Fundamentals of Risk Management

Part Four of this book considers risk response options in more detail. For hazard 
risks and control risks, the risk register is the location for recording details of the signi-
ficant threats. Detailed analysis of risk improvement plans will be required. Often, risk 

---

Risk management context
255
improvement plans will require capital expenditure, and this may need to be approved 
via the expenditure authorization procedures in the organization.
It has become standard practice to produce a risk register for projects, especially 
for construction and software projects. Risks to construction and software projects 
can create a lot of uncertainty and the risks will usually be control risks. Again,
the record of the actions taken to minimize the uncertainty should be a dynamic one, 
and further actions should be planned.
It is a common criticism of risk registers that they are undertaken once or twice
a year and represent a static snapshot of the risks facing the organization. In order 
to be effective and make a significant contribution, risk management needs to be
a dynamic activity that produces outputs that have an impact on the organization.
If this is going to happen, then the risk register needs to become a document that 
drives changes and improvements. Perhaps, it would be better if the risk register was 
referred to as the ‘risk management action plan’ for the organization.
Event reports, analyses and recommendations are related to recording details of
the events that occur and managing the impacts and consequences of those events. 
Details of incident investigations and analysis of the performance of business opera-
tions, together with risk improvement recommendations, are all covered by this type 
of risk management documentation. Risk improvement recommendations address 
significant control weaknesses and aim to eliminate the potential for future material 
or significant failures.
Recording of events is an important activity, especially in relation to hazard risks. 
Also, recording and analysing events during a project will be vitally important.
Event reports are most relevant to hazard and control risks. Annual evaluation of 
risk performance will also give rise to reports that require detailed analysis. Evaluation 
of risk performance is an important role for internal audit.
Clinical risk management is a well-developed branch of the risk management 
discipline. Accurate record keeping is vital in order to identify that appropriate risk 
mitigation actions have been put in place, as well as to provide records of any clinical 
mishaps that occur. The box below provides an overview of the importance of record 
keeping in relation to managing clinical risk.
Even if all adverse clinical events could be avoided, the legal cost of malpractice litigation 
cannot be eliminated. While very few negligent injuries lead to claims, there are many 
negligence claims in cases where there was no injury and no negligence. This means that,
if the right risk management processes and systems are in place, hospitals and doctors 
should be able to rebut allegations of negligence in these circumstances and successfully 
argue that no compensation payment should be made.
The implementation of risk management activities in hospitals is the immediate 
responsibility of hospital management. Nevertheless, doctors have a vital role to play by 
developing an understanding of the importance of risk management and helping to devise
a practical approach to recording that procedures have been followed and any incidents 
have been recorded.
Managing clinical risk

---