.
Residual controls still needed:
- Workload management. If the system enforces independence but staffing does not allow it, staff will find another workaround (e.g., sharing logins). The underlying pressure must be addressed: staffing levels at peak, or a queuing rule that high-risk items wait for a second pharmacist.
- Exception handling. Define what happens when no second pharmacist is available. An explicit, logged exception with a compensating check (e.g., a delayed check before administration) is safer than an invisible bypass.
- Monitoring. Sample the audit trail monthly to confirm the second check is genuinely independent, and track exceptions as a leading indicator.
- Culture. Staff must be able to report pressure and near-misses without blame, or the next workaround will be invisible too.
- Testing. Include the enforced check in the validation of the new e-prescribing module before go-live.