Hospital E-Prescribing Risk Assessment Before Go-Live
A 600-bed hospital is introducing an electronic prescribing and medicines administration system in 14 weeks. The risk assessment workshop is attended by six people: three IT staff, two pharmacists and the vendor's implementation lead. Nursing, junior doctors, patients and the medicines safety officer are not invited. The team scores 22 risks on a 1–5 likelihood and 1–5 impact matrix, but no criteria define what score requires escalation or treatment. The highest-scoring risk is 'clinician resistance to change', scored 20, and the treatment plan is 'deliver two training sessions'. Monitoring relies on incident reports after go-live; no pilot or simulation is planned. The project board asks whether the risk process is sufficient for go-live. The clinical director notes that a similar system at another trust had prescribing errors because of poor configuration of paediatric doses.
1. Evaluate the adequacy of communication and consultation in this risk assessment.
Read the worked answer
Communication and consultation are inadequate because the workshop excludes the people who create, experience and control the risks. Nurses, junior doctors, the medicines safety officer and patients are not present. IT and pharmacy can describe technical configuration and dispensing issues, but they cannot reliably predict workarounds, alert fatigue or paediatric prescribing errors at the point of care.
ISO 31000 treats consultation as a two-way process that helps identify, understand and evaluate risk, and it should occur throughout the process, not only at sign-off. The absence of the medicines safety officer is particularly serious because the known failure mode from the other trust concerns paediatric dose configuration. Excluding patients also weakens consideration of consent, communication and accessibility.
The practical fix is not to add names to the attendance list without changing the method. The team should run targeted sessions with nursing and prescribers, use scenario walkthroughs for paediatric doses, record concerns and feed them into risk analysis. Consultation should continue through design, pilot and go-live, with a defined route for staff to report emerging risks.
2. Assess the treatment for 'clinician resistance to change' against ISO 31000 risk treatment requirements.
Read the worked answer
Training is a possible treatment, but here it is only a slogan. ISO 31000 requires treatment options to be selected, a treatment plan to be formulated and implemented, and residual risk to be assessed. 'Deliver two training sessions' does not state who owns the action, when it will happen, what success looks like, or how the residual risk will be evaluated.
More importantly, the risk description is weak. 'Clinician resistance' is a label, not an event with causes and consequences. Resistance may be a symptom of poor usability, excessive alerting, loss of clinical autonomy or workflow misalignment. If those causes remain, training may suppress complaints without changing behaviour, and workarounds may create prescribing errors. A better treatment portfolio might include user-centred design review, clinician champions, simulation of paediatric scenarios, a pilot with feedback loops, and visible escalation of configuration defects.
The team should also test whether training actually reduces likelihood or impact. If the residual risk remains high, it should be escalated to the project board with a documented acceptance decision.
3. Recommend changes to monitoring and review before and after go-live.
Read the worked answer
Monitoring should not begin with post-go-live incident reports. Those are lagging indicators and may reveal harm after patients are affected. Before go-live, the team should define review points and leading indicators: completion and results of simulation testing, proportion of paediatric dose rules verified, number and severity of unresolved usability defects, training completion by role, and readiness of the support model.
A pilot or shadow mode should be considered, with daily review of prescribing errors, alerts overridden and user-reported problems. After go-live, monitoring should combine incident reporting with proactive data such as error logs, help-desk themes and audit of high-risk medicines. Triggers should be set - for example, a defined rate of dose errors or a cluster of alerts bypassed - and assigned to named owners.
ISO 31000 expects monitoring and review to be planned, to cover both the risks and the effectiveness of treatment, and to feed back into the process. The project board should receive a short readiness report with residual risks and a clear go/no-go recommendation, not just an incident count after the event.