Risk management is the organized process of identifying, analyzing, controlling, and monitoring risks that could harm clients, staff, visitors, or the organization. In health care it protects people first and, as a result, reduces legal and financial loss.
| Term | Meaning |
|---|
| Risk | Chance that an event will cause harm or loss |
| Hazard | Anything with potential to cause harm (wet floor, faulty equipment, look-alike drugs) |
| Incident (safety event) | Any event or circumstance that could have resulted, or did result, in unnecessary harm |
| Near miss | Incident that did not reach the client |
| Adverse event | Incident that resulted in harm to the client |
| Sentinel event | Patient safety event, not primarily related to the natural course of the illness, that results in death, permanent harm, or severe temporary harm; triggers immediate investigation such as root cause analysis |
| Incident report (occurrence or event report) | Internal, confidential document describing an incident for review and learning |
Proactive vs reactive risk management
- Proactive — find and fix risks before harm: environmental rounds, FMEA, equipment maintenance, audits, staff training
- Reactive — learn from events that already happened: incident reports, root cause analysis, complaint review
Risk management process
- Identify risks — incident reports, near misses, complaints, audits, safety rounds, staff input
- Analyze and prioritize — how likely and how severe; high-severity or frequent risks first
- Control (treat) — eliminate, reduce, transfer (e.g., insurance), or accept with monitoring
- Evaluate and monitor — track indicators and recurrence; adjust controls
Root cause analysis (RCA) — reactive, structured analysis after a serious event or pattern.
- Asks what happened, why it happened, and how to prevent it, not who is to blame
- Team is multidisciplinary (nurses, physicians, pharmacists, managers, quality staff, others involved in the process); people directly involved are interviewed; including someone with no stake in the outcome helps objectivity
- The client and family are usually interviewed for their account and informed of results per disclosure policy
- Uses timelines, flowcharts, fishbone diagrams, and repeated "why" questions to reach system causes
- Produces an action plan with owners, deadlines, and measures; strongest actions change systems (design, forcing functions, standardization) rather than relying only on retraining
Failure mode and effects analysis (FMEA) — proactive, done before harm.
- Map every step of a high-risk process
- For each step, list what could fail (failure modes), causes, and effects
- Score each failure mode for severity (S), occurrence (O), and detectability (D), typically 1–10 each (for detection, a higher number means harder to detect)
- Risk priority number (RPN) = S × O × D; redesign the highest-risk steps first
- Re-score after changes
Worked example. Wrong-rate programming of an infusion pump: severity 9, occurrence 3, detection 4 → RPN = 9 × 3 × 4 = 108. Delayed antibiotic after a missed order: severity 6, occurrence 5, detection 2 → RPN = 6 × 5 × 2 = 60. The pump step (108) is addressed first.
Hierarchy of risk control — eliminate the hazard → substitute → engineering and design controls → administrative controls (policies, training, signs) → personal protective equipment.
When an incident occurs — correct sequence
- Assess and care for the client first; stabilize and prevent further harm
- Notify the physician and the charge nurse or manager
- Carry out ordered treatment and monitor the client
- Document in the client's record: objective facts, client assessment, notifications, and care given — without blame, opinions, or the words "incident report"
- Complete the incident report per policy, promptly, by the person who witnessed or discovered the event
- Participate in review and disclosure per hospital policy
Writing the incident report
- Factual and objective: who, what, when, where, what was done; direct quotes of what the client said
- No speculation, blame, or admission of fault; no conclusions about cause
- Do not file it in the chart, do not photocopy it, do not mention it in the chart — it is an internal quality and risk document
- Submit within the time the policy requires (usually before the end of the shift)
Common incidents nurses report
- Medication errors and adverse drug reactions
- Falls with or without injury
- Wrong-patient or wrong-site events, specimen labeling errors
- Pressure injuries acquired in hospital
- Equipment failure, burns, electrical events
- Transfusion reactions and blood product errors
- Client elopement, self-harm, violence or aggression
- Needlestick injuries and exposures (staff incidents)
Environmental and equipment safety
- Fire — RACE: Rescue clients in immediate danger, Alarm (activate alarm and call), Confine/contain (close doors), Extinguish if small and safe, or evacuate
- Extinguisher — PASS: Pull pin, Aim at base, Squeeze handle, Sweep side to side
- Electrical: remove frayed cords or damaged plugs from use and report them; use grounded equipment; keep liquids away; take extra care where oxygen is in use because it supports combustion
- Medical devices: follow preventive maintenance schedules, tag and remove faulty devices, and report device-related incidents
- Falls: screen all clients, apply risk-based measures (low bed, call light within reach, non-slip footwear, toileting schedule, frequent rounding); avoid sedatives as a "fall prevention" measure; restraints are a last resort because they increase injury
- Workplace violence: organization-level prevention (training, response plans, security, reporting, and support for affected staff)
Disclosure. Clients have a right to honest information about harm from care. Disclosure is done by the responsible team per policy, with an explanation, an apology or expression of regret as policy allows, and the steps being taken.
