demonstrate a working understanding of integrated governance and assurance Clinical leads and clinical members of the Governing Body assess and advise on matters of clinical risk and patient care advise on quality, safety and clinical governance, having regard to any statutory or regulatory requirements Senior managers/risk owners take responsibility for the management of risk in their departments and for local risk registers, in accordance with the requirements of this policy and strategy by: assessing risk identify and implement mitigating actions in a timely fashion ensure that risks are escalated to the appropriate level in the organisation All staff Will: ensure that any significant risks they identify are reported to their line manager attend any safety, risk and governance training which has been identified by a process of training needs analysis as necessary for the performance of their role be aware of risks associated with their acts or omissions undertake appropriate risk assessments minimise risks wherever possible, in a managed way ensure that they are fully aware of all appropriate MCCG policies and procedures that impact on their work Risk management: committee structure Audit and Governance Committee The Committee shall provide the Governing Body with a means of independent and objective review of financial and corporate governance, assurance processes and risk management across the whole of the CCG’s activities (clinical and non-clinical). Clinical Quality Committee The Committee will report annually to the Governing Body in respect of the fulfilment of its functions with its terms of reference. Such report shall include, but not be limited to, functions undertaken in relation to the effectiveness of risk management within the CCG; the managements of
serious quality and safety incidents and any pertinent matters in respect of which the Committee has been engaged. Finance Committee The Finance Committee shall consider and review the financial report to be presented to the Governing Body, incorporating financial performance against budget, financial risk analysis, forecasts and robustness of underlying assumptions. Risk identification Risks will be identified from a number of sources, including but not limited to: incident reports and trends (internal, and by monitoring incidents in commissioned services) complaints monitoring in commissioned services patient and staff surveys inspections, such as Care Quality Commission and Royal Colleges Key Performance Indicators risk assessments local risk registers internal/ external feedback and recommendations Identifying and managing risks arising in commissioned services Commissioning is the process of putting in place healthcare services that effectively meet the needs of the population. The CCG has a duty to act with a view to securing continuous improvement to the quality of services and to assist and support the NHS England in relation to the Governing Body’s duty to improve the quality of primary medical services. The CCG is responsible for monitoring the safety and quality of the services it commissions and for taking action where there is significant concern, alongside, as necessary in the circumstances at the time, the appropriate regulatory body. The CCG, through the Director of Quality, will maintain oversight of the following: The processes in place in commissioned services to provide assurance with regard to clinical risk management, including (but not necessarily limited to): Safeguarding of adults and children Clinical Governance and Information Governance Confidentiality (including Caldicott Guardian) Health & Safety Infection Prevention and Control
Managing and overseeing the performance management of serious incidents reported by the providers of health services commissioned by the CCG. Clinical and quality risk will be monitored through Clinical Quality Review Groups and Clinical Quality Committee. In South London, monthly quality surveillance groups will meet to ensure all partners share information about quality of commissioned services. Risk Summits may be arranged when any commissioner has a serious concern about quality. Further guidance will follow following new guidance from the NHS England., Risk assessment Risks should be assessed using the matrix shown at Appendix 3. Risk assessment consistency The risk assessment process is qualitative and therefore prone to subjectivity. To ensure consistency all risks entered on the Risk Register and Governing Body Assurance framework will be moderated and reported to the CCG Executive team prior to presentation at the relevant Committee. The Executive team will review the Strategic Risk Register monthly, including the GBAF. Risk register The risk register will include as a minimum: source of the risk (including, but not limited to, incident reports, risk assessments, local risk registers, and external recommendations) description of the risk risk score summary risk treatment plan date of review residual risk rating The risk register and GBAF will be monitored monthly by the Executive Team and Operational Delivery Group. High and extreme risks will be transferred to the Governing Body Assurance Framework for review at each meeting of the Governing body, which will monitor the progress of Risk Action Plans. Covalent system and updating the Risk Register Covalent is the software system used by MCCG to manage its risk register and GBAF. The effectiveness of the system depends on those
