SharePoint Location Non-clinical Policies and Guidelines SharePoint Index Directory 3.0 Corporate Sub Area 3.1 Risk and Health & Safety Documents Key words (for search purposes) Risk, Risk Management, Risk Assessment Central Index No RM12 Endorsing Body Operational Management Board Endorsement Date 16 th September 2011 Review Date September 2014 Lead author and designation (if under review) Review led by David Ireland, Assistant Director: Risk & OH. Ann Stansfield, Health and Safety Advisor and LSMS David Ireland, Assistant Director: Risk & OH 1 of 15
Key Points Establishes the framework for risk management in the Trust Establishes responsibilities and accountabilities Refers to the Code of Practice which sets out the process for managing risk Background Peterborough and Stamford Hospitals NHS Foundation Trust Board of Directors (the Trust) is committed to implementing the principles of governance, defined as the system by which the organisation is directed and controlled, at its most senior levels, to achieve its objectives and meet the necessary standards of accountability, probity and openness. The Trust recognises that the principles of governance must be supported by an effective risk management system that is designed to deliver improvements in patient safety and care as well as the safety of its staff, patients, visitors, its data management and asset security. Fundamental to this approach is the need to identify hazards, determine under what circumstances these hazards could cause death, injury, illness, harm or loss, quantify the likelihood and severity/impact of the risk involved and manage the situation to ideally eliminate the risk, or at least minimise the effects. The assessment of risk forms an essential part of the Trust s risk management strategy protecting people, property and services. The Risk assessment process will initiate or contribute to the strategic planning, corporate objective setting, business planning, procurement and service developments in assisting to identify weaknesses, threats or opportunities. This will be undertaken by identifying risks in current processes, systems or services and proactively used when planning new services, developments or projects. The outcome of an adverse event, claim or complaint investigation may also trigger the need for risk assessment. Purpose and scope of policy It is the Board of Directors intention that risk management is not a separate function undertaken by specific people or committees; risk management is to be embedded into every planning or operational activity across the Trust as a matter of routine. This Policy and the accompanying Code of Practice and all other associated documents applies to all Trust employees, contractors and other third parties who may be visiting or working on Trust premises, or may be working away from the Trust premises on behalf of the Trust. This policy also covers those who may be affected by the Trust s activities but do not necessarily occupy a Trust site. Risk management is the responsibility of all staff, although managers at all levels are expected to take an active lead to ensure that risk management is a fundamental part of their operational services and forward planning. The decision making process is aligned to the Scheme of Delegation. The purpose of this Policy is to set out the legal requirements and the Trust s approach to the identification and management of hazards in all categories of risk. 2 of 15
This Policy must be read in conjunction with the Risk Assessment and Risk Management Code of Practice and the Management of the Risk Register Procedure. 1 Policy This policy will establish a consistent and integrated approach to the management of all risk across the whole Trust. 1.1 The key objectives of this policy are to provide the framework for achieving: Robust corporate governance. The control and management of risk to achieve organisational objectives. By implementing this policy the Trust will also achieve: o Continued compliance with the Care Quality Commission s registration requirements and the NHSLA Risk Management Standards. o Production of the assurance framework to enable the Statement on Internal Control to be signed. o The integration of risk management within the Trust s strategic aims and objectives. o Integrated governance encompassing financial, clinical, corporate, information, performance and research governance systems. 1.2 The Trust encourages an open culture (see Being Open Policy) that encourages all staff and contractors to operate within the systems and structures outlined in this policy. 1.3 The Trust will provide appropriate training in relation to risk management to ensure this policy is implemented. 2 Definition of Terms Risk is the uncertainty of outcome, whether positive or negative threat, of actions and events. It is the combination of likelihood and impact (severity), including perceived importance. Risk Management is all the processes involved in identifying, assessing and judging risks, assigning ownership, taking action to mitigate or anticipate them, and monitoring and reviewing progress. Types of Risk Identification There are two main types of risk identification which are explained in more detail at Appendix A but in short they are Proactive assessments where there is a potential risk identified in the planning processes or change management processes and Reactive where something has happened and the risk needs to be assessed or reassessed. Escalation is the process by which higher authority levels within the Trust are made aware of risks requiring their attention. 3 of 15
