Romain Portier, Sebastien Guery and Cyril Vegni discuss approaches to developing strategic risk management in the French healthcare sector

Falls, errors in prescribing or administering drugs, infections contracted during a stay at a hospital, erroneous laboratory reports ... these are just some of the many situations which can lead to serious problems that can endanger the life or the well-being of patients in all types of healthcare establishments.

A Hospitals for Europe working group on the quality of care in hospitals estimated that in 2000 one patient out of 10 in European hospitals was the victim of avoidable damage or adverse effects related to the care they had received. In France, an experimental investigation was carried out in the Aquitaine region in order to develop an epidemiologic method, ie studying the causes, distribution, and control of disease. This estimated that the incidence rate of iatrogenic risk - conditions caused by medical practitioners or treatment - was between 10% and 15.4% of in-patients.

Nosocomial infections - infectious diseases contracted during hospitalisation - are a particularly topical subject at present. However, risks incurred by hospitals are not limited to this. In effect, a hospital is a 'company' of health, with all the risks this concept implies.

Increasingly, both the public and the regulators require ever greater standards of quality and safety from hospitals. So hospitals need to reinforce and add to their arsenal of tools and processes used in controlling risks.

Health sector risk managers, encountering risks like medical safety and professional liability, must become familiar with all the aspects of strategic risk management, including risk acceptability assessment, risk identification, risk control and residual risk management.

Risk management and coordination of vigilance constitute the major part of the accreditation process and quality steps. However, these steps do not define the methods and management tools that hospitals need to implement in order to prevent incidents. It is only by systematic arrangement and design, with recourse to feedback from experience, and by setting up a rigorous and well-controlled process that risk management will go beyond merely satisfying legal obligations to become an undeniable factor of progress.

Identifying risks

In the healthcare sector, risk can be defined as the probability of an undesirable event occurring which causes injury to patients, hospital personnel or visitors. Risk zero does not exist, and it is clearly not appropriate to reach the stage of danger which can be defined as a threshold risk considered to be arbitrarily or subjectively unacceptable.

In general we can classify the risks in two distinct categories. Regulated risks are those related to infection, fire, construction, the intervention of outside firms, and so on. They are understood and managed as a result of their regulatory framework, and are risks which any hospital has to integrate into its risk management. However, there is another category of risk - those that are not regulated.

These include matters not subject to regulation, such as memory lapses, lack of training, verbal transcription errors and absence of protocol.

This second risk category is obviously the more difficult to deal with, particularly as the risk manager will not necessarily have the benefit of all the information. It is therefore important to carry out evaluations of such risks, using adapted tools, as frequently as possible, in order to formulate and build the entire risk management policy.

In addition, the hospital sector faces most of the risks that occur in other industries, as well as the more specific risks that stem from acting as a 'public receiving establishment' (ERP). The latter is partly the reason for the emergence of risk management in the last few years in the French healthcare sector.

Table 1 shows the principal risks encountered by a hospital. This list is obviously not exhaustive but it gives a good picture of the range of risks that concern most safety professionals, patients and hospital management.

This panorama of risks illustrates the complexity of risk management and the areas that need to be considered. Issues surrounding litigation or disputes may be sensitive, requiring delicate handling, while claims can be numerous and financially costly, resulting in escalating insurance premiums.

An ambitious project

The strategy that an organisation adopts strongly conditions its activity, its objectives and those who work within it. It directs efforts and is a key determining factor in the relationships that are established between the outside world and the organisation itself. It thus plays an essential part in effecting change, in most cases initiating and bringing it about.

Managed actions mix rigour and improvisation, rigidity and flexibility, do-it-yourself and systematic method. The art of managing risks consists in combining these approaches and making them coexist. It is necessary to keep a strict focus on objectives while preserving the possibility of questioning established methods.

Like all important organisational projects, efficiently setting up strategic risk management in the health sector relies upon the support of management.

