Risk Management and Patient Safety

R E V I E W

Risk Management in Executive Levels of Healthcare

Organizations: Insights from a Scoping Review (2018) This article was published in the following Dove Press journal:

Risk Management and Healthcare Policy

Masoud Ferdosi 1

Reza Rezayatmand 2

Yasamin Molavi Taleghani 3

1Health Management and Economics

Research Center, Department of Health

Services Management, School of

Management and Medical Information

Sciences, Isfahan University of Medical

Sciences, Isfahan, Iran; 2Health

Management and Economics Research

Center, Isfahan University of Medical

Sciences, Isfahan, Iran; 3Department of

Health Services Management, School of

Management and Medical Information

Sciences, Isfahan University of Medical

Sciences, Isfahan, Iran

Background: This study attempted to present a framework and appropriate techniques for

implementing risk management (RM) in executive levels of healthcare organizations (HCOs)

and grasping new future research opportunities in this field.

Methods: A scoping review was conducted of all English language studies, from January

2000 to October 2018 in the main bibliographic databases. Review selection and character-

ization were performed by two independent reviewers using pretested forms.

Results: Following a keyword search and an assessment of fit for this review, 37 studies

were analyzed. Based on the findings and considering the ISO31000 model, a comprehensive

yet simple framework of risk management is developed for the executive levels of HCOs. It

includes five main phases: establishing the context, risk assessment, risk treatment, monitor-

ing and review, and communication and consultation. A set of tools and techniques were also

suggested for use at each phase. Also, the status of risk management in the executive levels

of HCOs was determined based on the proposed framework.

Conclusion: The framework can be used as a training tool to guide in effective risk

assessment as well as a tool to assess non-clinical risks of healthcare organizations.

Managers of healthcare organizations who seek to ensure high quality should use a range

of risk management methods and tools in their organizations, based on their need, and not

assume that each tool is comprehensive.

Keywords: organization risk management, scoping review, risk analysis, health care,

executive levels

Introduction Given the World Health Report (2000), the significance of healthcare organizations

(HCOs) has grown in global health discourse.1 However, in the last decade, HCOs

have faced two contradictions: first, healthcare costs have increased due to popula-

tion aging, the introduction of advanced technologies, and increased medical

errors.2,3 On the other hand, HCOs have become more complicated due to such

factors as efficient customers, biomedical developments, the complexity of services

and an increasing number of healthcare users.2,3 Therefore, demand for healthcare

is significantly higher than the human capacity and resources available in healthcare

departments.4 Corresponding to these limits, three interventional approaches have

been developed at various levels of the HCOs: (i) quality management, (ii) risk

management, and (iii) patient safety.5

In particular, risk management (RM) is a process-oriented method providing a

structured framework for identifying, assessing, and reducing risk at appropriate

times for HCOs.6 RM approach protects healthcare providers against unfavorable

Correspondence: Yasamin Molavi Taleghani Isfahan University of Medical Sciences, School of Management and Medical Informatics, Health Management and Economics Research Center, Hezar Jarib Street, Second Floor, Isfahan, Iran Tel +98 912 7233347 Email [email protected]

Risk Management and Healthcare Policy Dovepress open access to scientific and medical research

Open Access Full Text Article

submit your manuscript | www.dovepress.com Risk Management and Healthcare Policy 2020:13 215–243 215

http://doi.org/10.2147/RMHP.S231712

DovePress © 2020 Ferdosi et al. This work is published and licensed by Dove Medical Press Limited. The full terms of this license are available at https://www.dovepress.com/terms. php and incorporate the Creative Commons Attribution – Non Commercial (unported, v3.0) License (http://creativecommons.org/licenses/by-nc/3.0/). By accessing the

work you hereby accept the Terms. Non-commercial uses of the work are permitted without any further permission from Dove Medical Press Limited, provided the work is properly attributed. For permission for commercial use of this work, please see paragraphs 4.2 and 5 of our Terms (https://www.dovepress.com/terms.php).

R

is k

M an

ag em

en t a

nd H

ea lth

ca re

P ol

ic y

do w

nl oa

de d

fr om

h ttp

s: //w

w w

.d ov

ep re

ss .c

om / b

y 16

5. 21

5. 20

9. 15

o n

18 -A

pr -2

02 0

F or

p er

so na

l u se

o nl

y.

Powered by TCPDF (www.tcpdf.org)

1 / 1

incidents.7 This way, RM plays a major role in shrinking

uncertainties and enhancing rich opportunities for different

areas of the health system.8 Development of RM helps

HCOs and providers to reduce damage due to the probable

occurrence of defective processes through identifying error,

rooting, and strategy development.9 Implementing RM in

HCOs improves allocation of health resources,10 process

management, decision-making, reduced organizational

losses,11 patient safety,11 continuous quality improvement,2

customer satisfaction,2 organizational performance,12 hos-

pital reputation,11 and better community creation.2

A general framework for RM needs to be identified

before implementing the risk process. This framework deter-

mines the strategy of organization for identifying risk, risk

assessment, and risk reduction.13 This strategy outlines how

the RM process should be implemented in the organization. It

determines the resources that are needed, the key roles and

responsibilities for that, the ways risk needs to be identified.

It shows how the decision-making process looks like while

using those strategies.13 The available evidence suggests that

despite the existence of a large number of RM techniques, a

few of them have been employed so far in the HCOs.14–16

Risk management is one of the emerging areas in man-

agement systems; there are several reports that have provided

an overview of risk management inHCOs; however, it is

difficult to find studies that have systematically synthesized

risk management models at the executive levels of healthcare

organizations.17–19 This sector is far behind the rest of the

industry in terms of using these techniques. Nowadays, there

is a consensus in the healthcare sectors that the knowledge,

experience, and expertise of other industries in RM can

improve the quality of services provided in the healthcare

sectors.3 Therefore, reviewing the selection of RM techni-

ques seems indispensable. These instruments need to be

tailored to the complexities of the healthcare system and

the causes affecting incidents in this sector.20,21

The organizational structure of the healthcare system

has been classified into executive, administrative and

operational, each of which is exposed to some risks.22

This limited study aims to identify those risks that happen

in executive levels. The study would not consider those

risks that may happen in the operational levels of health-

care organizations and can be considered as a clinical risk.

Mention should be made that the executive levels of

healthcare organizations are the headquarters and deputies

of the HCOs that provides counseling and control over

healthcare delivery units.22 Therefore, the aim of this

review is to scope published different organizational RM

models, identify the strengths and weaknesses of each

model, and this way, propose a framework for implement-

ing RM in the executive levels of HCOs.

The applied purpose of this study was to integrate existing

research on the various areas of RM cycle (risk identification,

risk assessment, & risk management) and ultimately provide a

centralized knowledge base for future research in the executive

levels of HCOs. It is of note that the executive levels of HCOs

are the headquarters and deputies of the HCOs that provides

counseling and control over healthcare delivery units.

Methods The methodological framework of the scope review

described below was guided by such methodologies,

which have been published elsewhere.23,24

Scoping Review Question The first phase was represented by the definition of the

scope of the study in compliance with the objectives and

the underlying research hypotheses.

Based on preliminary studies, the research questions

developed for scoping review are as follows:

RQ1: How are organizational risks identified and cate-

gorized within the executive levels of HCOs?

RQ2: What is the proposed framework for organiza-

tional risk management in the executive levels of

HCOs? Also, what is the status of risk management

in the executive levels of HCOs based on the pro-

posed framework?

RQ3: What techniques and tools are available for

implementing organizational risk management in

the executive levels of HCOs?

Inclusion and Exclusion Criteria To obtain and include relevant and important documents to

concentrate on, a series of inclusion and exclusion criteria

should be defined. The selection of the studies was done

according to the following inclusion criteria:

(i) Studies on organizational RM and assessment tech-

niques and framework in healthcare organizations or

related organizations appropriate for imitation in the

healthcare organization; (ii) articles in English; (iii) 2000

to October 2018.

The following studies were excluded: (i) in the format

of letters, editorials, news, professional commentaries, and

reviews; (ii) without available abstracts or full text or

Ferdosi et al Dovepress

submit your manuscript | www.dovepress.com

DovePress Risk Management and Healthcare Policy 2020:13216

R

is k

M an

ag em

en t a

nd H

ea lth

ca re

P ol

ic y

do w

nl oa

de d

fr om

h ttp

s: //w

w w

.d ov

ep re

ss .c

om / b

y 16

5. 21

5. 20

9. 15

o n

18 -A

pr -2

02 0

F or

p er

so na

l u se

o nl

y.

Powered by TCPDF (www.tcpdf.org)

1 / 1

references; (v) Models that cannot be imitated in health-

care organizations; (vi) Published in languages other than

English.

Identifying Locating Sources and Relevant

Articles This study was conducted in October 2018 through con-

sulting such databases as Pub Med, ISI, Emerald, Scopus,

IEEE, Springer, ProQuest, Cochrane, and Wiley from

2000 to May 2018. The search strategy was the same for

all the databases.

The identification of the keywords related to the sub-

jects and the objectives of the study are as follows: initi-

ally, keywords were identified by the authors through a

brainstorming process. The identified keywords were

refined and validated by a team composed of two univer-

sity academic members and two healthcare managers. The

search strategy was formulated using Boolean operators.

The formula was searched in the field of title and abstract

in online databases. The search strings used are shown in

Table 1, a search for each research question was per-

formed. Also, the search was repeated two times with the

following search string. In addition, the references were

retrieved from the studies included in the first iteration.

The keywords of references that matched with the search

keywords were chosen.

Study Selection and Data Abstraction The two authors (YMT and MF) independently performed

level 1 (titles and abstracts) and level 2 (full article texts)

screening forms. All screening and extraction were com-

pleted in duplicate. Disagreements were discussed between

the two reviewers and a third-party reviewer (R R) was

contacted if disagreements could not be resolved. After

independent reading of the full texts, the content analyzed

and selected the articles that answer the respective research

questions. Study quality was not assessed during the scop-

ing review as the objective of a scoping review is to identify

gaps in the literature and highlight future areas for systema-

tic review.23,24 The required information extracted based on

the research questions and placed in the designed templates.

Results Three thousand five hundred and seventy-four studies

were screened, excluded 761 duplicates, 1556 on title

review, 1081 on abstract review and 144 in a full-text

review. In total, leaving 37 papers (32 papers first iteration

on the database and five studies from hand searching)

search for critical appraisal. Table 2 shows the flowchart

for the study selection.

