Wexcombe NHS Trust: Training Delivered, Behaviour Unchanged
Eighteen months ago Wexcombe NHS Trust introduced a risk management framework: a policy, a corporate register and mandatory training. Training attendance reached 92%. The register holds 300 risks. Fifty-eight per cent of responses are recorded as 'monitor'. Risk is formally discussed once a month at the Quality Committee and nowhere else - ward huddles, directorate meetings and capital bid reviews have no risk item. A staff survey found 38% agreement with the statement 'raising a concern here is career limiting'. Three serious incidents during the year had all been raised informally with a line manager before they occurred and none reached the register. Capital bids continue to be assessed on benefits and cost alone, with no risk section. The trust's board asks you to demonstrate that risk management is embedded, not merely implemented.
1. Distinguish implementation from embedding, and assess the evidence in the scenario against that distinction.
Read the worked answer
The distinction. Implementation means the components exist: a policy, a register, trained people, a reporting cycle. Embedding means risk management changes what people actually do when they make decisions - how they prioritise, how they spend, how they escalate, what they say in a meeting when a concern arises. Implementation can be measured by attendance; embedding can only be measured by behaviour and by outcomes.
The evidence here points strongly to implementation without embedding.
- 92% training attendance shows the training happened; it says nothing about whether anyone applies it. Attendance is an input metric.
- Risk discussed only at one monthly committee shows risk management is a location rather than a practice. If a ward manager's decision-making is unchanged for the other 29 days, the framework is peripheral.
- 58% of responses recorded as 'monitor' suggests responses are not being designed at all. 'Monitor' is an admission that no treatment has been chosen, and it will be the default whenever owners lack authority or time.
- 38% agreement that raising a concern is career limiting is the decisive finding. Where speaking up carries personal cost, no framework will surface real risk. The three serious incidents raised informally and never registered confirm this is not perception but behaviour.
- Capital bids with no risk section show the framework has not reached the highest-value decisions. If risk does not appear where money is committed, it is not informing decision-making.
Conclusion to give the board. The trust has a functioning compliance system and an absent risk culture. More training will not close that gap; it would only raise attendance further.
2. Recommend three interventions you would prioritise, with reasoning for the order.
Read the worked answer
Prioritise by what blocks everything else. The order is speaking up, then decisions, then routine practice.
1. Make it safe to raise a concern (months 1–4). This comes first because every other measure depends on it. A register fed only by what people feel safe to record is worthless, and the trust now has evidence that concerns are being suppressed. Practical steps: a protected route to raise a risk that bypasses the immediate line manager; explicit, visible backing from the executive team, including a case where a concern was raised and the raiser suffered no detriment; and a named non-executive who receives the log of registered concerns and their outcomes. Measure take-up monthly. If registrations fall after an initial rise, the route is not trusted.
2. Put risk into the decisions that commit resources (months 2–6). Require a risk section in every capital bid: what could prevent the benefits, the downside case, who owns each risk and what treatment is funded. This comes second because it is where the framework earns its place - and it forces executives, not just risk staff, to use it. Without this, embedding remains a middle-management exercise.
3. Move risk into routine operational practice (months 3–9). Add a standing two-minute risk item to ward huddles and directorate meetings, with a simple rule: anything raised is captured, given an owner and a date, or explicitly closed. Retire 'monitor' as an acceptable response by requiring every risk above a threshold to have a chosen treatment and a named action owner.
The sequence matters. Doing step 3 first produces a tidy register built on silence. Doing step 2 first without step 1 produces documents that people fill in defensively. Safety, then decisions, then habit.
3. Propose measures that would demonstrate over twelve months whether embedding is actually happening.
Read the worked answer
Measures should capture behaviour and outcomes, not activity. Organise them in four groups and report them to the board quarterly with a baseline.
Voice and escalation. Number of risks raised through the protected route per month, and repeat raisers - a healthy sign, not a warning. Proportion of incidents and near misses that had a prior register entry; target should rise from the current near-zero. Time from concern raised to owner assigned. Staff survey agreement on 'I can raise a risk without detriment', with a target above the current 38%.
Decision quality. Percentage of capital bids containing a risk section and a downside case. Percentage of funded bids where a risk treatment was costed. Number of decisions where the risk position changed the outcome - the hardest but most telling measure; capture it by asking decision-makers at the point of approval.
Practice. Proportion of risks with a response other than 'monitor' above threshold. Percentage of risk owners at a level able to authorise their response. Number of directorates running a standing risk item, verified by sampling minutes rather than self-report. Proportion of entries with new evidence recorded each quarter.
Outcomes. Serious incidents preceded by a registered risk and active response; trend over four quarters. Actions overdue by more than one cycle.
Add two qualitative checks: interviews with ten frontline staff asking what they would do with a concern, and a review of three decisions taken without risk input, to see whether the omission was a judgement or an oversight. If the quantitative measures improve while the interviews still describe a culture of silence, the measures are being gamed - and that finding is itself the most useful output of the year.