In today’s health and aged care environment there are potential problems on a number of fronts. Connectivity, integration and convergence are all forcing providers to do much more with much less.

The challenge is to continue providing high quality care using astute business models. The key is to strengthen risk management and resilience and achieve long term sustainability.

Failings of the traditional model

Traditional risk management is focused on specific categories, or ‘silos’, of risk and the way in which a particular risk may affect a certain aspect of organisational health. In aged care, the focus on clinical risks associated with liability and sanctions often means that other risks, such as reputational risks, are not considered. The silo approach also fails to address the affect of one risk on another, thus compounding the impact of a potential incident.

In the area of human resources for example, risks such as workforce fatigue, staff education levels and the decreasing labour pool, all have the potential to affect each other. For example, a decreasing professional labour pool can create a demanding and stressful work environment that promotes workplace fatigue.
 
Similarly, events like the Victorian bushfires have escalated the focus on emergency management and disaster recovery planning. To be successful in these circumstances, it is helpful to adopt an enterprise-wide risk management strategy.

The integrated approach

It is difficult for those outside the sector to grasp the uniqueness of aged care risk management. While it shares some elements of risk management with other industries, the potential severity of a catastrophe or injury in aged care is distinct. Aged care functions non-stop and poor outcomes can result in dire consequences – even a loss of viability. As a result, traditionally risk management has placed emphasis on addressing clinical risks. Such a narrow approach may not actually lead to the safest outcomes for residents or clients.

What about the challenges posed by continuous advances in medical research and technologies? Although these advances support the goal of improved patient care, they come with a price tag: new risks. What is the risk that these advancements will threaten the ethical and moral values of an institution?

Enterprise risk management (‘ERM’) is useful because it considers a broader approach for addressing an institution’s risks. And with stakeholders demanding greater risk transparency, it is becoming increasingly important to assess and respond to an institution’s myriad risks using a strategic risk management program.

Emerging risk management priorities

From our work with leading aged care organisations, we are witnessing an evolving role for risk officers who have identified the following three risk management priorities:

• ensuring that the organisation is in fully compliant;
• monitoring and identifying emergent risk; and
• extending risk principles into the wider business strategies.

There is a trend towards integrating compliance, governance and risk management efforts. But how can we do less and achieve more?

Tools such as scenario planning, sensitivity analysis and forecasting are valuable resources for an integrated approach to risk. For example, protecting patient confidentiality is often identified as a compliance risk. However scenario planning will open up a range of other possible risks. The way information is obtained, stored, retrieved, accessed, archived, destroyed and the medium with which it is stored, communicated and transmitted all have points of vulnerabilities.

Trend forecasting also provides key insights into the trends and expectations of things to come.

Analysis, management and planning

A systematic approach to risk management in progression or combination will help achieve effective risk management. Many risk management frameworks are available for use such as the AS/NZS4360, IS31000 and COSO framework. Whichever approach is chosen, the key to achieving effective risk management is founded in the following steps:

1. Identify the risks to be managed by adopting a comprehensive, well structured and systematic process. Any risks not identified at this stage are likely to be excluded from further analysis. It is therefore important to obtain a holistic and integrated view of possible risks.
2. Consider the potential consequences of risks in terms of severity. Ensure that the analysis rigorously considers the context and criteria of the risks, the level of uncertainty and the needs of decision makers.
3. Evaluate the risks. Compare the estimated level of risk with the pre-established criteria and rank the risks to identify management priorities. Ascertain tolerance levels and tolerable risks, based on parameters set by the board. Develop a risk treatment and response plan.
4. Develop a range of response options for treating risks and assess these options. Options include avoiding the risk, changing the probability of the risk occurring, change the consequences of the risk, sharing the risk or retaining the risk and making appropriate provisions for dealing with adverse outcomes, should they arise.
5. Monitor and review the effectiveness and performance of the risk management process and the risk treatment plan. By analysing incident reports and understanding the root-causes, risk managers are often able to identify opportunities to strengthen organisational control designs. 
6. Last but certainly not least, communicate.
   

It is also important to look at culture. The importance of risk culture is greatly influenced by leadership from the board. When a board ‘walks the talk’, its actions form the basis of a successful risk framework.

Key business risks

Although they are critical to an organisation’s viability, a number of key business risks in aged care are often ignored.

One commonly overlooked area is that of contract management and service level agreements with third party contractors. Service failures or interruptions can result in unintended increases in clinical and operating expenses that may negatively impact cash flow, liquidity, financial performance and capital. They might also result in injury or damage to third parties that could result in expense to the institution.

Some key risks in this area relate to provider credentialing, vicarious exposures, apparent authority and ostensible agency, good faith and fair dealing, provider selection and compliance.

Other liabilities include boards which operate a company while insolvent. Boards therefore need to have a clear and unfettered view of cash flow positions and financial risks.

Revenue risks can arise from the time a resident is registered to the point of billing with many numerous opportunities for things to go wrong. Examples include demographic information, charges missing and outdated codes. Knowledge is power and identifying revenue-cycle risks empowers organisations to control the threats to its financial performance, compliance and operations.

Advertising risks, such as exaggeration and unsubstantiated claims, may pose a legal risk to an institution. It is important to distinguish between factual messages and opinions. Factual messages provide objective, verifiable information to consumers. Certain facts about the facility, such as religious or ethnic affiliation, the cost of service and care hours provided, may determine consumer preference in certain cases,

Opinions try to influence the consumer to believe that the facility offers a positive subjective attribute. Advertisers should be able to substantiate the claims and the types of testimony that they use. Language such as “best care”, “world class facility”, “first class staff”, “extraordinary” and “individualised care” should be avoided.

The benefits of ERM

If avoiding sanctions is not incentive enough, try resilience. Apart from a broad base approach, ERM provides opportunities to improve efficiencies, streamline compliance costs and provides management and stakeholders a better view of risks.

This further facilitates improved decision making and creates greater empowerment, control and monitoring of risks. Understanding and reporting key risks indicators also helps to improve transparency.

Streamlining of governance, risk and compliance reduces the much loathed paperwork and effort surrounding accreditation and audits.

Finally, having clear view of risk and an integrated model of risk management increases flexibility and responsiveness of a provider to respond and be more opportunistic. This is critical for organisations to be successful and build the resilience and challenges which abound.

Shirley Liew is the director of risk services at Moore Stephens Sydney.

Compliance risks  

Some key risk indicators associated with non-compliant homes include:

• the number of claims throughout a given period;
• the number of events relating to potential patient harm;
• the incidences of errors or refunds;
• the number of patient complaints;
• staff turnover and churn;
• the adequacy of staff orientation and ongoing training;
• staff/patient ratios;
• the timeliness of management reporting; and
• variance to budgets.