DHA 715 Week 1 Introduction to Enterprise Risk Management Example

From Insurance Claims to Enterprise Risk: Building an ERM Program for Four Rural Hospitals Inside a Regional Network

[Student Name]

University of Phoenix

DHA/715: Risk Management in Complex Health Organizations

Week 1 Assignment

[Instructor Name]

[Date]

The network, its rural hospitals, risk events, the committee and the risk register are composites written for a model paper; research findings come from the sources cited.

In a single quarter, the network's four rural hospitals faced three crises. A ransomware attempt locked two workstations before the information technology team isolated them. A surgeon operated on the wrong knee. And eleven nurses resigned from one hospital in six weeks, forcing the closure of eight beds. Each crisis was handled by a different department, and no one looked at them together. The regional vice president was asked to build an enterprise risk management program for the rural region. This paper describes the foundation of that program.

Traditional Risk Management

Traditional hospital risk management grew around insurance and liability. Risk managers tracked incidents, handled claims, bought insurance and ensured compliance with regulations. The work was important but narrow: it focused on losses after they happened and on clinical and legal risks, with little attention to strategic, financial, workforce or technology risks.

Enterprise Risk Management

Enterprise risk management takes a wider view. It identifies and manages risks across all domains, considers how they interact and links them to the organization's strategic objectives. It asks not only what could cause a claim but what could prevent the organization from achieving its mission: a cyberattack that halts care, a workforce collapse that closes services or a financial shock that forces cuts.

Risk Domains

Programs usually sort risks into families: patient safety, day-to-day operations, money, strategy, people, law and regulation, technology and external hazards such as hurricanes, which the coastal plain knows well. The quarter's three crises fell in technology, clinical and human capital domains, but each spilled over: the ransomware attempt threatened patient care, the wrong-site surgery brought regulatory and reputational risk and the nurse departures raised patient safety and financial risk.

Interactions Among Risks

The events were connected. Nurses who left cited workload and burnout; understaffing raises the chance of errors like the wrong-site surgery; and staff under strain are more likely to click on phishing emails. Enterprise risk management treats these links as the point, not a coincidence.

A Maturity Model

Health care organizations are still building ERM programs. Interviews with 15 chief risk officers in the United States and Brazil found that adopting ERM had gained momentum and become a priority and that risk managers commonly wanted economic assessment of risks; the authors proposed an ERM model for health care organized in four maturity levels with an implementation timeline and guidelines for gradual adoption, including economic risk assessment (da Silva Etges et al., 2018a).

Applying the Maturity Model

The rural region begins at the lowest level: risks managed in silos, little shared data and no common method for rating risks. The first-year goal is to reach the second level, with a common risk register, standard ratings and regular reporting, before attempting economic assessment of risks in year two.

Identifying Risks With an Inventory

Systematic identification matters. The same research group developed an enterprise risk inventory for health care from ERM guidelines and interviews with chief risk officers, confirmed through a survey of risk managers; the inventory includes 28 risks with specific scenarios, and participants ranked cyberattack as the principal risk, followed by sentinel events and risks associated with human capital, such as organizational culture, use of electronic records and physician wellness (da Silva Etges et al., 2018b). The three risks the rural hospitals met in one quarter are the three the field ranks highest.

A Systems View of Error

Culture shapes whether risks are reported. Reason describes two approaches to human error: the person approach, which focuses on individuals' carelessness and seeks to blame, and the system approach, which sees errors as consequences of weaknesses in defenses, like holes in slices of Swiss cheese, and seeks to strengthen those defenses; he argues that the person approach hides the conditions that produce errors (Reason, 2000).

Applying the Systems View

The wrong-site surgery showed both approaches. The first response was to suspend the surgeon. The investigation found missing site marking, a time-out rushed because the operating room was behind schedule and a consent form with an unclear abbreviation. Blaming one surgeon would have left those holes open.

Building the Risk Register

The first risk register lists 24 risks for the rural region. Each has an owner, a description, current controls, a likelihood rating from one to five, an impact rating from one to five on patient harm, finances, operations and reputation and a combined score.

How Ratings Were Assigned

Ratings came from structured sessions with department leaders, who used a shared scale: likelihood from rare to almost certain within three years and impact across patient harm, finances, operations and reputation. Where leaders disagreed, the committee reviewed incident data, claims history and published evidence. The process took longer than simply asking executives to rank risks, but it produced ratings that department leaders accepted as fair.

Top Risks

The highest-scoring risks were cyberattack and system downtime, nurse and physician workforce shortages, patient safety events in surgery and medication use, post-acute placement delays, dependence on a single payer contract and emergency department boarding.

Governance

A rural region risk committee, chaired by the regional vice president, includes each hospital president, the chief nursing officer, the medical director, the information security lead, the finance director and the compliance officer. It meets monthly, reviews the register and reports quarterly to the network's enterprise risk committee and the regional board.

Risk Appetite

The committee drafted a risk appetite statement: very low tolerance for patient harm and data breaches, moderate tolerance for financial risk in pursuing strategic goals and willingness to accept operational risk to maintain rural access.

Reporting

A one-page heat map shows each risk's likelihood and impact, with arrows for trends. Each hospital reviews its portion monthly, and new risks can be added by any manager.

Linking Risk to Strategy

The region's strategic goals, keeping emergency departments open, expanding primary care and joining value-based contracts, each carry risks. Workforce shortages threaten all three; cyberattack threatens access; payer concentration threatens finances. By mapping each top risk to the goals it endangers, the committee made risk a strategic conversation rather than a compliance exercise.

Culture

The program adopts a just culture approach: staff who report errors and near misses are supported, system causes are investigated and accountability is reserved for reckless behavior.

Next Steps

In the next six months, the committee will complete risk assessments with each department, set mitigation plans for the top six risks, run a cyberattack tabletop exercise and link the register to the region's strategic plan.

Conclusion

Three crises in one quarter showed why risk cannot be managed in silos. Enterprise risk management looks across domains, recognizes interactions and ties risk to strategy. Research offers a maturity model and an inventory that ranks cyberattack, sentinel events and human capital risks highest, and a systems view of error supports the culture the program needs. A register, governance and just culture give the rural region its start.

References

da Silva Etges, A. P. B., Grenon, V., de Souza, J. S., Kliemann Neto, F. J., & Felix, E. A. (2018a). ERM for health care organizations: An economic enterprise risk management innovation program (E2RMhealth care). Value in Health Regional Issues, 17, 102-108. https://doi.org/10.1016/j.vhri.2018.03.008

da Silva Etges, A. P. B., Grenon, V., Lu, M., Cardoso, R. B., de Souza, J. S., Kliemann Neto, F. J., & Felix, E. A. (2018b). Development of an enterprise risk inventory for healthcare. BMC Health Services Research, 18, Article 578. https://doi.org/10.1186/s12913-018-3400-7

Reason, J. (2000). Human error: Models and management. BMJ, 320(7237), 768-770. https://doi.org/10.1136/bmj.320.7237.768