Characteristics of Articles Reviewed Bibliographical information about the 36 articles included

in this review can be obtained from Table 3.

Table 1 Search Strings for Research Questions and Studies

Code Search Strings Online Databases Field Quantity

RQ1 (risk OR failure* OR error* OR event*) AND (source* OR

classification* OR identify* OR category* OR epidemiology) AND

(organization* OR system* OR administration*) NOT clinical*

PubMed Title, Mesh, and Abstract 164

ISI Title, Topic, and Abstract 495

Scopus Title, Abstract, keywords 284

Emerald Title, Abstract, keywords 114

ProQuest Title, Abstract, keywords 102

Cochrane Title, Abstract, keywords 28

Wiley Title, Abstract, keywords 49

Springer Title, Abstract, keywords 30

IEEE Title, Mesh, and Abstract 21

RQ2

And

RQ3

(“risk management*” OR “risk assessment*” OR “management risk*”

OR “assessment risk” OR “ risk analysis*”) AND (model* OR

approach* OR technique* OR method* OR structure* OR tool* OR

process* OR framework*) AND (organization* OR system* OR

administration*)

PubMed Title, Mesh and Abstract 387

ISI Title, topic, and Abstract 273

Scopus Title, Abstract, keywords 838

Emerald Title, Abstract, keywords 235

ProQuest Title, Abstract, keywords 61

Cochrane Title, Abstract, keywords 24

Wiley Title, Abstract, keywords 215

Springer Title, Abstract, keywords 63

IEEE Title, Abstract, keywords 191

Dovepress Ferdosi et al

Risk Management and Healthcare Policy 2020:13 submit your manuscript | www.dovepress.com

DovePress 217

R

is k

M an

ag em

en t a

nd H

ea lth

ca re

P ol

ic y

do w

nl oa

de d

fr om

h ttp

s: //w

w w

.d ov

ep re

ss .c

om / b

y 16

5. 21

5. 20

9. 15

o n

18 -A

pr -2

02 0

F or

p er

so na

l u se

o nl

y.

Powered by TCPDF (www.tcpdf.org)

1 / 1

Code Search Strings Online Databases Field Quantity

RQ1 (risk OR failure* OR error* OR event*) AND (source* OR classification* OR identify* OR category* OR epidemiology) AND (organization* OR system* OR administration*) NOT clinical*

PubMed Title, Mesh, and Abstract 164 ISI Title, Topic, and Abstract 495 Scopus Title, Abstract, keywords 284 Emerald Title, Abstract, keywords 114 ProQuest Title, Abstract, keywords 102 Cochrane Title, Abstract, keywords 28 Wiley Title, Abstract, keywords 49 Springer Title, Abstract, keywords 30 IEEE Title, Mesh, and Abstract 21

RQ2 And RQ3

(�risk management*� OR �risk assessment*� OR �management risk*� OR �assessment risk� OR � risk analysis*�) AND (model* OR approach* OR technique* OR method* OR structure* OR tool* OR process* OR framework*) AND (organization* OR system* OR administration*)

PubMed Title, Mesh and Abstract 387 ISI Title, topic, and Abstract 273 Scopus Title, Abstract, keywords 838 Emerald Title, Abstract, keywords 235 ProQuest Title, Abstract, keywords 61 Cochrane Title, Abstract, keywords 24 Wiley Title, Abstract, keywords 215 Springer Title, Abstract, keywords 63 IEEE Title, Abstract, keywords 191

According to Table 3, 11 articles (14.3%) were used to

answer the first research question, 30 articles (38.9%) were

used to answer questions 2, and finally, 36 articles (46.8%)

were used to answer research question 3. (Total papers >36

because each paper may be classified into two or more study

types, or may address two or more review questions.) Also, it

could be recognized that all but four articles were published

in 2009 or later, this is due to the complexity of environment

and type of services provided by organizations and, conse-

quently, use of the RM and risk assessment process as a tool

for reducing errors and incidents in recent years.

As can be seen in Table 3, based on the setting of

the studies, Europe had the most study with (59.5%)

of the authors affiliated with European universities and

Table 2 Paper Selection Process

Phase Number of

Imported

Number of

Excluded

Exclusion Criteria

Identification First iteration on data base

Question 1: 1287 (36.1%)

Question 2, 3: 2287 (63.9%)

3574 – R0: Disproportionate to the goals and

research questions

R1: letters, editorials, news, professional

commentaries, and reviews

R2: No outcome reported

R3: Poor study design

R4: No abstract or full text available

R5: Unclear description

R6: Not applicable for healthcare

organizations.

R7: No systematic approach to error

Screening Duplicate citations – 761

Title screening

Reason excluding papers on the basis of titles:

R0: 998 (64.1%) R1: 198(12.7%)

R6: 286(18.3%) R8:74(4.7%)

2813 1556

Abstract screening

Reason excluding papers on the basis of abstract:

R0: 450 (41.6%) R1: 127 (11.7%)

R2: 42 (3.9%) R3: 39 (3.6%)

R4: 36 (3.3%) R5: 25 (2.3%)

R6: 309 (28.6%) R8: 53 (4.9%)

1257 1081

Eligibility Full-text eligibility

(Agreement rate: 85%).

Reason excluding papers on the basis of full text:

R0: 39(27.4%) R1: 8(5.6%) R2: 10(6.94%) R3: 18

(12.5%) R4: 7(4.9%) R5: 6 (4.2%)

R6: 27(19%) R7: 29(20.4%)

176 144

Included Relevant papers found from the search on

database

Responsiveness rate of studied divided by each

research question:

Question 1: 10(14.7%) Question 2: 27(39.7%)

Question 3: 31(45.6%)

32 -

Relevant references on references of relevant

papers

Responsiveness rate of studied divided by each

research question:

Question 1: 1(20%) Question 2: 3 (30%)

Question 3: 5 (50%)

5 -

Achieving the relevant papers

Responsiveness rate of studied divided by each

research question:

Question 1: 11(14.3%) Question 2: 30(38.9%)

Question 3: 36(46.8%)

37 -

Note: Each study may answer several research questions.

Ferdosi et al Dovepress

submit your manuscript | www.dovepress.com

DovePress Risk Management and Healthcare Policy 2020:13218

R

is k

M an

ag em

en t a

nd H

ea lth

ca re

P ol

ic y

do w

nl oa

de d

fr om

h ttp

s: //w

w w

.d ov

ep re

ss .c

om / b

y 16

5. 21

5. 20

9. 15

o n

18 -A

pr -2

02 0

F or

p er

so na

l u se

o nl

y.

Powered by TCPDF (www.tcpdf.org)

1 / 1

Phase Number of Imported Number of Excluded Exclusion Criteria

Identification First iteration on data base 3574 � R0: Disproportionate to the goals and research questions R1: letters, editorials, news, professional commentaries, and reviews R2: No outcome reported R3: Poor study design R4: No abstract or full text available R5: Unclear description R6: Not applicable for healthcare organizations. R7: No systematic approach to error

Question 1: 1287 (36.1%) Question 2, 3: 2287 (63.9%)

Screening Duplicate citations � 761

Title screening 2813 1556 Reason excluding papers on the basis of titles: R0: 998 (64.1%) R1: 198(12.7%) R6: 286(18.3%) R8:74(4.7%) Abstract screening 1257 1081

Reason excluding papers on the basis of abstract: R0: 450 (41.6%) R1: 127 (11.7%) R2: 42 (3.9%) R3: 39 (3.6%) R4: 36 (3.3%) R5: 25 (2.3%) R6: 309 (28.6%) R8: 53 (4.9%)

Eligibility Full-text eligibility 176 144 (Agreement rate: 85%). Reason excluding papers on the basis of full text: R0: 39(27.4%) R1: 8(5.6%) R2: 10(6.94%) R3: 18 (12.5%) R4: 7(4.9%) R5: 6 (4.2%) R6: 27(19%) R7: 29(20.4%)

Included Relevant papers found from the search on database 32 -

Responsiveness rate of studied divided by each research question: Question 1: 10(14.7%) Question 2: 27(39.7%) Question 3: 31(45.6%) Relevant references on references of relevant papers

Responsiveness rate of studied divided by each research question: Question 1: 1(20%) Question 2: 3 (30%) Question 3: 5 (50%) Achieving the relevant papers 37 -

Responsiveness rate of studied divided by each research question: Question 1: 11(14.3%) Question 2: 30(38.9%) Question 3: 36(46.8%)

Table 3 Bibliographical Sources of the Studies Included in the Literature Review

Code First Author Year of

Publication

Research Designs of the Articles Included in the Literature Review Answering Which

Research question Article

Type*

Data

Collection*

Country/

Setting of the

Studies

Context/Study

Population

1 Molavi

Taleghani 25

2016 4 1,2,3,4,5 Iran Emergency surgery ward

in hospital

2,3

2 Gervais 26

2012 3 2,4,5 Ireland Pharmaceutical

manufacturing

environment

2,3

3 Bernardini 27

2013 3 2 Italy Complex and mission-

critical systems

2,3

4 Cagliano 8

2011 3 6 Italy Pharmacy department in a

large hospital

2,3,1

5 Parand 28

2017 4 1,4,5 England+ Italy Medication administration

within homecare

1,2,3

6 Sendlhofer 29

2015 3 2,6 Austria Large university hospital 2,3

7 Lopez 30

2010 4 2,3 USA Clinical cell therapy in

regenerative medicine

2,3

8 Emblemsvag 31

2002 3 6,2 Norway Manufacturing

environment

1,2,3

9 Jaberidoost 32

2015 4 1,2,3,5 Iran Pharmaceutical industry 2,3

10 Wierenga 33

2009 3 5,3 Netherlands Two hospital 2,3

11 Niel-Laine 34

2011 2 2,5 France A central sterile supply

department

2,3,1

12 Trucco 35

2006 2 1,2,4,3 Italy Drug therapy management

process

2,3

13 Emre

Simsekler 36

2018 4 1,2,6 England Gastroenterology Unit in

Hospitals

1,3

14 Bonnabry 37

2005 4 5 Switzerland Pediatric parenteral

nutrition process

2,3

15 Rezaei 38

2018 4 2,5,1,3 IRAN Surgery ward in hospital 2,3

16 Domanski 39

2016 3 1,2,3 Poland Nonprofit Organizations 1,2,3

17 Ramkumar 40

2016 4 2,5,6 India E-procurement systems 1,2,3

18 Beauchamp-

Akatova 41

2013 3 2,3,6 Netherlands Air transport systems 2,3

19 Faiella 42

2017 4 2,3,6 Uk Administration of

medication in the home

setting

2,3

20 Usman Tariq 43

2013 3 6,2 Saudi Arabia Iodine development

industry

1,2,3

(Continued)

Dovepress Ferdosi et al

Risk Management and Healthcare Policy 2020:13 submit your manuscript | www.dovepress.com

DovePress 219

R

is k

M an

ag em

en t a

nd H

ea lth

ca re

P ol

ic y

do w

nl oa

de d

fr om

h ttp

s: //w

w w

.d ov

ep re

ss .c

om / b

y 16

5. 21

5. 20

9. 15

o n

18 -A

pr -2

02 0

F or

p er

so na

l u se

o nl

y.