Staff nurse
- Recognize hazards and correct or report them at once
- Report all incidents and near misses; complete reports accurately and on time
- Follow policies for identification, medications, falls, infection prevention, and equipment
- Take part in RCA interviews and FMEA teams honestly
Nurse manager / risk manager
- Keep reporting easy and non-punitive; give feedback on what changed
- Trend reports to find patterns; lead or refer for RCA or FMEA
- Implement and monitor action plans; ensure orientation and competency checks
- Coordinate with the hospital patient safety committee and patient safety officer
- Documentation in the client's record is a legal document; it must show the facts and the nurse's response. Missing documentation can be read as care not done (see Topic 6).
- Incident reports are internal documents for quality improvement; keep them out of the medical record and handle them confidentially under hospital policy.
- Personal and health information in reports is sensitive personal information under the Data Privacy Act of 2012 (RA 10173); access is limited to those who need it.
- DOH AO 2020-0007 (National Policy on Patient Safety in Health Facilities) sets roles for patient safety committees and officers and indicators for monitoring; hospital incident reporting systems feed these programs.
- Ethical duties: non-maleficence, veracity (honest disclosure), fidelity to the client, and justice toward staff (just culture).
- Falsifying, delaying, or concealing an incident violates professional standards and can lead to administrative and legal consequences.
Case 1 — Wrong dose given. A nurse realizes that a client received twice the ordered dose of an antihypertensive.
- Correct first action: assess the client (blood pressure, heart rate, level of consciousness) — then notify the physician, monitor, document facts in the chart, and complete an incident report.
- Why: client safety comes before paperwork; the report is not referenced in the chart.
Case 2 — Found on the floor. A nurse finds a client sitting on the floor beside the bed; no one saw the fall.
- Correct documentation: "Client found sitting on floor beside bed at 0215. States, 'I tried to walk to the bathroom.' No visible injury; vital signs ..." — not "Client fell out of bed."
- Why: record only what was observed; the fall itself was not witnessed.
Case 3 — Proactive review. A hospital is introducing smart infusion pumps and wants to prevent programming errors before launch.
- Correct tool: FMEA.
- Why: FMEA is prospective; RCA is used after an event.
Case 4 — Frayed cord. During rounds a nurse notices a cardiac monitor cord with exposed wire.
- Correct action: remove the device from use (replace with a working unit), tag it, and report to biomedical engineering.
- Why: prevents electrical injury; reporting enables repair and trending.
- Completing the incident report before assessing the client.
- Writing "incident report filed" in the chart or placing a copy in the chart.
- Using RCA to find the person to discipline; RCA targets systems.
- Mixing up RCA (reactive) and FMEA (proactive).
- Reporting only events that caused harm; near misses must be reported too.
- Using restraints or sedatives as routine fall prevention.
- Recording opinions ("careless," "fell because confused") instead of observations.
- Risk management: identify → analyze → control → monitor.
- After an incident: client first → notify → document facts in chart → incident report.
- Incident report: objective, prompt, by the person involved or who discovered it, never in or referred to in the chart.
- Near misses must be reported; they reveal hazards before harm.
- Sentinel event = death, permanent harm, or severe temporary harm → RCA.
- RCA = reactive, multidisciplinary, system-focused; FMEA = proactive with RPN = severity × occurrence × detection.
- RACE for fire; PASS for extinguishers.
- Remove and report damaged electrical equipment; oxygen increases fire risk.
- Restraints are a last resort; they do not prevent falls reliably.
- Incident data are confidential and protected under hospital policy and RA 10173.