Continual Systematic Assessment is the process of constantly identifying and managing risk. Other definitions are available in the Code of Practice. 3 Duties 3.1 The Board of Directors is responsible for ensuring the Trust has effective systems for identifying and managing all risk; clinical, financial and organisational. The Board of Directors has established a risk management structure to help deliver its responsibilities for implementing risk management systems within the Trust, which is explained below. 3.2 The Chief Executive, as Accountable Officer, is ultimately responsible for ensuring that the Trust is compliant with statutory legislation and that this policy is effective and has delegated responsibility for risk management as set out below. 3.3 The Director of Human Resources has executive responsibility for health and safety and employment risks. 3.4 The Medical Director and the Director of Nursing have executive responsibility for patient safety and clinical risk. 3.5 The Chief Operating Officer has executive responsibility for performance management risks. 3.6 The Director of Finance has executive responsibility for Financial Governance and all associated financial risks. 3.7 The Company Secretary has executive lead for ensuring that any risks to the Board Assurance Framework are identified and recorded on the corporate risk register and for Information Governance. 3.8 Each Executive Director has Board level accountability for risk management within their Directorate and Board accountabilities. 3.9 The General Manager Clinical Services CBU is the Chair of the Trust Health and Safety Committee and is responsible for communication to and from the Operational Management Board and to the Director of Human Resources as Board lead for health and safety. 3.10 General Managers and Clinical Leads are responsible for the management of all aspects of risk within their respective Clinical Business Unit (CBU). The CBU management team will: Identify suitable CBU meetings for the discussion of risk management issues; Develop and implement work-plans to ensure risks are identified and treated; Ensure CBU and other local risk registers (electronic or paper) are maintained and reviewed at least quarterly to ensure timely and systematic risk management and communication of risk; 4 of 15
Implement any control measures required to mitigate the risks from those assessments graded as Significant or High; Ensure that risks in the CBU are captured on to the appropriate risk register; Ensure escalation of risks from local risk registers through to CBU meetings and onto corporate meetings according to their impact where required; Report on High risks to the nominated Corporate level meeting as prescribed by the Chief Executive. 3.11 Ward and Departmental Managers are responsible for risk assessment being completed and subsequently managed in their areas of work and for eliminating or reducing risk within the capacity of their delegated authority. Managers can delegate the task but cannot delegate the responsibility. Managers should support their assessors by allowing them sufficient work time and encouragement to complete the tasks. 3.12 Risk Management and Health & Safety Departments will provide: A framework which complies with legislation to enable operational staff to undertake their legal duties and for the Board of Directors to gain assurance about the management of risk; Suitable and sufficient training courses for staff and managers to enable them to carry out the assessment of risk and how to undertake root cause analysis investigations; Advice and guidance on risks that require specialist knowledge; Provide support to trained Risk Assessors; Monitor high level risk assessments recorded on the risk register. Risk Management processes, including Health and Safety and Manual Handling, will be overseen by the Health and Safety Department and the Health and Safety Committee. Additional support will be provided by the Patient Safety Manager, Clinical Risk Advisor, Infection Control Team, Fire Safety Advisor, Local Security Management Specialist (LSMS), and the Emergency Planning Lead. These specialists and safety advisors will act as a central reference point for all risk management issues. The Risk Management Department is also responsible for maintaining and developing the Trust wide risk management system for PALS, complaints, adverse events and risk register. 3.13 Responsibility of all Employees, Agency and Contractors ( Staff ) All staff are encouraged to utilise the risk management processes as a mechanism to highlight areas they believe need to be improved. Where staff feel that raising issues may compromise them or may not be effective they should be aware of and encouraged to follow the Trust s Raising Issues of Concern / Whistle-Blowing and 'Safe Haven' incorporating Trust guidance on whistle blowing and raising concerns in line with the requirements of the Public Interest Disclosure Act 1998. 3.14 Powers for Mitigating Risks 5 of 15