Powered by TCPDF (www.tcpdf.org)

1 / 1

Code First Author Year of Publication Research Designs of the Articles Included in the Literature Review Answering Which Research question Article Type

(see note * on page 6)

Data Collection (see note * on page 6)

Country/ Setting of the Studies

Context/Study Population

1 Molavi Taleghani (see endnote 25 on page 28)

2016 4 1,2,3,4,5 Iran Emergency surgery ward in hospital

2,3

2 Gervais (see endnote 26 on page 27)

2012 3 2,4,5 Ireland Pharmaceutical manufacturing environment

2,3

3 Bernardini (see endnote 27 on page 27)

2013 3 2 Italy Complex and mission- critical systems

2,3

4 Cagliano (see endnote 8 on page 27)

2011 3 6 Italy Pharmacy department in a large hospital

2,3,1

5 Parand (see endnote 28 on page 28)

2017 4 1,4,5 England+ Italy Medication administration within homecare

1,2,3

6 Sendlhofer (see endnote 29 on page 28)

2015 3 2,6 Austria Large university hospital 2,3

7 Lopez (see endnote 30 on page 28)

2010 4 2,3 USA Clinical cell therapy in regenerative medicine

2,3

8 Emblemsvag (see endnote 31 on page 28)

2002 3 6,2 Norway Manufacturing environment 1,2,3

9 Jaberidoost (see endnote 32 on page 28)

2015 4 1,2,3,5 Iran Pharmaceutical industry 2,3

10 Wierenga (see endnote 33 on page 28)

2009 3 5,3 Netherlands Two hospital 2,3

11 Niel-Laine (see endnote 34 on page 28)

2011 2 2,5 France A central sterile supply department 2,3,1

12 Trucco (see endnote 35 on page 28)

2006 2 1,2,4,3 Italy Drug therapy management process

2,3

13 Emre Simsekler (see endnote 36 on page 28)

2018 4 1,2,6 England Gastroenterology Unit in Hospitals

1,3

14 Bonnabry (see endnote 37 on page 28)

2005 4 5 Switzerland Pediatric parenteral nutrition process

2,3

15 Rezaei (see endnote 38 on page 28)

2018 4 2,5,1,3 IRAN Surgery ward in hospital 2,3

16 Domanski (see endnote 39 on page 28)

2016 3 1,2,3 Poland Nonprofit Organizations 1,2,3

17 Ramkumar (see endnote 40 on page 28)

2016 4 2,5,6 India E-procurement systems 1,2,3

18 Beauchamp- Akatova (see endnote 41 on page 28)

2013 3 2,3,6 Netherlands Air transport systems 2,3

19 Faiella (see endnote 42 on page 28)

2017 4 2,3,6 Uk Administration of medication in the home setting

2,3

20 Usman Tariq (see endnote 43 on page 28)

2013 3 6,2 Saudi Arabia Iodine development industry 1,2,3

institutions. Asia was the next one with (21.6%) of the

studies, followed by America (13.5%), Oceania

(2.7%), and Africa with 2.7%. Also, most of the stu-

dies examined in developed countries. Thus, at this

point, we can already identify a need for more

research into risk management in developing countries.

As for design, 2(5.4%) studies were empirical quanti-

tative, 5 (13.5%) empirical qualitative, 12 (32.4%) con-

ceptual/theoretical and 18 (48.7%) mix method.

How are Organizational Risks Identified

and Categorized Within Executive Levels

of Healthcare Organizations? Risk identification is usually a necessary condition for later

risk management.25 Given dynamic and complex healthcare

organizations, different risk sources can trigger hazardous

situations, potentially harming the organization.36 It is

therefore essential to consider as many risk sources as

possible within a classification to help participants

Table 3 (Continued).

21 Famiyeh 44

2015 4 3,1,5,4 Ghana Mining organization 2,3

22 Choo 45

2015 4 6,1,3,4,5 USA Business unit within a

large high-tech

organization

1,2,3

23 Apostolopoulos 46

2016 4 3,5,6 UK Various industries 1,2,3

24 Delcea 47

2016 1 2,6 Romania Clinical Emergency

County Hospital

1,3

25 Abdi 48

2016 4 6,4,3,5 Iran Intensive care unit 2,3

26 Chu 49

2014 4 5,6 Taiwan E-healthcare architecture

and syndrome test

2,3

27 Prijatelj 50

2012 3 5,3 Slovenia Selected clinical

departments

2,3

28 Kerckhoffs 51

2013 2 1,5 Netherlands Intensive Care Unit of in

hospital

2,3

29 Vahidnia 52

2017 2 1,3,6,2,4 Turkey Small software company in

a University

2,3

30 Leung 53

2008 3 1,2,3,5 Canada Public sector research 2,3

31 Zeng 54

2013 3 2 USA Enterprise resource

planning (ERP) systems

2,3

32 MC Emre

Simsekl 55

2015 4 1,2,4 UK University Hospitals

Foundation Trust

1,3

33 M. C. Emre

Simsekler 36

2018 2 3,1 UK Health-care Foundation

Trust

3

34 Jun 56

2010 4 2,6,3,1 UK Health service 3

35 Card 20

2014 1 5,1 USA Healthcare organization 3

36 Potts 57

2014 4 1,5,3,2,4 UK Community-based

anticoagulation clinic

2,3

37 Kessels-

Habraken 58

2009 4 1,2,4,5 Netherlands General hospital 2,3

Notes: *Type of study included 1) Empirical quantitative; 2) Empirical qualitative 3) Conceptual/theoretical 4) mixed method. Data collection methods included 1) Survey (questionnaires or checklists); 2) Database, Documents & Records; 3) Interviews; 4) observation; 5) Focus Groups; 6) Ethnographies, Oral History, & Case Studies.

Ferdosi et al Dovepress

submit your manuscript | www.dovepress.com

DovePress Risk Management and Healthcare Policy 2020:13220

R

is k

M an

ag em

en t a

nd H

ea lth

ca re

P ol

ic y

do w

nl oa

de d

fr om

h ttp

s: //w

w w

.d ov

ep re

ss .c

om / b

y 16

5. 21

5. 20

9. 15

o n

18 -A

pr -2

02 0

F or

p er

so na

l u se

o nl

y.

Powered by TCPDF (www.tcpdf.org)

1 / 1

21 Famiyeh (see endnote 44 on page 28)

2015 4 3,1,5,4 Ghana Mining organization 2,3

22 Choo (see endnote 45 on page 28)

2015 4 6,1,3,4,5 USA Business unit within a large high-tech organization

1,2,3

23 Apostolopoulos (see endnote 46 on page 28)

2016 4 3,5,6 UK Various industries 1,2,3

24 Delcea (see endnote 47 on page 28)

2016 1 2,6 Romania Clinical Emergency County Hospital

1,3

25 Abdi (see endnote 48 on page 28)

2016 4 6,4,3,5 Iran Intensive care unit 2,3

26 Chu (see endnote 49 on page 28)

2014 4 5,6 Taiwan E-healthcare architecture and syndrome test

2,3

27 Prijatelj (see endnote 50 on page 28)

2012 3 5,3 Slovenia Selected clinical departments 2,3

28 Kerckhoffs (see endnote 51 on page 28)

2013 2 1,5 Netherlands Intensive Care Unit of in hospital

2,3

29 Vahidnia (see endnote 52 on page 28)

2017 2 1,3,6,2,4 Turkey Small software company in a University

2,3

30 Leung (see endnote 53 on page 28)

2008 3 1,2,3,5 Canada Public sector research 2,3

31 Zeng (see endnote 54 on page 28)

2013 3 2 USA Enterprise resource planning (ERP) systems

2,3

32 MC Emre Simsekl (see endnote 55 on page 28)

2015 4 1,2,4 UK University Hospitals Foundation Trust

1,3

33 M. C. Emre Simsekler (see endnote 36 on page 28)

2018 2 3,1 UK Health-care Foundation Trust 3

34 Jun (see endnote 56 on page 28)

2010 4 2,6,3,1 UK Health service 3

35 Card (see endnote 20 on page 27)

2014 1 5,1 USA Healthcare organization 3

36 Potts (see endnote 57 on page 28)

2014 4 1,5,3,2,4 UK Community-based anticoagulation clinic

2,3

37 Kessels- Habraken (see endnote 58 on page 28)

2009 4 1,2,4,5 Netherlands General hospital 2,3

familiarize themselves with the given system and potential

risk sources.36 Although the study strategy did not focus on

risk types of healthcare organizations (see methods), the

reviewed studies placed significant emphasis on identifying

and discussing a variety of typical risks in similar organiza-

tions with healthcare organizations.

According to the results of Simsekler et al, risk identi-

fication Framework (RID Framework) used to identify

risks of the health organizations.36 The risk identification

framework includes a spectrum of inputs (System famil-

iarization), processes (Identification of risks), and outputs

(Presentation of the risks) in its structure.36

Results of the studies, a functional framework for

identifying and classifying risks in executive levels of

HCOs are presented in Table 4.

According to Table 4, risk sources are classified into

two categories (internal and external), and risk identifica-

tion tools classified into two categories (retrospective-pro-

spective and intra-organizational – inter-organizational).

Which Organization RM Framework and

Techniques are Used in Executive Levels

of Healthcare Organizations? A stringent risk management process may enable executive

levels of HCOs to cope with the risks presented in the

previous section. Once risks have been identified, a number

of techniques and actions can be selected to address them.

Various models have been used by organizations to

assess and manage risk, the results are which are shown

in Table 5. Based on the findings in Table 5, the risk

management framework that are applicable to the execu-

tive levels of HCOs are classified into basic models and

combined models. In addition, risk management models

are divided by cost, time, and complexity. The approaches

of risk management models are also divided into qualita-

tive or quantitative, systemic or individual, retrospective

or retrospective, and holistic or partial.