APPENDIX 3: Risk assessment matrix Consequence score (severity levels) and examples of descriptors 1 2 3 4 5 Domains Negligible Minor Moderate Major Catastrophic Impact on the safety of patients, staff or public (physical/ psychological harm) Minimal injury requiring no/minimal intervention or treatment. No time off work Minor injury or illness, requiring minor intervention Requiring time off work for >3 days Increase in length of hospital stay by 1-3 days Moderate injury requiring professional intervention Requiring time off work for 4-14 days Increase in length of hospital stay by 4-15 days RIDDOR/agency reportable incident An event which impacts on a small number of patients Major injury leading to incapacity/disability Requiring time off work for >14 days Increase in length of hospital stay by >15 days Mismanagement of patient care with long-term effects Incident leading to death Multiple permanent injuries or irreversible health effects An event which impacts on a large number of patients Quality/complaints/ audit Peripheral element of treatment or service suboptimal Informal complaint/ inquiry Overall treatment or service suboptimal Formal complaint (stage 1) Local resolution Single failure to meet internal standards Minor implications for patient safety if unresolved Reduced performance rating if unresolved Treatment or service has significantly reduced effectiveness Formal complaint (stage 2) complaint Local resolution (with potential to go to independent review) Repeated failure to meet internal standards Major patient safety implications if findings are not acted on Non-compliance with national standards with significant risk to patients if unresolved Multiple complaints/ independent review Low performance rating Critical report Totally unacceptable level or quality of treatment/service Gross failure of patient safety if findings not acted on Inquest/ombudsman inquiry Gross failure to meet national standards
Human resources/ organisational development/ staffing/ competence Short-term low staffing level that temporarily reduces service quality (< 1 day) Low staffing level that reduces the service quality Late delivery of key objective/ service due to lack of staff Unsafe staffing level or competence (>1 day) Low staff morale Poor staff attendance for mandatory/key training Uncertain delivery of key objective/service due to lack of staff Unsafe staffing level or competence (>5 days) Loss of key staff Very low staff morale No staff attending mandatory/ key training Non-delivery of key objective/service due to lack of staff Ongoing unsafe staffing levels or competence Loss of several key staff No staff attending mandatory training /key training on an ongoing basis Statutory duty/ inspections No or minimal impact or breech of guidance/ statutory duty Breech of statutory legislation Reduced performance rating if unresolved Single breech in statutory duty Challenging external recommendations/ improvement notice Enforcement action Multiple breeches in statutory duty Improvement notices Low performance rating Critical report Multiple breeches in statutory duty Prosecution Complete systems change required Zero performance rating Severely critical report Adverse publicity/ reputation Rumours Potential for public concern Local media coverage – short-term reduction in public confidence Elements of public expectation not being met Local media coverage – long-term reduction in public confidence National media coverage with <3 days service well below reasonable public expectation National media coverage with >3 days service well below reasonable public expectation. MP concerned (questions in the House) Total loss of public confidence Business Projects/ Objectives Insignificant cost increase/ schedule slippage Key ‘political’ target is being achieved and impact prevents improvement <5 per cent over project budget Schedule slippage Key ‘political’ target is being achieved but impact reduces performance marginally below target in the near future or Performance currently on target, but there is no agreed plan to meet the target 5–10 per cent over project budget Schedule slippage Key ‘political’ goal is marginally below target or is soon projected to deteriorate beyond acceptable limits or There is an agreed plan but it does not yet meet the rising target Non-compliance with national per cent over project budget Schedule slippage Key ‘political’ target not being achieved and impact prevents improvement, or substantial decline in performance trend Incident leading >25 per cent over project budget Schedule slippage Key objectives not met Key ‘political’ target is not being achieved and the impact further deteriorates the position 25
Finance including claims Small loss Risk of claim remote Loss of per cent of budget Claim less than £10,000 Loss of 0.25–0.5 per cent of budget Claim(s) between £10,000 and £100,000 Uncertain delivery of key objective/Loss of 0.5–1.0 per cent of budget Claim(s) between £100,000 and £1 million Purchasers failing to pay on time Non-delivery of key objective/ Loss of >1 per cent of budget Failure to meet specification/ slippage Loss of contract / payment by results Claim(s) >£1 million Service/business interruption Environmental impact Loss/interruption of >1 hour Minimal or no impact on the environment Loss/interruption of >8 hours Minor impact on environment Loss/interruption of >1 day Moderate impact on environment Loss/interruption of >1 week Major impact on environment Permanent loss of service or facility Catastrophic impact on environment Table 2 Likelihood score (L) What is the likelihood of the consequence occurring? The frequency-based score is appropriate in most circumstances and is easier to identify. It should be used whenever it is possible to identify a frequency. Likelihood score 1 2 3 4 5 Descriptor Rare Unlikely Possible Likely Almost certain Frequency How often might it/does it happen This will probably never happen/recur Do not expect it to happen/recur but it is possible it may do so Might happen or recur occasionally Will probably happen/recur but it is not a persisting issue Will undoubtedly happen/recur, possibly frequently Table 3 Risk scoring = consequence x likelihood ( C x L ) Likelihood Likelihood score 1 2 3 4 5 Rare Unlikely Possible Likely Almost certain 5 Catastrophic 5 10 15 20 4 Major 4 8 12 16 20 3 Moderate 3 6 9 12 15 2 Minor 2 4 6 8 10 1 Negligible 1 2 3 4 5