Decision making on risk mitigation is aligned with the Financial Scheme of Delegation; where decisions are outside of the budgetary authority of the local manager they must be escalated up the management chain or trigger a business case. 4 Committees with Responsibility for Managing Risk Responsibility for specific risk management areas has been delegated to the following committees. 4.1 Board of Directors The Board of Directors will review the reports submitted from the Board Committees on High organisation wide risks and any risks related to the Board Assurance Framework. 4.2 Performance Assurance Committee Reporting to the Board of Directors, the Performance Assurance Committee has responsibility for monitoring and review of the High risks within CBUs, ensuring the control and governance processes which have been established are implemented in the management of risk, and the associated assurance processes. This is to help the Board of Directors to be fully assured that the most efficient, effective and economic risk control and governance processes are in place, and that the associated assurance processes are optimal. 4.3 Trust operational Board (TOB) TOB is responsible for monitoring the High organisation wide risks on the Trust s risk register holding senior managers and their teams to account, agreeing resourced treatment plans and ensuring their delivery. TOB receives a monthly report which identifies the High (16 and above) organisation wide risks and any strategic risks recorded on the risk register. 4.4 Clinical Governance Committee (CGC) Reporting to the Performance Assurance Committee the role of this committee is to determine and oversee the continual development and implementation of Clinical Governance and Clinical Risk Management across the Trust. 4.5 Audit Committee Reporting to the Board of Directors, the Audit Committee will have primary responsibility for financial risk and associated controls, corporate governance, financial assurance and challenging the risk management processes managed by other Trust committees. 4.6 Monitoring Terms of reference for these committees are available from the Executive Assistant to the Chief Executive or the Director that chairs each of the committees described. Appendix B sets out the Trust s process to be followed for monitoring compliance with these Terms of Reference. 5 Risk Forums Business units and non-clinical directorates have existing governance and management meetings that meet regularly. Time will be allocated within these groups to discuss risk management issues. 6 of 15
The groups will be responsible for: Appropriate population of the risk register in line with this Policy, and the Risk Register Procedure including the validating of all risk scores attributed. For High (red) risks automatically escalated from lower levels, reviewing the treatment plan, ensuring that the process is dynamic and that changes reflect practice. Monitoring the implementation of treatment plans for locally and CBU managed risk. Reviewing all risks on the risk register in line with the approved plan to verify they remain valid. Providing the appropriate corporate committee, through reporting assurance, that these actions have been undertaken. 6 Process for managing risk The process for identification and management of risk is to be a continual systematic process. There are some descriptors of the process for managing risk at Appendix A, but a more detailed description can be found in the Risk Assessment and Risk Management Code of Practice and the Management of the Risk Register Procedure documents. 7 Training and Development The Trust training needs analysis sets out the mandatory training requirements for risk management training. In addition other training courses which support operational practice can be identified through the Trust training prospectus which can be found on the Intranet. 8 Monitoring and Review See Appendix 2 for the monitoring framework. 9 Endorsement This policy will be shared with the Clinical Governance Committee for comment and finally endorsed by the Trust Operational Board (TOB). 10 Distribution The Policy will be submitted on to Sharepoint for open access to all Trust employees. It will be shared with Progress Health and their partners through a formal meeting. It will be publicised in Factsheet the month after it has been endorsed. 11 Implementation The Policy will be implemented throughout the Trust, led by senior managers and clinicians who will have had opportunity to comment on it before endorsement and each business unit and directorate management structure is represented at TOB where 7 of 15
senior managers will be required to share this through their respective management structures to all staff. 12 References Office of Government Commerce, Management of Risk:Guidance for Practitioners. London 2002. NHSLA Risk Management Standards for Acute Trusts. NHS Litigation Authority. NHSLA PILOT Clinical Negligence Scheme for Trusts Maternity Clinical Risk Management Standards June 2010/11. NHS Litigation Authority. Care Quality Commission, Essential Standards of Quality and Safety. London. March 2010. 8 of 15