According to the studies’ results, a simple and compre-

hensive framework for RM in executive levels of HCOs was

suggested. The proposed framework of the present study

consists of five phases that its main phases are adapted

from the ISO13000 framework. The following is a suggested

framework and techniques that can be used to implement risk

management processes in executive levels of HCOs. Finally,

in Table 5 examines the extent to which risk management

based on the key phases of the proposed framework is

established in healthcare organizations.

(I) Establishing the context,

(II) Risk assessment (risk identification, risk analysis,

and risk evaluation),

(III) Risk treatment (strategy determination, designing

measures and decision-making, planning, and

implementation),

(IV) Communication and consultation, and

(V) Monitoring and reviews.

In the following, RM framework and techniques in execu-

tive levels of HCOs for each organization were mentioned.

Establishing the Context (Initiation and

Preparations) The first phase in the risk management process is estab-

lishing the context. The context establishment primarily

paves the way for the organizational nature of the com-

pany such as the project objective and management style

or organization culture. In this step, issues such as health-

care organization background, who should conduct the

RM process, Identify interested parties, formulate pro-

blems, set the objective(s) of RM and Select appropriate

methods for RM are reviewed.43,59

The organizational RM team should be multidisciplin-

ary and comprised of various specializations, in particular,

managers, process owner experts, and RM experts (con-

sultants and facilitators).25,33 Also, the number of team

members depends on the complexity of organizational

issues.33,40,43

Risk Assessment The second phase in the risk management process is risk

assessment, which involves measuring or estimating the

potential frequency of losses and the potential impact of a

risk on the organizations' health care. Subsequently, the

risks can be ranked according to its importance for the

HCOs. In general, the following three steps (risk identifi-

cation, risk analysis, and risk evaluation) proposed for risk

assessment in executive levels of HCOs:

Risk Identification Describing the Process and System Definition

According to the results, there were several methods for

outlining risky processes that executive levels of HCOs

can use depending on their needs: Textual system

description,8,41,53,59 activity breakdown structure (ABS),8

radar charts,34 flow charts,3,25,28,30,38,45,50,56,62 process

Dovepress Ferdosi et al

Risk Management and Healthcare Policy 2020:13 submit your manuscript | www.dovepress.com

DovePress 221

R

is k

M an

ag em

en t a

nd H

ea lth

ca re

P ol

ic y

do w

nl oa

de d

fr om

h ttp

s: //w

w w

.d ov

ep re

ss .c

om / b

y 16

5. 21

5. 20

9. 15

o n

18 -A

pr -2

02 0

F or

p er

so na

l u se

o nl

y.

Powered by TCPDF (www.tcpdf.org)

1 / 1

Establishing the context, Risk assessment (risk identification, risk analysis, and risk evaluation), Risk treatment (strategy determination, designing measures and decision-making, planning, and implementation),

Communication and consultation, and

Monitoring and reviews.

Table 4 Identification and Classification of Risks in Executive Levels of Healthcare Organization

Input Process Output

Customers and stakeholders demands (patients, providers, suppliers,

and buyers) 8

All organizational processes (clinical and

non-clinical processes, technology

processes, etc.) 8

Customer perceptions,

costs, functions and health

status 8

Source of risk 8

Intra-organizational Risk 8

1- Internal:

1–1 Organization or Operational: Organization structure, process,

organization culture 8,26,31,45,59

1–2 Physical structure and technological supports:

Used by resources to perform their activities and all the tools

necessary to support processes within a healthcare delivery system.

(information system, information security, Technology selection and

implementation related) 8,31,34,40,45,60

1–3 Communication/information: As the basis of the relationships

among resources and between them and technological supports.

(Information exchanges, communicating variations and

decisions). 8,31,34,40,55,59

1–4 Human or personnel resource34,45,55,59

1–5 Financial: Form of financing, evaluation, return. 31,45,59

1–6 Organization conditions or location 45,55

1–7 Customer43

1–8 Administrative or task 25,55

1–9 Knowledge and skill 40

1–10 Material and equipment: displays/integrity/positioning/

usability 34,55

1–11 Collaboration and team 39

2- External:

2–1 Supplying 3,60,61

2–2 Financing 8,43

2–3 Environment and ecological8

2–4 Regulation and Legal 34,45

2–5 Logistics: Manufacturing, disruption and transportation, inventory,

storage 34,60,61

2–6 Commercial 34

2–7 Revenue: demand, toll/tariff, development 60,61

2–8 Capacity60

2–9 Social 60

2–10 Volunteers 39

2–11 Political and government43

A: Expert opinion(focus groups-

brainstorming- Delphi

technique) 26,32,37,40,43,44,46

B: Results of examination of documents,

reports and other records of visits 29,30,52

C: Observation 25

Hazard: what can go

wrong?

Cause: why/how it could

go wrong?

Effect: who/what is at risk?

Extra-organizational

A: Literature 32,40,61

B: Stakeholder analysis 43

C: Results of reports of higher

organizations 30

D: External audit 30,43

Retrospective

A: Expert opinion 26,32,44

B: Interviews 30,46,53

C: Risk Breakdown Structure(RBS) 8,46

D: Survey results 29,32,40,53

E: Critical incident

F: Reporting system 29

G: Historical and Previous data 43,52

H: Quality function deployment(QFD) 43

I: Triangle method 25

J: Cause and effect analysis (CEA) 60

K: Event or fault tree analysis 26,54,60

L: Checklists or check sheet 60

M: SWOT analysis 46

N: PESTEL analysis 46

O: Direct observation 25

Nature of hazards 8,36

Prospective

A: Obvious hazard: Is apparent to the senses

B: Concealed hazard: Is not apparent to the senses

C: Developing hazard: Cannot be recognized immediately, and

develops over time

4: Transient hazard: An intermittent or temporary hazard

A: Level of probability 43

B: Failure mode and effect analysis

(FMEA) 60

C: Imagery 60

D: Modeling 60

E: Grey systems theory 47

F: Hierarchical holographic

modeling (HHM) 26

Time 8,36

A: Past: what has gone wrong the past?

B: Present: what could go wrong currently?

C: Future: what can go wrong due to change?

Ferdosi et al Dovepress

submit your manuscript | www.dovepress.com

DovePress Risk Management and Healthcare Policy 2020:13222

R

is k

M an

ag em

en t a

nd H

ea lth

ca re

P ol

ic y

do w

nl oa

de d

fr om

h ttp

s: //w

w w

.d ov

ep re

ss .c

om / b

y 16

5. 21

5. 20

9. 15

o n

18 -A

pr -2

02 0

F or

p er

so na

l u se

o nl

y.

Powered by TCPDF (www.tcpdf.org)

1 / 1

Input Process Output

Customers and stakeholders demands (patients, providers, suppliers, and buyers) (see endnote 8 on page 27)

All organizational processes (clinical and non-clinical processes, technology processes, etc.) (see endnote 8 on page 27)

Customer perceptions, costs, functions and health status (see endnote 8 on page 27)Source of risk (see endnote 8 on page 27) Intra-organizational Risk (see endnote 8 on page 27)1- Internal: A: Expert opinion(focus groups- brainstorming-

Delphi technique) (see endnote 26 on page 27 and endnotes 32, 37, 40, 43, 44, & 46 on page 28)

Hazard: what can go wrong? Cause: why/how it could go wrong? Effect: who/what is at risk?

1�1 Organization or Operational: Organization structure, process, organization culture (see endnotes 8 & 26 on page 27 and endnotes 31, 45, & 59 on page 28)1�2 Physical structure and technological supports: B: Results of examination of documents,

reports and other records of visits (see endnotes 29, 30, & 52 on page 28)

Used by resources to perform their activities and all the tools necessary to support processes within a healthcare delivery system. (information system, information security, Technology selection and implementation related) (see endnote 8 on page 27 and endnotes 31, 34, 40, 45, & 60 on page 28)

C: Observation (see endnote 25 on page 27)Extra-organizational

1�3 Communication/information: As the basis of the relationships among resources and between them and technological supports. (Information exchanges, communicating variations and decisions). (see endnote 8 on page 27 and endnotes 31, 34, 40, 55, & 59 on page 28)

A: Literature (see endnotes 32, 40, & 61 on page 28)B: Stakeholder analysis (see endnote 43 on page 28)C: Results of reports of higher organizations (see endnote 30 on page 28)1�4 Human or personnel resource (see endnotes 34, 45, 55,

& 59 on page 28) D: External audit (see endnotes 30 & 43 on page 28)1�5 Financial: Form of financing, evaluation, return. (see endnotes

31, 45, & 59 on page 28) Retrospective

1�6 Organization conditions or location (see endnotes 45 & 55 on page 28)1�7 Customer (see endnote 43 on page 28) A: Expert opinion (see endnote 26 on

page 27 and endnotes 32 & 44 on page 28)

1�8 Administrative or task (see endnote 25 on page 27 and endnote 55 on page 28)

B: Interviews (see endnotes 30, 46, & 53 on page 28)1�9 Knowledge and skill (see endnote 40 on page 28) C: Risk Breakdown Structure(RBS) (see endnote 8 on page 27 and endnote 46 on page 28)

1�10 Material and equipment: displays/integrity/positioning/ usability (see endnotes 34 & 55 on page 28)

D: Survey results (see endnotes 29, 32, 40, & 53 on page 28)E: Critical incident

1�11 Collaboration and team (see endnote 39 on page 28)F: Reporting system (see endnote 29 on page 28)2- External: 2�1 G: Historical and Previous data (see endnotes 43 & 52 on page 28)2�1 Supplying (see endnote 3 on page 27 and endnotes 60

& 61 on page 28) H: Quality function deployment(QFD) (see endnotes 43 on page 28)2�2 Financing (see endnote 8 on page 27 and endnote 43

on page 28) I: Triangle method (see endnotes 25 on page 27)2�3 Environment and ecological (see endnote 8 on page 27)J: Cause and effect analysis (CEA) (see endnotes 60 on page 28)2�4 Regulation and Legal (see endnotes 34 & 45 on page

28) K: Event or fault tree analysis (see endnote 26 on page 27 and endnotes 54 & 60 on page 28)

2�5 Logistics: Manufacturing, disruption and transportation, inventory, storage (see endnotes 34, 60, & 61 on page 28)

L: Checklists or check sheet (see endnote 60 on page 28)M: SWOT analysis (see endnote 46 on page 28)2�6 Commercial (see endnote 34 on page 28) N: PESTEL analysis (see endnote 46 on page 28)2�7 Revenue: demand, toll/tariff, development (see endnotes

60 & 61 on page 28) O: Direct observation (see endnote 25 on page 27)2�8 Capacity (see endnote 60 on page 28)

2�9 Social (see endnote 60 on page 28) 2�10 Volunteers (see endnote 39 on page 28) 2�11 Political and government (see endnote 43 on page 28) Nature of hazards (see endnote 8 on page 27 and endnote 36 on page 28)

Prospective

A: Obvious hazard: Is apparent to the senses A: Level of probability (see endnote 43 on page 28)B: Concealed hazard: Is not apparent to the senses B: Failure mode and effect analysis (FMEA) (see endnote 60 on page 28)C: Developing hazard: Cannot be recognized immediately,

and develops over time C: Imagery (see endnote 60 on page 28) 4: Transient hazard: An intermittent or temporary hazard D: Modeling (see endnote 60 on page

28)Time (see endnote 8 on page 27 and endnote 36 on page 28)E: Grey systems theory (see endnote 47 on page 28)F: Hierarchical holographic modeling (HHM) (see endnote 26 on page 28)A: Past: what has gone wrong the past?