For grading risk, the scores obtained from the risk matrix are assigned grades as follows 1 - 3 Low risk 4 - 6 Moderate risk 8 - 12 High risk 15 - 25 Significant risk APPENDIX 4: Authority levels for managing different levels of risk and risk escalation All action plans required must use the template shown as Appendix 5: Risk Action Plan and Assurance Report Key Levels of Risk Risk Category Management Actions Action Plan Requirements 1-3 Low Risk To be brought to the attention of the department/ team leader. Manage by routine procedures Formal action plan not required 4-6 Moderate Risk Line Manager - immediate control measures in place - review risk assessment - inform Heads of Department. Specific responsibility for risk assessment and action planning must be allocated to a named person. Deadline for completion will usually be within 6 to 12 months and will depend on the availability of resources. Head of Department to decide whether to Accept the Risk. If Accepted no formal action plan is required. If risk requires Mitigation a formal action plan must be produced. The Risk will be managed at Departmental Level. 8-9 High Risk Urgent attention required. To be brought to the attention of the responsible Director, Heads of Department, Line Manager - immediate control measures put in place - review risk assessment - action plan devised. Within one month of identification appropriate action must be agreed. The deadline for implementation and reassessment will normally be no later than 6 months from identification. Director to decide whether to Accept the Risk. If Accepted no formal action plan is required. If risk requires Mitigation a formal action plan must be produced. The Risk will be managed at Directorate level. 10-12 High Risk Urgent attention required. To be brought to the attention of the responsible Director, Heads of Department, Line Manager - immediate control measures in place - review risk assessment - action plan devised. Within one month of identification appropriate action must be agreed. The deadline for implementation and reassessment will normally be no later than 6 months from identification. An action plan should be produced. The risks must be added to the Corporate Risk Register or the Directorate Risk Register. The Director must also decide whether to recommend that the risk be escalated to the Governing Body Assurance Framework. This may be agreed in exceptional circumstances even though the risk is scored below 15. Otherwise management and oversight of the risk
Action Plan to Address Gaps in Control/ Assurance Action (A) / Milestone (MS) A / MS Owner Priority End Date Resources Contingency /Dependency 1 Actions must comply with SMART criteria i.e. be Specific, Measurable, Achievable, Realistic and Time Limited A or MS Job Title High Medium Low Date by which action will be achieved What is needed to achieve the action What other actions/ departments/ individuals etc does this action rely on 2 3 1a. Progress Reports for all Actions and Milestones Progress Evidence RAG Factors Preventing Green RAG Rating Remedial Action Being Taken To Ensure Action End Date is Achieved End Date For Remedial Action 1 Progress made to date on achieving the action Evidence available to support the progress made and the RAG rating. R If the action is on track to achieve its End Date it should have a Green RAG Rating. If not explain why. Please explain what is being done to get the action back on track. When will the remedial action be complete
2 A 3 G Action Plan to Achieve Target Risk Score Action (A) / Milestone (MS) A / MS Owner Priority End Date Resources Contingency /Dependency 1 Actions must comply with SMART criteria i.e. be Specific, Measurable, Achievable, Realistic and Time Limited A or MS Job Title High Medium Low Date by which action will be achieved What is needed to achieve the action What other actions/ departments/ individuals etc does this action rely on 2 3
2a. Progress Reports for all Actions and Milestones No Progress Evidence RAG Factors Preventing Green RAG Rating Remedial Action Being Taken To Ensure Action End Date is Achieved End Date For Remedial Action 1 Progress made to date on achieving the action Evidence available to support the progress made and the RAG rating. R If the action is on track to achieve its End Date it should have a Green RAG Rating. If not explain why. Please explain what is being done to get the action back on track. When the remedial action be complete 2 A 3 G
These concern the effective management and control of the finances of the CCG. The risk events can range from insufficient funding, poor budget management, mismanage assets and liabilities and failure to collect due revenue  Governing body  Audit and Governance Committee  Finance committee Governance These concern the establishment of an effective organisational structure with clear lines of authorities and accountabilities. The risk events can include inappropriate decision making and delegation of authorities, lack of appropriate tone set by leader  Governing Body  Executive Team  Audit and Governance Committee Legal & Compliance These concern issues such as health & safety, consumer protection, data protection, employment practices, claims against any of the services you commission  Governing Body  Executive Team Clinical Quality committee will monitor legal claims against providers from a quality perspective. Operations These concern the day to day concerns MCCG is confronted with as it strives to deliver its strategic objectives. They can be anything from loss of key staff to process failure It covers risk events such as breakdown in process to deliver service  Governing Body  Executive Team People
These concern the insufficient capacity and capability of ‘human capital’, as well as inappropriate staff behaviour, failing to comply with employment legislation or industrial action.  Executive Team Clinical Quality Committee (workforce assurance of providers in terms of impact on quality, staff survey etc.) Strategic These concern external factors such as the economy, changes in the political environment, technological changes, changes in customer behaviour/needs, legal and regulatory changes, and environmental factors.  Governing Body  Executive Team Information Management and Technology These concern the day to day issues MCCG is confronted with as it strives to deliver its strategic objectives. They can be anything from loss of data to failure of a critical IT system. It covers risk events such as technological breakdown or loss of hard or soft copy data.  Governing Body  Executive Team Clinical These concern risks that arise directly from the provision and delivery of healthcare to patients. This includes clinical errors and negligence, healthcare associated infection and failure to obtain consent.  Governing body  Executive Team  Clinical Quality Committee Partnerships/Contractual These concern risks associated with failure of contractors and partnership arrangements to deliver services or products to the agreed cost and specification. Contractor fails to deliver, partner agencies do not have  Governing Body  Executive Team  Clinical Quality Committee (for risks associated with partners/contractors