Appendix 1 Process for the Management of Risk The Trust employs a number of mechanisms to systematically assess and manage its risks, all of which combined, provide the Board of Directors with the required assurance that risks to objectives are being appropriately managed. These processes broadly fall into proactive and reactive risk processes. Proactive risk processes: Strategies, policies and procedures In addition to this Policy, there are a range of other policies that support the management of risk in the Trust. These are available on the Trust s intranet site. Resilience Management The Trust has in place a comprehensive Major Incident Plan, as well as a range of plans and other associated documents that are designed to ensure the resilience of the Trust in a range of scenarios that would limit the operating capacity of the Trust. These plans are tested on a regular basis, and learning from these tests is communicated back into relevant groups to ensure the processes are refined. Implementation of clinical guidance the Trust has mechanisms in place to implement the latest guidance Standards and Accreditation the Trust ensures that it meets (and aims to exceed) a range of standards and accreditations. Many of these are covered by the Policy for Responding to External Agency Visits. Audit Activity (clinical, internal and external) there is extensive audit activity within the Trust covering a range of issues. Findings from these reviews are fed back to appropriate members of staff, and reports made to the local Clinical Governance Groups or the Trust Clinical Governance Committee and to the Audit Committee (internal and external audit). Reports to Trust Operational Board (TOB) / Board of Directors on key Trust priorities regular reports are made identifying potential risks to the Trust s strategic priorities, and what actions are being taken to minimise these risks. The balanced scorecards cover a number of key Trust targets, lined to strategic priorities. Triggers linked to these targets result in remedial action when performance is below acceptable levels. Horizon scanning and learning from others all areas within the Trust complete horizon scanning to identify potential risks to service delivery. The fortnightly Publication and Consultations list sent out to senior staff identifies most national documents or consultations. Organisational Learning the Trust seeks to learn from the experiences of other organisations as well as its own risks. For example, published reports from key regulators are always reviewed, with findings compared to existing Trust practice. 9 of 15
Being Open The Trust seeks to learn by engaging with patients and or their next of kin where complaints or adverse events have occurred and feedback is provided through the CLAEP report or specific cases to CGC. Training (incorporating Statutory and Mandatory Training) Extensive training activity takes place in the Trust on a range of subjects. Much of this is regulated by professional bodies such as the General Medical Council (GMC), the Royal College of Nursing (RCN) etc, while some are linked to individual personal development plans, or to the implementation of Trust policies. As a minimum, all staff receive appropriate statutory / mandatory training as described in the Trust Mandatory Training Policy. Risk Registers and the Board Assurance Framework: The Trust has a robust process for the management of the Trust-wide risk register that supports the Board Assurance Framework. The Trust-wide risk register is supported by comprehensive risk assessment systems in all areas, and is stored on the Trust risk management system, DATIX. Central Alert System (CAS): this is the method of communication of essential information to Trust personnel in circumstances where the information is urgent, requires immediate action from, or needs to be brought to the urgent attention of staff. This system is described in the Policy for the Management of Safety Alerts. Reactive Risk Processes: The Trust also identifies potential risks from events that have already occurred. The main sources of these come from: Complaints - The Trust has a well-established complaints process that is responsible for handling all Trust complaints and ensures that all concerns are responded to within the approved timescales. Complaints are graded using the Trust s Risk and Incident Grading Matrix; all serious complaints are the subject of a full root cause analysis (RCA). Information and action plans arising from complaints are used to develop or change the service delivery. The Trust Complaints handling process is described in detail in the Complaint Policy. Adverse Events - The Trust has a system for reporting Adverse Events and Near Misses or Serious Incidents (SIs), which is described in the Adverse Event Policy. All notified incidents are graded using a simple risk assessment matrix, consistent with that used for Risk Management, aligned with the national patient safety requirements. Claims, Litigation and inquests: The Trust s Legal Department works closely with the Complaints and Risk Departments to enable the early identification of potential legal claims against the Trust. The Legal Department liaises with HM Coroner and clinicians in respect of the inquest process. Any concerns or recommendations raised by the Coroner are communicated appropriately to ensure that remedial action is taken. The processes for Claims, Litigation and inquests are set out in the Claims Management & Investigation Policy - Clinical Negligence, Personal Injury & Property Claims Post Event Analysis where something happens within the Trust that impacts on services, potential risks are identified and appropriate management action put in place 10 of 15