B: Present: what could go wrong currently? C: Future: what can go wrong due to change?

Table 5 Characteristics of Organization RM and Risk Analysis Techniques

Model Name Steps Characteristics Output and Information Attitude to

the Risk

Applicable

Type of

Environment

Cost Time Complexity

Establish

the

Context

Risk

Identification

Risk

Analysis

Risk

Evaluation

Risk

Treatment

Monitoring

1- Risk Analysis Phases

1-1- Base models

Strategic risk

analysis

approach (SRA)

1 - Define objectives, 2 -

Brainstorm risk, and

characteristics according to the

SWOT axis; 3 - Calculate

possibilities and consequence of

the risks; 4 - Combine risks with

characteristics. 31

Weakness: It does

not express the

relationship

between risks and

its nature.

Strength: It

interrelates the

organization

strategic risks and

organizational

characteristics.

N S Y Y N N *Qualitative

*Systemic

*Prospective

*Holistic

Particularly

risks

associated

with the

mission and

objectives of

the

organization

Low-

medium

Low-

medium

Low-medium

Preliminary Risk

Analysis method

(PRA)

1. PRA team; 2. Elaborating

hazardous situations mapping

and priority; 3. Elaboration of

potential risks scenario. 34

Strength: An

effective tool for

identifying high-

risk dangers

Weakness: Error

details are not

mentioned

Y S Y Y Y Y *Holistic

*Systemic

*Prospective

*Qualitative

All, especially

the early

stages of a

project

Low-

medium

Low-

medium

Low-medium

Healthcare

Failure Mode

and Effect

Analysis

1. Selection of a high-risk

process; 2. Assembling the team;

3. Graphically describing the

processes; 4. Conducting hazard

analysis; 5. Actions and outcome

measures. 25

Weakness: 1.

Use qualitative

and subjective

approaches to

calculate error.

2. Interaction

between errors

is ignored.

3. Effectiveness

of measures is

not estimated.

Y Y Y Y S N *Systemic

*Narrow

*Prospective

*Qualitative

All, especially

for

well-defined

systems

Medium Medium Medium

(Continued)

D ovepress

F e rd o si e t a l

R isk

M a n a g e m e n t a n d H e a lth

c a re

P o lic y 2 0 2 0 :1 3

su b m it

yo u r m a n u scrip

t | w w w .d o v e p re ss.c

o m

D ovePress

2 2 3

Risk Management and Healthcare Policy downloaded from https://www.dovepress.com/ by 165.215.209.15 on 18-Apr-2020

For personal use only.

P ow

ered by TC P

D F (w

w w

.tcpdf.org)

1 / 1

Model Name Steps Characteristics Output and Information Attitude to the Risk

Applicable Type of Environment

Cost Time Complexity

Establish the Context

Risk Identification Risk Analysis Risk Evaluation Risk Treatment Monitoring

1- Risk Analysis Phases

1-1- Base models Strategic risk analysis approach (SRA)

1- Define objectives, 2 - Brainstorm risk, and characteristics according to the SWOT axis; 3 - Calculate possibilities and consequence of the risks; 4 - Combine risks with characteristics. (see endnote 31 on page 28)

Weakness: It does not express the relationship between risks and its nature. Strength: It interrelates the organization strategic risks and organizational characteristics.

N S Y Y N N *Qualitative *Systemic *Prospective *Holistic

Particularly risks associated with the mission and objectives of the organization

Low- medium Low- medium Low-medium

Preliminary Risk Analysis method (PRA)

1. PRA team; 2. Elaborating hazardous situations mapping and priority; 3. Elaboration of potential risks scenario. (see endnote 34 on page 28)

Strength: An effective tool for identifying high- risk dangers Weakness: Error details are not mentioned

Y S Y Y Y Y *Holistic *Systemic *Prospective *Qualitative

All, especially the early stages of a project

Low- medium Low- medium Low-medium

Healthcare Failure Mode and Effect Analysis

1. Selection of a high-risk process; 2. Assembling the team; 3. Graphically describing the processes; 4. Conducting hazard analysis; 5. Actions and outcome measures. (see endnote 25 on page 27)

Weakness: 1. Use qualitative and subjective approaches to calculate error. 2. Interaction between errors is ignored. 3. Effectiveness of measures is not estimated.

Y Y Y Y S N *Systemic *Narrow *Prospective *Qualitative

All, especially for well-defined systems

Medium Medium Medium

Table 5 (Continued).

Model Name Steps Characteristics Output and Information Attitude to

the Risk

Applicable

Type of

Environment

Cost Time Complexity

Establish

the

Context

Risk

Identification

Risk

Analysis

Risk

Evaluation

Risk

Treatment

Monitoring

Criticality

analysis

(FMECA)

1. Team formation, 2. Process

mapping, 3. Risk identification, 4.

Determination of error roots, 5.

Criticality, 6. Analysis, 7.

Determine corrective actions. 37

Weakness: 1.

Use qualitative

and subjective

approaches to

calculate error.

2. Interaction

between errors

is ignored.

3. Effectiveness

of measures is

not estimated.

Y Y Y Y S N *Systemic

*Narrow

*Prospective

*Qualitative

All, especially

for

well-defined

systems

Medium Medium Medium

Change Risk

Assessment

Model (CRAMS)

1. Risk Identification; 2. Risk

Assessment; 3. Risk Monitoring

& Control CRAM’s Node

Hierarchy. 46

Weakness:

Depend on the

expert judgment.

Strength: A

method for

analyzing system

changes

Y S Y Y Y Y *Prospective

*Qualitative

*Systemic

*Narrow

All, especially

for the

analysis of

recent

changes in

systems

Low-

medium

Low-

medium

Low-medium

Using a GRPN-

Based FMEA

Model

1. Select a procedure/sub

procedure for study; 2.

Assemble a team; 3. Make a

diagram of the procedure/

subprocedure; 4. Identify the

failure modes; 5. Use historical

data of risk factors 6-Give α and

risk weights; 6. Suggest

threshold; 7. Create an FMEA

worksheet; 8. Sort the failure

modes; 9. Take corrective

action. 49

Strength: Using

quantitative

parameters to

estimate and

prioritize errors

Weakness: The

effectiveness of

measurable is not

estimated.

2-Variables

values are

homogeneous

for calculating

SOD.

Y S Y Y Y N *Systemic

*Narrow

*Prospective

*Qualitative-

quantitative

All, especially

for

well-defined

systems and

critical

parameters

Medium Medium Medium

F e rd o si e t a l

D ovepress

su b m it yo

u r m a n u scrip

t | w w w .d o v e p re ss.c

o m

D ovePress

R isk

M a n a g e m e n t a n d H e a lth

c a re

P o lic y 2 0 2 0 :1 3

2 2 4

Risk Management and Healthcare Policy downloaded from https://www.dovepress.com/ by 165.215.209.15 on 18-Apr-2020

For personal use only.

P ow

ered by TC P

D F (w

w w

.tcpdf.org)

1 / 1

Model Name Steps Characteristics Output and Information Attitude to the Risk

Applicable Type of Environment

Cost Time Complexity

Establish the Context

Risk Identification Risk Analysis Risk Evaluation Risk Treatment Monitoring

Criticality analysis (FMECA)

1. Team formation, 2. Process mapping, 3. Risk identification, 4. Determination of error roots, 5. Criticality, 6. Analysis, 7. Determine corrective actions. (see endnote 37 on page 28)

Weakness: 1. Use qualitative and subjective approaches to calculate error. 2. Interaction between errors is ignored. 3. Effectiveness of measures is not estimated.

Y Y Y Y S N *Systemic *Narrow *Prospective *Qualitative

All, especially for well-defined systems

Medium Medium Medium

Change Risk Assessment Model (CRAMS)

1. Risk Identification; 2. Risk Assessment; 3. Risk Monitoring & Control CRAM�s Node Hierarchy. (see endnote 46 on page 28)

Weakness: Depend on the expert judgment. Strength: A method for analyzing system changes

Y S Y Y Y Y *Prospective *Qualitative *Systemic *Narrow

All, especially for the analysis of recent changes in systems

Low- medium Low- medium Low-medium

Using a GRPN- Based FMEA Model

1. Select a procedure/sub procedure for study; 2. Assemble a team; 3. Make a diagram of the procedure/ subprocedure; 4. Identify the failure modes; 5. Use historical data of risk factors 6-Give ﾱ and risk weights; 6. Suggest threshold; 7. Create an FMEA worksheet; 8. Sort the failure modes; 9. Take corrective action. (see endnote 49 on page 28)

Strength: Using quantitative parameters to estimate and prioritize errors Weakness: The effectiveness of measurable is not estimated. 2-Variables values are homogeneous for calculating SOD.

Y S Y Y Y N *Systemic *Narrow *Prospective *Qualitative- quantitative

All, especially for well-defined systems and critical parameters

Medium Medium Medium

Bow-Tie Model 1. Selection of

hazards; 2. Description of the

team formation; 3. Identify

hazard; 4-Identify critical

event; 5. Identify treat; 6. Identify

consequence ;7-Identify

barrier; 8. Identify escalation

factor; 9. Determining

recommendation and

implemented. 33,48,51

Weaknesses:

1. Uses

qualitative and

subjective

approaches in

calculating

errors.

