A risk workshop that produced a red heat map but no priorities
St Aldate's Hospital is a 600-bed acute trust preparing to go live with a £45m electronic patient record (EPR) system in nine months. A risk workshop used a five-by-five likelihood-impact matrix. Clinicians scored 'patient harm from misconfigured order sets' as likelihood 2, impact 5. IT scored 'loss of data integrity during migration' as likelihood 4, impact 4. Both appear as similar red cells on the board heat map. The workshop involved 18 people, but there was no agreed definition of the likelihood timeframe, no distinction between inherent and residual risk, and no record of existing controls. The risk register now contains 212 risks, 178 rated medium or high; 60 have no named owner. The board paper shows a heat map that is mostly red and asks whether the EPR programme is 'out of control'. The programme director wants a rapid review before the next board meeting.
1. Identify the main weaknesses in the risk assessment and risk register, and explain how each weakness could distort the board's view.
Read the worked answer
Weaknesses include:
- Undefined likelihood timeframe and criteria: clinicians and IT scored on different scales. A '2' for patient harm may mean once in ten years, while IT's '4' may mean once a year, yet the heat map treats them as comparable.
- No control assessment: scores mix inherent and residual risk, so a red cell may reflect a well-controlled risk or an uncontrolled one. The board cannot tell which red cells need action.
- No calibration or facilitation: 18 participants without definitions invites anchoring and groupthink; scoring becomes opinion rather than evidence.
- Register inflation: 212 risks with 178 medium or high means material and trivial risks are indistinguishable. The board cannot prioritize.
- Missing owners for 60 risks: no accountability for treatment or monitoring.
- Undifferentiated impact: patient safety, data protection, financial and reputational impacts are not comparable on one 1-5 scale without descriptors.
- No linkage to objectives or tolerances, so the board has no benchmark for 'out of control'.
Consequently the board sees 'mostly red' and concludes loss of control, when the real issue is an uncalibrated assessment process. The heat map is being used as a reporting artefact rather than a decision tool.
2. Recommend a more defensible approach to assessing and reporting the EPR risks, including suitable techniques and governance.
Read the worked answer
Recommended approach:
- Define likelihood by time horizon and probability bands (e.g., before go-live, within one year, within three years) and impact by dimensions with explicit descriptors. Separate patient safety (use a clinical severity scale) from financial and data protection impacts.
- Assess inherent and residual risk separately; record controls, control owner, evidence and effectiveness rating.
- Use bow-tie analysis for the highest-consequence patient safety scenarios (order-set misconfiguration, data migration integrity) to identify preventive and mitigating barriers. Use scenario analysis and Delphi for migration risk.
- Tier the register: a programme-level top 20 risks owned by the programme board; workstream registers for the rest; aggregate related risks.
- Assign every risk an owner and an action with a due date and clear acceptance criteria.
- Report trend, movement since last period, control effectiveness and risks outside tolerance. Use a heat map only as a summary, with a table for top risks.
- Obtain independent review by the clinical safety officer and internal audit before go-live.
This gives the board a defensible basis to judge whether the programme is in control, not just whether the map is red.