The goal is not to programme behaviours but to prepare people and organisations to react quickly and strategically to changes in the sector.

Experience shows that implementing strategic risk management in the health sector depends on a simple process - anticipate, prepare, initiate, adapt, accompany, evaluate and conclude. These seven distinct stages can be described as follows.

- ANTICIPATE - Determine objectives that will adequately respond to evolutionary changes in the sector. This makes it possible to foresee the impacts and their consequences.
- PREPARE - Determine the actions required and identify conditions for their implementation.
- INITIATE - Put processes in place.
- ADAPT - In designing implementation, incorporate measures that allow for flexibility and adaptability.
- ACCOMPANY - Supporting and complementing the strategic risk management is crucial for its success.
- EVALUATE - Examine and judge whether the strategic risk management has evolved as planned and the appropriateness of the objectives, and measure the results obtained.
- CONCLUDE - Finalisation and project analyses enable validation - or invalidation - of the actions and policies undertaken and their correlation with the partial or total target objectives.

In the first three phases, taking efficient control of the change has to be the recurring theme, before moving on to accompaniment and support.

The final evaluations and conclusions will provide the basis for short and medium term action plans.

Keys to success

During its recent years of experience with strategic risk management, Equity's team has formulated what we consider to be the five important lessons, and these are applicable to the health sector.

- Strategic risk management must create conditions aimed at supporting personal control. Individuals must be able to improve and to develop themselves continuously. This can be facilitated by training, autonomy and an active participation in projects - and this approach must, of course, be applied throughout the whole life cycle of projects, particularly in the design and realisation phases.

- Each participant in implementing strategic risk management must specify and constantly improve their perceptions of the project and realise how their perceptions influence the decisions and the actions. Personal and group targets make it possible to build coherence from an initial starting point of different perceptions.

- Team training is essential in joining up reflections that build into a shared interpretation. This allows for decision-making and common planning, which is followed by a coordinated action. This action is then the basis for new reflections.

- It is also necessary to focus on constructing a shared vision. Management's role is to make this expression of the organisation emerge, and not to impose its own vision, so that the vision is truly shared. This vision gives the risk management team the opportunity to get a true direction for its actions, drawing on collective competencies. It should be used as the basis for action and training.

- Finally, systemic thought is the teaching which governs all the others.

It consists of approaching the hospital as a complex system in which processes interact.

Imparting these five lessons is a delicate process; often it may not be possible to observe the results during the project. Indeed, the transition from conceptual to operational is rather difficult in hospital structures.

However, the application of the CLIN (Committee for the Prevention of Nosocomial Infections) recommendations in all the relevant areas - hospital, department, region and country - is one current demonstration of its success.

Information is vital

The strategic reflection must be fed by an information system rich in diversified, specific and continuous data, relating to everything that concerns the measurement and follow-up of the hospital's activities. Information provided to the various strategic risk management participants in the hospital must be centred on the organisation's objectives. The goal is to reveal levels of achievement and to show how all the actions carried out by those concerned converge, and allow direct or indirect impacts on the work environment to be achieved.

Objective information should stimulate hospital personnel in charge of care to think about risk management in their respective areas, whether administrative or operational. It must contribute to creating a common language for the entire personnel in the hospital. In the health sector, the risk management system and information must be seen as generating actions rather than providing justification in the case of problems.

Buy-in from all the parties concerned is vital. Information relevant to strategic risk management must become the basis of dialogue between everyone involved. This is a major challenge for health sector risk managers today. If information is not shared, the reliability of data collected becomes eroded. The result is increasing mistrust of the system, in the long term signing its death warrant.

Future prospects

The constituent parts of hospitals generally still operate too much on a silo basis, making it difficult to launch a transverse project and to identify sources of information and knowledge. This is of particular relevance to strategic risk management, which is characterised by its transversality between all functional services of the hospital.