2. Team

members should

have high

knowledge of

their system

details.

3. The

effectiveness of

measures cannot

be estimated.

S S Y Y Y N *Prospective

*Qualitative

*Systemic

*Narrow

All, especially

for

project in a

larger safety

improvement

plan

medium medium medium

1-2 Combined Models

Analytic

hierarchy

process and

simple additive

weighting

(SAW) methods

1. Risk identification; 2. Risk

analysis included 2-1. Scoring

hazards; 2-2. Scoring probability;

2. 3Prioritize function; 2-4. Pilot

study; 2–5. Risk analysis

matrix; 3. Risk evaluation

included 3-1. Risk calculation;

3-2. Risk ranking. 32

Strength: 1. Use

of quantitative

approaches to

risk estimation

Y S Y Y N N *Qualitative-

quantitative

*Systemic

*Prospective

*Holistic

All Medium Medium Medium

(Continued)

D ovepress

F e rd o si e t a l

R isk

M a n a g e m e n t a n d H e a lth

c a re

P o lic y 2 0 2 0 :1 3

su b m it

yo u r m a n u scrip

t | w w w .d o v e p re ss.c

o m

D ovePress

2 2 5

Risk Management and Healthcare Policy downloaded from https://www.dovepress.com/ by 165.215.209.15 on 18-Apr-2020

For personal use only.

P ow

ered by TC P

D F (w

w w

.tcpdf.org)

1 / 1

Bow-Tie Model 1. Selection of hazards; 2. Description of the team formation; 3. Identify hazard; 4-Identify critical event; 5. Identify treat; 6. Identify consequence ;7-Identify barrier; 8. Identify escalation factor; 9. Determining recommendation and implemented. (see endnotes 33, 48 & 51 on page 28)

Weaknesses: 1. Uses qualitative and subjective approaches in calculating errors. 2. Team members should have high knowledge of their system details. 3. The effectiveness of measures cannot be estimated.

S S Y Y Y N *Prospective *Qualitative *Systemic *Narrow

All, especially for project in a larger safety improvement plan

medium medium medium

1-2 Combined

Analytic hierarchy process and simple additive weighting (SAW) methods

1. Risk identification; 2. Risk analysis included 2-1. Scoring hazards; 2-2. Scoring probability; 2. 3Prioritize function; 2-4. Pilot study; 2�5. Risk analysis matrix; 3. Risk evaluation included 3-1. Risk calculation; 3-2. Risk ranking. (see endnote 32 on page 28)

Strength: 1. Use of quantitative approaches to risk estimation

Y S Y Y N N *Qualitative- quantitative *Systemic *Prospective *Holistic

All Medium Medium Medium

Table 5 (Continued).

Model Name Steps Characteristics Output and Information Attitude to

the Risk

Applicable

Type of

Environment

Cost Time Complexity

Establish

the

Context

Risk

Identification

Risk

Analysis

Risk

Evaluation

Risk

Treatment

Monitoring

Evidence-based

methodology

Be used by three methods:

A - (HFMEA): 1. Topic definition;

2. Assemble the team; 3.

Graphical process; 4. Failure

mode identification; 5. Failure

moderating; 6. Identification of

critical factor; 7. Cause analysis;

8. Identify actions and outcome

measures

B - Systematic Human Error

Reduction and Prediction

Analysis (SHERPA):1-HTA

diagram; 2- Human error

identification;3Consequence

analysis and check of severity

scores; 4-Recovery analysis; 5-

Remedy analysis

C- Systems-Theoretic Accident

Model and Processes (STAMP)

1-Control structure; 2-Controls

and communication problem

examination. 28

Strength:

Combined model

Weakness: uses

qualitative and

subjective

approaches to

calculate error

Y Y Y Y Y Y *Prospective

*Systemic-

humanistic

*Qualitative-

quantitative

*Narrow

All, specially

system

accidents

Medium-

high

High High

Human

Reliability

Assessment

(HRA) and

FMEA

1. Context analysis; 2. Process

mapping; 3. Risk identification

and assessment; 4. Failure modes

and waste analysis; 5. Suggested

improvement actions and degree

of success of already taken

measures. 8

Strength:

Combined model

Weakness: The

validity of results

depends on the

collected data.

Y Y Y N S N *Systemic-

humanistic

*Prospective

*Narrow

*Qualitative-

quantitative

All Medium-

high

Medium-

high

Medium-high

F e rd o si e t a l

D ovepress

su b m it yo

u r m a n u scrip

t | w w w .d o v e p re ss.c

o m

D ovePress

R isk

M a n a g e m e n t a n d H e a lth

c a re

P o lic y 2 0 2 0 :1 3

2 2 6

Risk Management and Healthcare Policy downloaded from https://www.dovepress.com/ by 165.215.209.15 on 18-Apr-2020

For personal use only.

P ow

ered by TC P

D F (w

w w

.tcpdf.org)

1 / 1

Model Name Steps Characteristics Output and Information Attitude to the Risk

Applicable Type of Environment

Cost Time Complexity

Establish the Context

Risk Identification Risk Analysis Risk Evaluation Risk Treatment Monitoring

Evidence-based methodology

Be used by three methods: A - (HFMEA): 1. Topic definition; 2. Assemble the team; 3. Graphical process; 4. Failure mode identification; 5. Failure moderating; 6. Identification of critical factor; 7. Cause analysis; 8. Identify actions and outcome measures B - Systematic Human Error Reduction and Prediction Analysis (SHERPA):1-HTA diagram; 2- Human error identification;3Consequence analysis and check of severity scores; 4-Recovery analysis; 5- Remedy analysis C- Systems-Theoretic Accident Model and Processes (STAMP) 1-Control structure; 2-Controls and communication problem examination. (see endnote 28 on page 28)

Strength: Combined model Weakness: uses qualitative and subjective approaches to calculate error

Y Y Y Y Y Y *Prospective *Systemic- humanistic *Qualitative- quantitative *Narrow

All, specially system accidents

Medium- high

High High

Human Reliability Assessment (HRA) and FMEA

1. Context analysis; 2. Process mapping; 3. Risk identification and assessment; 4. Failure modes and waste analysis; 5. Suggested improvement actions and degree of success of already taken measures. (see endnote 8 on page 27)

Strength: Combined model Weakness: The validity of results depends on the collected data.

Y Y Y N S N *Systemic- humanistic *Prospective *Narrow *Qualitative- quantitative

All Medium- high

Medium- high

Medium-high

(FMEA/FMECA) 1. Selection of the process to be

studied; 2. Establishment of the

team; 3. Training; 4. Process

modeling flowchart; 5.

Identification of potential failure

mode; 6. Identification of

possible consequences; 7.

Identification of possible causes;

8. Estimation S, O, D; 9.

Calculation of risk priority; 10.

Decision; 11. Approval. 30

Strength:

Combined model

Weakness: 1-

Evaluation of

external effects is

limited.2.

Interaction

between errors

is ignored

S Y Y Y Y N *Systemic

*Narrow

*Prospective

*Qualitative-

quantitative

All, especially

for

well-defined

systems and

critical

parameters

Medium-

high

Medium-

high

Medium-high

CREA (Clinical

Risk and Error

Analysis

method)

1. Activities Identification; 2.

Activities; 3. Identification of

error modes based HUMAN

HAZOP; 4. Risk Evaluation

based risk diagram; 5.

Organizational Causes Analysis

based VINCENT’S

FRAMEWORK. 35

Strength: The

decision support

tool is for

process

reengineering

Weakness: 1. Is

based on

personal

judgment.

2. requires

strong

documentation

N Y Y Y N N *Holistic

(Emphasis on

work

procedures)

*Systemic-

humanistic

*Prospective

*quantitative

All, especially

Identify

possible

deviations and

sequential

operations or

procedures

High High High

(Continued)

D ovepress

F e rd o si e t a l

R isk

M a n a g e m e n t a n d H e a lth

c a re

P o lic y 2 0 2 0 :1 3

su b m it

yo u r m a n u scrip

t | w w w .d o v e p re ss.c

o m

D ovePress

2 2 7

Risk Management and Healthcare Policy downloaded from https://www.dovepress.com/ by 165.215.209.15 on 18-Apr-2020

For personal use only.

P ow

ered by TC P

D F (w

w w

.tcpdf.org)

1 / 1

(FMEA/FMECA) 1. Selection of the process to be studied; 2. Establishment of the team; 3. Training; 4. Process modeling flowchart; 5. Identification of potential failure mode; 6. Identification of possible consequences; 7. Identification of possible causes; 8. Estimation S, O, D; 9. Calculation of risk priority; 10. Decision; 11. Approval. (see endnote 30 on page 28)

Strength: Combined model Weakness: 1- Evaluation of external effects is limited.2. Interaction between errors is ignored

S Y Y Y Y N *Systemic *Narrow *Prospective *Qualitative- quantitative

All, especially for well-defined systems and critical parameters

Medium- high

Medium- high

Medium-high

CREA (Clinical Risk and Error Analysis method)

1. Activities Identification; 2. Activities; 3. Identification of error modes based HUMAN HAZOP; 4. Risk Evaluation based risk diagram; 5. Organizational Causes Analysis based VINCENT�S FRAMEWORK. (see endnote 35 on page 28)

Strength: The decision support tool is for process reengineering Weakness: 1. Is based on personal judgment. 2. requires strong documentation

N Y Y Y N N *Holistic (Emphasis on work procedures) *Systemic- humanistic *Prospective *quantitative

All, especially Identify possible deviations and sequential operations or procedures

High High High

Table 5 (Continued).

Model Name Steps Characteristics Output and Information Attitude to

the Risk

Applicable

Type of

Environment

Cost Time Complexity

Establish

the

Context

Risk

Identification

Risk

Analysis

Risk

Evaluation

Risk

Treatment

Monitoring

Multiple models Be used by three methods:

A - FMEA: 1. Identify failure

modes; 2. Identify severity,

likelihood, and detection;3.

Define failure causes

B - Hierarchical holographic

modeling (HHM): 1. Define the

key risk issue; 2. Decompose the

risk issue into different,

appropriate perspectives; 3.

Further decompose the head

topics into a hierarchy of

subtopics; 4. Crosscheck; 5.

Walkthrough each topic and sub-

topic to identify risk scenarios

for further analysis.

C- Technique for human error

rate prediction (THERP): 1.

