1. Supporting the Health & Personal Social Services in Northern Ireland Risk Management APRIL - 2007

2. Supporting the Health & Personal Social Services in Northern Ireland

3. Definitions of Risk Management “…anything that could stop the organisation achieving its business objectives.” “The chance of something happening that will have an impact upon objectives. It is measured in terms of likelihood and impact.” (AS/NZS 4360:1999)

4. Supporting the Health & Personal Social Services in Northern Ireland Some Terminology Hazard - Confidential report being left in member of staff’s car Risk - Report falls into wrong hands and confidentiality is breached Incident – Car broken into and report taken Near Miss – Car broken into but report not taken

5. Supporting the Health & Personal Social Services in Northern Ireland An Example A trailing PC cable lying across the floor is a hazard. The risk is that someone trips over it. If the cable is noticed and cleared by a member of staff, it was a near miss If someone trips up and injures themselves before it is cleared away, this is an incident

6. Supporting the Health & Personal Social Services in Northern Ireland Why Manage Risks? Some Risk Control Failures: Barings Bank Zeebrugge Ferry Enron Hoover – New York Harold Shipman Organ Retention Inquiry Bristol Royal Infirmary

7. Supporting the Health & Personal Social Services in Northern Ireland Uncertainty RReports that say that something hasn’t happened are always interesting to me, because, as we know, there are known knowns; there are things we know we know. WWe also know there are known unknowns; that is to say we know there are some things we do not know. BBut There are also unknown unknowns –the ones we don’t know we don’t know” DDonald Rumsfeld UUS Defence Secretary (5 December 2003)

8. Supporting the Health & Personal Social Services in Northern Ireland Why is Risk Management an Issue in the NHS? 10.8% patients experienced an adverse event. Of these 49% judged preventable 34% developed injury or complication with moderate impairment 6% permanent impairment Contributed to death 8% (June 2003) 28,000 written complaints £400m per year settlement plus £2.4m liability (clinical negligence only) Hospital-acquired infections - £1billion annually. (February 2005)

9. Supporting the Health & Personal Social Services in Northern Ireland Why is Risk Management an Issue in the US? 98,000 deaths per year due to “medical error” 40% outpatient prescriptions deemed “unnecessary” 777,000 injuries or deaths caused by “adverse drug events” (2004)

10. £173 million! 135,172 accidents involving NHS staff at work Only 42% of accidents that are supposed to be reported under the law are reported. –Work related sickness/absence –Permanent injury benefits –Ill health retirements –Out of court payments(October 2003) Supporting the Health & Personal Social Services in Northern Ireland Cost of Work Related Accidents

11. Supporting the Health & Personal Social Services in Northern Ireland Consider the Risk Types Reputation Financial Legal Technical Environmental Political Others?

12. Supporting the Health & Personal Social Services in Northern Ireland Examples Economic problems. Obsolescence of technology. Fraud. Poor accounting systems. H&S. Professional. Environmental. Ineffective management. Staff turnover/Skills shortage. Poor service levels/Poor quality. IT Systems fail to cope.

13. Supporting the Health & Personal Social Services in Northern Ireland Benefits of Good Risk Management Links between Risk Management and business objectives. Fewer sudden shocks. Competitive advantage. Strategy-setting basis. Assists with change management. Reduction in the need for “fire-fighting.” Minimise damage and loss. Why would you not want to the above things?

14. Supporting the Health & Personal Social Services in Northern Ireland How Identify Risks? Round table discussions. Workshops. Questionnaires. Audits. SWOT analysis. Stakeholder analysis. Complaints. Sickness absence / staffing levels. New legislation and policy. Controls Assurance Standards.

15. NIPEC’s - Risk Management Structure Risk Owners Head of Corporate Services Internal Business Meeting Audit Committee COUNCIL Health & Safety Group

16. Risk Management Strategy & Action Plan 2007/08 Risk Action Plan During 2007/08, the Head of Corporate Services will take forward the following actions: Action 1: Review this Strategy; Action 2: Arrange regular meetings of the Internal Business Meeting to review the Risk Register, progress risk issues, discuss new risks that have been identified, promote awareness of Risk Management and any other relevant matters; Action 3: Monitor and update the Risk Register Action 4: Liaise with staff to monitor risk treatment work;

17. Risk Management Strategy & Action Plan 2007/08 Risk Action Plan (ctd) Action 5: Continue the work towards compliance with the applicable Controls Assurance Standards. (Where “gaps” are identified, an appropriate Action Plan will be developed, implemented and progress monitored); Action 6: Make available awareness sessions to staff throughout NIPEC in order to enhance staff understanding of Risk Management activities and requirements; Action 7: Review any Risk-related policies Action 8: Undertake a review of this Strategy by the end of March 2007 and produce an Action Plan for 2007/08.

18. Timetable for Implementation January 2007 - February 2007 Review the Risk Management Strategy May 2007 Awareness sessions to staff throughout NIPEC January 2007 – March 2008 Arrange regular meetings of the Internal Business Meeting. January 2007 – March 2008 Liaise with staff to monitor risk treatment work. January 2007 – March 2008 Continue the work towards compliance with the applicable Controls Assurance Standards March 2008 Formal review of the Risk Register.

19. NIPEC’s Risk Registers HIGH Level Risk Register LOW Level Risk Register

20. NIPEC’s HIGH Level Risk Register Major Organisational Areas identified as per the Business Plan. (a) Risks evaluated and scored using the (5x5) risk matrix based on possible likelihood and impact (b) An example - the Register for 2007/08

21. NIPEC Risk Register LEVEL OF RISKIMPACT Risk Quantification Matrix 5 - Catastrophic High Extreme 4 – Major High Extreme 3 - Moderate Medium High 2 – Minor Low Medium 1 – Insignificant Low Medium A Rare B Unlikely C Possible D Likely E Almost Certain Likelihood

22. An example from NIPEC’s High Level Risk Register 2007/08.

23. NIPEC’s Low Level Risk Register Corporate Register, Functional Register, Professional Areas]. (a)This Register contains 3 main areas [ Corporate Register, Functional Register, Professional Areas]. This is further broken down into 15 areas which are subsequently divided down into 82 sub areas. Again the above is based on the (5x5) risk matrix. (b) Example - the Register for 2006/07

24. An example from NIPEC’s Low Level Risk Register 2007/08.

25. This presentation will be available for download at http://www.nipec.n-i.nhs.uk/presentations