Risk Assessment and Management
What this domain tests
Risk assessment is the engine that prioritizes everything else. Know a repeatable process: identify risks (regulatory change, billing patterns, privacy incidents, referral relationships, vendor access), assess likelihood and impact, score and rank, map to controls, assign owners, and monitor. Know the difference between inherent risk (before controls) and residual risk (after controls), and that controls must be tested, not assumed.
Know common healthcare risk areas: coding and billing accuracy, medical necessity documentation, Stark/Anti-Kickback referral arrangements, privacy and security of protected health information, vendor/business associate management, and exclusion screening of employees and vendors. Know that risk assessment should be periodic (commonly annual) and triggered by events such as mergers, new service lines, or regulatory change.
Traps to expect
- Inherent vs. residual: questions ask which risk remains after controls - residual.
- Control existence ≠ effectiveness: an untested control provides no assurance.
- Ignoring low-likelihood/high-impact risks such as a large breach.
- Static assessment: a one-time assessment never updated is a finding.
- Documentation: scoring rationale and decisions must be recorded.
Rule of thumb
Rank by likelihood × impact, then ask whether an existing control actually reduces the score. If you cannot describe how the control is tested, treat the risk as uncontrolled.
Worked example
A clinic adds telehealth across state lines. Likelihood of a licensure or privacy misstep is high; impact is moderate to high. Inherent risk scores high. Existing controls (credentialing verification, consent scripts) reduce it, but only if tested - e.g., auditing 10 encounters for licensure and consent. The residual score after verified controls drives whether to accept, mitigate further, or pause the service line.