Definition; 2. Screening; 3.

Qualitative analysis; 4.

Representation; 5. Impact

assessment; 6. Quantification; 7.

Documentation. 26

Strength:

Combined model

Weakness: It

analyzes all

failures equally,

regardless of

their importance,

and has

difficulty dealing

with data

redundancies,2-

expensive,3-

time-consuming

for complex

systems,4-failure

modes are

considered one-

at-a-time,

meaning it is

unable to detect

common cause

failures and

design failures.

Y S Y Y S Y *Narrow

*Systemic-

humanistic

*Prospective

*Qualitative-

quantitative

All High High High

F e rd o si e t a l

D ovepress

su b m it yo

u r m a n u scrip

t | w w w .d o v e p re ss.c

o m

D ovePress

R isk

M a n a g e m e n t a n d H e a lth

c a re

P o lic y 2 0 2 0 :1 3

2 2 8

Risk Management and Healthcare Policy downloaded from https://www.dovepress.com/ by 165.215.209.15 on 18-Apr-2020

For personal use only.

P ow

ered by TC P

D F (w

w w

.tcpdf.org)

1 / 1

Model Name Steps Characteristics Output and Information Attitude to the Risk

Applicable Type of Environment

Cost Time Complexity

Establish the Context

Risk Identification Risk Analysis Risk Evaluation Risk Treatment Monitoring

Multiple models Be used by three methods: A - FMEA: 1. Identify failure modes; 2. Identify severity, likelihood, and detection;3. Define failure causes B - Hierarchical holographic modeling (HHM): 1. Define the key risk issue; 2. Decompose the risk issue into different, appropriate perspectives; 3. Further decompose the head topics into a hierarchy of subtopics; 4. Crosscheck; 5. Walkthrough each topic and sub- topic to identify risk scenarios for further analysis. C- Technique for human error rate prediction (THERP): 1. Definition; 2. Screening; 3. Qualitative analysis; 4. Representation; 5. Impact assessment; 6. Quantification; 7. Documentation. (see endnote 26 on page 27)

Strength: Combined model Weakness: It analyzes all failures equally, regardless of their importance, and has difficulty dealing with data redundancies,2- expensive,3- time-consuming for complex systems,4-failure modes are considered one- at-a-time, meaning it is unable to detect common cause failures and design failures.

Y S Y Y S Y *Narrow *Systemic- humanistic *Prospective *Qualitative- quantitative

All High High High

integrating

FMEA and RCA

1. Initial framework

development; 2. Forming FDG

group; 3. Selecting a process; 4.

Mapping of selected process; 5.

Implementation of the FMEA

6. RCA model included 6-1.

Determine AE resulted from

failures after 3 months of RPN

calculation; 6-2. Benchmark

ability of improved RPN to

prioritize failure mode. 38

Strength:

Combined model

Weakness: 1. Is

based on

personal

judgment.

Y S Y Y S Y *Narrow

*Systemic

*Qualitative-

quantitative

*Retrospective-

Prospective

All, especially

for

well-defined

systems and

critical

parameters

Medium-

high

Medium-

high

Medium-high

Modified ANP

and Fuzzy

Inference

System risk

assessment

1. Construction of risk

assessment group; 2. Determine

risk factors; 3. Measurement of

Factor index; 4. Measurement of

Ringer-saline (RS) or Ringer-

lactate (RL); 5. Fuzzy inference

phase; 6. Defused phase; 7.

Output phase. 40

Strength: 1-

Combined model

2. Integration of

possible risk

factors for more

accurate decision

making

Y S Y Y S N *Retrospective-

Prospective

*Systemic

*Qualitative-

quantitative

*Narrow

All Medium-

high

Medium-

high

Medium-high

a fuzzy method

based tool the

risk assessment

analysis

1. Risk Factors, Scales and Data;

2. Identify Risk score; 3. Risk

evaluation included 3-1. Risk

matrix; 3-2. A decision matrix;

3-3. Obtained values as a vector

of fuzzy numbers. 52

Strength: is

suitable for small

business

organizations

with limited

resources.

2- Combined

model

S Y Y Y S N *Qualitative-

quantitative

*Prospective

*Systemic

*Narrow

All, specially

at project bid,

initiation

phases and

acceptance

decisions

Medium Medium Medium

(Continued)

D ovepress

F e rd o si e t a l

R isk

M a n a g e m e n t a n d H e a lth

c a re

P o lic y 2 0 2 0 :1 3

su b m it

yo u r m a n u scrip

t | w w w .d o v e p re ss.c

o m

D ovePress

2 2 9

Risk Management and Healthcare Policy downloaded from https://www.dovepress.com/ by 165.215.209.15 on 18-Apr-2020

For personal use only.

P ow

ered by TC P

D F (w

w w

.tcpdf.org)

1 / 1

integrating FMEA and RCA

1. Initial framework development; 2. Forming FDG group; 3. Selecting a process; 4. Mapping of selected process; 5. Implementation of the FMEA 6. RCA model included 6-1. Determine AE resulted from failures after 3 months of RPN calculation; 6-2. Benchmark ability of improved RPN to prioritize failure mode. (see endnote 38 on page 28)

Strength: Combined model Weakness: 1. Is based on personal judgment.

Y S Y Y S Y *Narrow *Systemic *Qualitative- quantitative *Retrospective- Prospective

All, especially for well-defined systems and critical parameters

Medium- high

Medium- high

Medium-high

Modified ANP and Fuzzy Inference System risk assessment

1. Construction of risk assessment group; 2. Determine risk factors; 3. Measurement of Factor index; 4. Measurement of Ringer-saline (RS) or Ringer- lactate (RL); 5. Fuzzy inference phase; 6. Defused phase; 7. Output phase. (see endnote 40 on page 28)

Strength: 1- Combined model 2. Integration of possible risk factors for more accurate decision making

Y S Y Y S N *Retrospective- Prospective *Systemic *Qualitative- quantitative *Narrow

All Medium- high

Medium- high

Medium-high

a fuzzy method based tool the risk assessment analysis

1. Risk Factors, Scales and Data; 2. Identify Risk score; 3. Risk evaluation included 3-1. Risk matrix; 3-2. A decision matrix; 3-3. Obtained values as a vector of fuzzy numbers. (see endnote 52 on page 28)

Strength: is suitable for small business organizations with limited resources. 2- Combined model

S Y Y Y S N *Qualitative- quantitative *Prospective *Systemic *Narrow

All, specially at project bid, initiation phases and acceptance decisions

Medium Medium Medium

Table 5 (Continued).

Model Name Steps Characteristics Output and Information Attitude to

the Risk

Applicable

Type of

Environment

Cost Time Complexity

Establish

the

Context

Risk

Identification

Risk

Analysis

Risk

Evaluation

Risk

Treatment

Monitoring

HFMEA and

Structured

What If

Technique

(SWIFT)

Be used by two methods:

SWIFT method:

1. determine a hierarchical task

analysis diagram; 2. a series of

questions was asked at each step

of the task analysis designed; 3.

Identify severity

HFMEA:

1. Assembling the team; 2.

Graphically describing the

processes; 3. Conducting hazard

analysis; 4. Actions and outcome

measures. 57

Strength: 1-

Combined model

Y Y Y Y Y N *Narrow

*Systemic

*Qualitative-

quantitative

* Prospective

All, especially

for

well-defined

systems

Medium Medium Medium

Prospective risk

analyses and

retrospective

incident

reporting and

analysis

Prospective risk analyses:

1. Assembling the team; 2.

constructed flowcharts of the

selected processes; 3. identified

and assessed possible risks for

each process step

retrospective incident reporting:

1. define occurrence of reported

incidents; 2. report any deviation

from normal; 3. analyzed the

reported incidents 58

Strength:

1. Combined

model

2. Integration of

possible risk

factors for more

accurate decision

making

Y Y Y Y S N *Narrow

*Systemic

*Qualitative-

quantitative

*Retrospective-

Prospective

All Medium Medium Medium

F e rd o si e t a l

D ovepress

su b m it yo

u r m a n u scrip

t | w w w .d o v e p re ss.c

o m

D ovePress

R isk

M a n a g e m e n t a n d H e a lth

c a re

P o lic y 2 0 2 0 :1 3

2 3 0

Risk Management and Healthcare Policy downloaded from https://www.dovepress.com/ by 165.215.209.15 on 18-Apr-2020

For personal use only.

P ow

ered by TC P

D F (w

w w

.tcpdf.org)

1 / 1

Model Name Steps Characteristics Output and Information Attitude to the Risk

Applicable Type of Environment

Cost Time Complexity

Establish the Context

Risk Identification Risk Analysis Risk Evaluation Risk Treatment Monitoring

HFMEA and Structured What If Technique (SWIFT)

Be used by two methods: SWIFT method: 1. determine a hierarchical task analysis diagram; 2. a series of questions was asked at each step of the task analysis designed; 3. Identify severity HFMEA: 1. Assembling the team; 2. Graphically describing the processes; 3. Conducting hazard analysis; 4. Actions and outcome measures. (see endnote 57 on page 28)

Strength: 1- Combined model

Y Y Y Y Y N *Narrow *Systemic *Qualitative- quantitative * Prospective

All, especially for well-defined systems

Medium Medium Medium

Prospective risk analyses and retrospective incident reporting and analysis

Prospective risk analyses: 1. Assembling the team; 2. constructed flowcharts of the selected processes; 3. identified and assessed possible risks for each process step retrospective incident reporting: 1. define occurrence of reported incidents; 2. report any deviation from normal; 3. analyzed the reported incidents (see endnote 58 on page 28)

Strength: 1. Combined model 2. Integration of possible risk factors for more accurate decision making

Y Y Y Y S N *Narrow *Systemic *Qualitative- quantitative *Retrospective- Prospective

All Medium Medium Medium

2- Risk Management Phases

2-1- Base models

Systemic Risk

Management’

(SYRMA)

1. defining and managing event

and recording threats and

vulnerabilities; 2. tracking

identified risks in a risk register;

3. performing risk assessment

and risk evaluation; 4. providing

the capability of registering

statistical or benchmark data; 5.

setting risk priorities; 6. defining

and tracking risk treatment

activities. 27

Strength:1-

address both

managerial and

operative staff

support

requirements.2-

Allows users to

personalize their

view of the

system

S Y Y Y Y Y *Qualitative-

quantitative

*Prospective

*Systemic

*Holistic

All, especially

for healthcare

sector and

case of

complex and

mission

critical

systems

Medium-

high

Medium-

high

Medium-high

Clinical risk

management

(CRM)

1. Identify risks; 2. Analysis risks;

3. Assess risks; 4. Manage

risks. 29

Weakness: is

based on

subjective and

intrinsic

judgment

S S Y N S Y *Qualitative

*Prospective

*Systemic

*Holistic

All, specially

for healthcare

Medium-

high

Medium-

high

Medium-high

Strategic Risk

Management

(SRM)

1. Defining the context; 2. Risk

assessment; 3. Making and

Communicating the decision and

Action; 4. Monitoring and course

correcting. 39

Weakness: is

based on

subjective and

intrinsic

judgment

Y S Y Y S Y *Qualitative

*Prospective

*Systemic

*Holistic

All, specially

for project

management

Medium-

high

Medium-

high

Medium-high

System risk

evaluation and

management

1. Define the objectives and

performance measures; 2.

