Issue Five: Modeling Growth and Innovation Part 3

This issue covers the 5th and 6th of the 10 steps risk leaders can take to optimize their programs and by extension the resiliency of their organizations.

Be the Fixer

Number five: be a problem solver. Risk professionals need to practice being good business partners, not the department of no. If you need to know more about how hospital operations work, then get that education. The Well Managed Healthcare Organization by White & Griffith is a great book to help you start learning. Healthcare administrators need a risk partner who can help them spot the uncertainties and also help them think through how to move forward while managing the risks. The more that you can be that partner, translating risk to be actionable in the business operation, the more effective you will be. Importantly, this does not mean that risk is responsible for solving all of the organization’s problems or taking on the operational responsibilities of other departments. What it does mean is that you learn to be a creative business partner to help others in your organization get to where they need to go in the least risky way. It also means that you facilitate decisions around risk in a way that those decisions are made at the right level of the organization. For example, if your current contracts process does not have an escalation pathway for agreements where the other party is not willing to agree to your organization’s standard terms on cybersecurity requirements, and a manager signs the agreement because it’s only worth $50,000 but it involves access to sensitive data then your organization may have a big problem later if the partner sustains a cyber attack and your data is compromised. We are all familiar with levels of signatory authority based on the cost of the contract. But few places have requirements for senior leadership approval where the business terms themselves create substantial risk for the organization. The risk professional can be the voice to encourage those decisions on risky contract language to be made at the proper (higher) level of the organization. But the risk professional would not be responsible for revisions of the contracts process or for holding staff accountable for following that process.

Toot your horn

Number six: demonstrate the return on investment of your work. We have struggled for years to be able to define the return on investment of risk management. It’s the old problem of how do you put a price on something that you were able to prevent from happening? This could be the subject of its own article but there are things you can do! At a minimum, you can show reduced numbers of preventable events over time. You can also work with your actuary to come up with an average cost for each of these events based on your organization’s past experience which then would allow you to show over time how much money was saved. You can start tracking situations where your organization spent money it didn’t need to due to some process failure, you can track missed business opportunities, and their lost potential value. You can track decreased costs for insurance and decreased defense costs/reserves from decreased litigation. This can and should be about more than just patient safety events, and you can develop data which will demonstrate the value of the work you do.