to reduce or eliminate the possibility of a similar occurrence. This can be separate or complimentary to the processes described in the policies listed above. Central Alerting System (CAS) - The Trust has robust processes in place to respond to alerts issued through the national frameworks, and supplements this with its own internal alert system. These are set out in the Policy for the Management of Safety Alerts Assessment and recording of risks Risks identified through the processes outlined above should result in a risk assessment. Full guidance on completing risk assessments is contained in the Risk Assessment and Risk Management Code of Practice. Risks identified through the risks assessment process will be recorded on the appropriate local, CBU or corporate risk registers. The Trust will have a tiered system of risk management, supported by its corporate system. The process for the management of risk will incorporate a combination of escalation and aggregation of risk at various levels within the organisation. More detailed guidance on the recoding of risks and the maintenance of risk registers is included in the Procedure for the Management of Risk Registers. Process for Board review of the Trust risk register The Trust s Board of Directors has overarching responsibility for risk. The Trust Operational Board, Performance Assurance Committee, and the Audit Committee all have specific responsibilities for elements of the risk system. The Performance Assurance Committee will receive monthly reports from the CBU management teams setting out the High risks on their risk registers and the action plans for mitigation. The Trust Operational Board will receive and review organisation wide High risks on the Trust Risk Register monthly, this report will be presented to the Board of Directors at the next Board meeting. The Audit Committee will monitor and review financial risks on the Trust Risk Register and have an overview of the risk register at least annually. The Trust s Board Assurance Framework will be presented to the Board of Directors at least annually. 11 of 15
Appendix 2 Compliance Monitoring Process to be monitored How will compliance with the outlined process be monitored? Frequency By whom? If compliance gaps have been identified, who is responsible for creating an action plan, and ensuring implementation of required changes? Review of risk assessments on the risk register to check in date. High organisation wide risks Regular checks and email to managers not compliant 4-6 weekly Assistant Director: Risk & OH Reminder to update followed up at Performance Assurance Committee where there are regular or significant numbers of non-compliance. CBUs held to account via Committee. Report to TOB Monthly Assistant Director: Risk & OH CEO via TOB to hold senior managers to account on management of these risks and to ensure action taken as instructed. CBU High risks CBU reports Monthly Conformance Committee CBU teams to submit action cards to show mitigating actions at each monthly meeting. CBU risk registers Regular reviews of CBU risk registers At least quarterly CBU management meetings CBU management teams to hold heads of departments to account if out of date and expect clear action by the next meeting. Analysis of adverse events, complaints and claims CLAEP report Quarterly CLAEP Group and Clinical Governance Committee Actions required by CBUs to be completed as described in CLAEP action plan. 12 of 15
Appendix 3 Equality Impact Assessment Screening Form Peterborough and Stamford Hospitals NHS Foundation Trust STAGE ONE : Equality Impact Assessment screening form Assessing Functions/Policies for Relevance Blue boxes are to be filled in Free text Yellow boxes - Click the box to select from the drop down list Select from drop down box Name of function / service / strategy / policy / project (activity) to be assessed: Name(s) of those completing this EqIA Screening form: David Ireland, Assistant Director: Risk & OH CBU / Department Corporate Support Date Feb 11 Function/service/strategy/policy/project (activity) aim or purpose: Policy to establish the rules and responsibilities for managing risk. Is this a new or existing activity: Existing Policy What are the intended results of this activity: To provide a framework that establishes how risk is managed in the Trust. 13 of 15
How will you measure the outcome of the activity: Through the Monitoring and Reviewing process Who is intended to benefit from the activity Patients and staff Please identify any internal/external groups who have been consulted regarding this activity: Operational Management Board Use the table below to identify whether the activity could/does have a positive impact, a negative impact or no impact at all on either any or all of the equality groups specified. Age *Disability Ethnicity / Race Gender Religion / Belief Sexual Orientation Eliminating unlawful/unjustifiable discrimination Promoting equality of opportunity Promoting positive attitudes and good community relations between and towards differing equality groups Eliminating harassment or victimization Encourage involvement and participation Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Neutral Eliminating health inequalities Neutral Neutral Neutral Neutral Neutral Neutral 14 of 15
If the answer to any of the above is Positive or Negative then please complete the Stage Two Full Equality Impact Assessment form to avoid or address the potential adverse impact. Decision to proceed (please select): No, we have decided that it is not necessary to carryout a full EqIA Reason for decision There are no aspects of the policy which could discriminate against any group Executive Director/General Manager - I confirm that I have been briefed on the results of this impact assessment. Name John Randall Date 160911 Signature J.M. Randall Please note the following: It is an essential that this EqIA screening form is discussed by your management team and remains readily available for inspection. A copy should also be forwarded to the Communications team for publication on the Trusts internet site. 15 of 15