Nowadays, as disputes and litigation multiply, risk management must widen its field of competence. Legal and financial risks must be treated in a more effective and convergent way in order to evaluate and to determine new approaches. One aspect is working with multi-jobs groups to define the patients' level of risk acceptance. It is useful to point out that absolute safety does not exist. The challenge is to communicate that safety at the hospital, in addition to practical measures, also represents an ethical engagement, a daily questioning of its practices. Understandably, there is a reluctance by care administrators such as nurses to dwell upon their errors, making it very difficult for the risk manager to recover information on incidents and accidents.

Strategic risk management in the health sector has both conceptual and methodological elements. It requires the defining of the steps and tools necessary to implement a total risk management policy that is clear and shared by all those involved. Moreover, strategic risk management must facilitate the quality convergence of users' expectations, the satisfaction of hospital personnel and the emphasis on financial performance. Such is the challenge.

Romain Portier is risk manager, Evrard City Hospital; Sebastien Guery is head of health risk project and Cyril Vegni is product manager risk management, Equity, HOSPITALS FOR EUROPE

The Standing Committee of the Hospitals of the European Union was created in 1966 to promote, among other things, improvements in the health of citizens throughout the countries of the European Union (EU). The acronym 'HOPE' stands for Hospitals for EurOPE.

The Standing Committee has seven principal philanthropic, scientific and educational objectives that can be summarised as follows to:

- be a source of advice on hospital and health affairs
- maintain information about the planning and operation of hospital services and health systems
- advise members on standards of provision, organisation and operation of hospital services
- promote exchange programmes and training
- maintain links between health professionals in the EU
- liaise and cooperate with international bodies concerned with health affairs
- engage in other activities designed to further the best interests of hospital services in the EU.


Health care interventions are intended to benefit the public, but due to the complex combination of processes, technologies and human interactions there is an inevitable risk that adverse events will happen, says a World Health Professions Alliance fact sheet. Much evidence has been built on risks in hospitals; however information about adverse events occurring in other healthcare settings such as doctors' surgeries, nursing homes and pharmacies are not well documented. Identifying and reducing the occurrence of errors and improving the safety and quality of health care has been brought forward as a priority issue for health services around the world.

An adverse event can be defined as harm or injury caused by the management of a patient's disease or condition by health care professionals rather than by the underlying disease or condition itself. Although human errors may sometimes precipitate serious failures, there are usually deeper, systemic factors, which if addressed earlier would have prevented the errors. Hence, the enhancement of patient safety involves a wide range of actions in the recruitment, training and retention of health care professionals, performance improvement, environmental safety and risk management, including infection control, safe use of medicines, equipment safety, safe clinical practice and safe environment of care.

There is growing evidence that inadequate institutional staffing levels are correlated with increase in adverse events such as patient falls, bed sores, medication errors, nosocomial infections and re-admission rates.

In short, inadequate human resources present a serious threat.


- The 1995 Quality in Australian Health Care Study (QAHCS) found an adverse event rate of 16.6% among hospital patients.
- 75% of the adverse drug events in a Utah/Colorado study were attributable to system failures. Most adverse events were not the result of negligence or lack of training, but rather of latent causes within systems.
- In NHS hospitals, adverse events in which harm is caused to patients occur at a rate in excess of 850,000 a year.
- According to a survey conducted by the Robert Wood Johnson Foundation, 95% of doctors and 89% of nurses in the US have witnessed a serious medical error.
- Poor quality healthcare is responsible for more than 30% of avoidable deaths in Italy.


French government estimates suggest that 7% of all French in-patients acquire a nosocomial infection. However, the Ministere des Solidarites de la Sante et de la Famille says that this frequency of noscomial infection is comparable with that in other developed countries. These other countries' statistics show a varying percentage from 5% to 12%.

However, the resistance of bacteria to antibiotics appears to be more frequent in France than in other European countries, in particular the countries of Northern Europe.