Workshop together; 3. Evaluate

and priorities consequences for

each alternative; 4. Evaluate

system consequences and

choose the best risk treatment;

5. Implement; 6. Monitor. 41

Strength:

1 - Can

understand new

risks and their

consequences.

2. Establish

interaction

between

different

stakeholders.

Y S Y Y Y Y *Systemic

*Holistic

(Emphasis on

problem solving

variables)

*Prospective

*Qualitative

All, specially

for dynamic

and changing

organization

Medium-

high

Medium-

high

Medium-high

(Continued)

D ovepress

F e rd o si e t a l

R isk

M a n a g e m e n t a n d H e a lth

c a re

P o lic y 2 0 2 0 :1 3

su b m it

yo u r m a n u scrip

t | w w w .d o v e p re ss.c

o m

D ovePress

2 3 1

Risk Management and Healthcare Policy downloaded from https://www.dovepress.com/ by 165.215.209.15 on 18-Apr-2020

For personal use only.

P ow

ered by TC P

D F (w

w w

.tcpdf.org)

1 / 1

2- Risk Management Phases

2-1- Base models

Systemic Risk Management� (SYRMA)

1. defining and managing event and recording threats and vulnerabilities; 2. tracking identified risks in a risk register; 3. performing risk assessment and risk evaluation; 4. providing the capability of registering statistical or benchmark data; 5. setting risk priorities; 6. defining and tracking risk treatment activities. (see endnote 27 on page 27)

Strength:1- address both managerial and operative staff support requirements.2- Allows users to personalize their view of the system

S Y Y Y Y Y *Qualitative- quantitative *Prospective *Systemic *Holistic

All, especially for healthcare sector and case of complex and mission critical systems

Medium- high

Medium- high

Medium-high

Clinical risk management (CRM)

1. Identify risks; 2. Analysis risks; 3. Assess risks; 4. Manage risks. (see endnote 29 on page 28)

Weakness: is based on subjective and intrinsic judgment

S S Y N S Y *Qualitative *Prospective *Systemic *Holistic

All, specially for healthcare

Medium- high

Medium- high

Medium-high

Strategic Risk Management (SRM)

1. Defining the context; 2. Risk assessment; 3. Making and Communicating the decision and Action; 4. Monitoring and course correcting. (see endnote 39 on page 28)

Weakness: is based on subjective and intrinsic judgment

Y S Y Y S Y *Qualitative *Prospective *Systemic *Holistic

All, specially for project management

Medium- high

Medium- high

Medium-high

System risk evaluation and management

1. Define the objectives and performance measures; 2. Workshop together; 3. Evaluate and priorities consequences for each alternative; 4. Evaluate system consequences and choose the best risk treatment; 5. Implement; 6. Monitor. (see endnote 41 on page 28)

Strength: 1 - Can understand new risks and their consequences. 2. Establish interaction between different stakeholders.

Y S Y Y Y Y *Systemic *Holistic (Emphasis on problem solving variables) *Prospective *Qualitative

All, specially for dynamic and changing organization

Medium- high

Medium- high

Medium-high

Table 5 (Continued).

Model Name Steps Characteristics Output and Information Attitude to

the Risk

Applicable

Type of

Environment

Cost Time Complexity

Establish

the

Context

Risk

Identification

Risk

Analysis

Risk

Evaluation

Risk

Treatment

Monitoring

ISO 31000 1. Establish the context; 2.

Identify risk; 3. Analysis risk; 4.

Evaluate risks; 5. Treat risks; 6.

Monitor and review; 7.

Communication and consult. 44

Weakness: is

based on

subjective and

intrinsic

judgment

Y Y Y Y Y Y *Qualitative

*Prospective

*Holistic

*Systemic

All Medium-

high

Medium-

high

Medium-high

ERM(enterprise

risk

management)

1. Establish the context; 2. -

Identify risks within this context;

3. Assess risks included: 3-

1. analyze risks; 3-2. Evaluate

risks; 4. Develop risk treatment

included 4-1. Risk mitigation; 4-

2. Implement mitigation

strategies. 53

Weakness: The

relative risk

assessment

matrix is used

instead of a

precise

measurement for

risk rating.

Y Y Y Y Y N *Qualitative

*Prospective

*Narrow

*Systemic

All Medium-

high

Medium-

high

Medium-high

ERP by fault tree

analysis

1. Context analysis; 2-Risk

identification; 3. Risk analysis;

4. Risk evaluation included

4-1. Enterprise resource

planning

decomposition and specification;

4-2. Fault tree analysis; 5. Risk

Response & Treatment; 6. Risk

Review, monitoring &

controlling. 54

Weakness: 1-We

can only check

one event at a

specific time

Y Y Y *Qualitative-

quantitative

*Systemic

*Prospective

*Narrow

All Medium-

high

Medium-

high

Medium-high

F e rd o si e t a l

D ovepress

su b m it yo

u r m a n u scrip

t | w w w .d o v e p re ss.c

o m

D ovePress

R isk

M a n a g e m e n t a n d H e a lth

c a re

P o lic y 2 0 2 0 :1 3

2 3 2

Risk Management and Healthcare Policy downloaded from https://www.dovepress.com/ by 165.215.209.15 on 18-Apr-2020

For personal use only.

P ow

ered by TC P

D F (w

w w

.tcpdf.org)

1 / 1

Model Name Steps Characteristics Output and Information Attitude to the Risk

Applicable Type of Environment

Cost Time Complexity

Establish the Context

Risk Identification Risk Analysis Risk Evaluation Risk Treatment Monitoring

ISO 31000 1. Establish the context; 2. Identify risk; 3. Analysis risk; 4. Evaluate risks; 5. Treat risks; 6. Monitor and review; 7. Communication and consult. (see endnote 44 on page 28)

Weakness: is based on subjective and intrinsic judgment

Y Y Y Y Y Y *Qualitative *Prospective *Holistic *Systemic

All Medium- high

Medium- high

Medium-high

ERM(enterprise risk management)

1. Establish the context; 2. - Identify risks within this context; 3. Assess risks included: 3- 1. analyze risks; 3-2. Evaluate risks; 4. Develop risk treatment included 4-1. Risk mitigation; 4- 2. Implement mitigation strategies. (see endnote 53 on page 28)

Weakness: The relative risk assessment matrix is used instead of a precise measurement for risk rating.

Y Y Y Y Y N *Qualitative *Prospective *Narrow *Systemic

All Medium- high

Medium- high

Medium-high

ERP by fault tree analysis

1. Context analysis; 2-Risk identification; 3. Risk analysis; 4. Risk evaluation included 4-1. Enterprise resource planning decomposition and specification; 4-2. Fault tree analysis; 5. Risk Response & Treatment; 6. Risk Review, monitoring & controlling. (see endnote 54 on page 28)

Weakness: 1-We can only check one event at a specific time

Y Y Y *Qualitative- quantitative *Systemic *Prospective *Narrow

All Medium- high

Medium- high

Medium-high

2-2: Combined models

The combined

approach

(HFMEA,

SHERPA) and

(STAMP-STPA)

1. Graphical process included 1-1.

Box and arrow diagram; 1–2. HTA

Diagram; 1–3. Representation of

the control loop; 2. Hazard

analysis included 2–1. Failures

identification; 2–2. Human error

classification; 2–3. Failure scoring;

2–4. Consequence Analysis; 2–5.

Check the coherence of severity

scores; 2–6. Hazard score

calculation; 2–7. Recovery

Analysis; 2–8. Selection of the

critical failures; 2–9. List of the

existing control measures; 3.

Cause analysis;4-Identification of

prevention measures and

controls. 42

Weakness: The

validity and

reliability of the

combined model

have not been

measured.

Strength: 1-

Combined model

S Y Y Y S Y *Qualitative

*Prospective

*Systemic-

humanistic

*Holistic with

emphasis on

duties

All, specially

for

health care

Medium-

high

High High

Problem-solving

strategy with

embedded Six

Sigma

methodology

1. Trained RM team; 2. The

define phase; 3. Identify, classify

and prioritize risk; 4. RCA; 5-

Measures process capability; 6.

Prioritize, implement, control

and monitor. 43

Strength: The

validity of the

model is proven.

Y S Y Y Y Y *Qualitative-

quantitative

*Systemic

*Prospective

*Holistic

All High High High

(Continued)

D ovepress

F e rd o si e t a l

R isk

M a n a g e m e n t a n d H e a lth

c a re

P o lic y 2 0 2 0 :1 3

su b m it

yo u r m a n u scrip

t | w w w .d o v e p re ss.c

o m

D ovePress

2 3 3

Risk Management and Healthcare Policy downloaded from https://www.dovepress.com/ by 165.215.209.15 on 18-Apr-2020

For personal use only.

P ow

ered by TC P

D F (w

w w

.tcpdf.org)

1 / 1

2-2: Combined models

The combined approach (HFMEA, SHERPA) and (STAMP-STPA)

1. Graphical process included 1-1. Box and arrowdiagram; 1�2. HTA Diagram; 1�3. Representation of the control loop; 2. Hazard analysis included 2�1. Failures identification; 2�2. Human error classification; 2�3. Failure scoring; 2�4. Consequence Analysis; 2�5. Check the coherence of severity scores; 2�6. Hazard score calculation; 2�7. Recovery Analysis; 2�8. Selection of the critical failures; 2�9. List of the existing control measures; 3. Cause analysis;4-Identification of prevention measures and controls. (see endnote 42 on page 28)

Weakness: The validity and reliability of the combined model have not been measured. Strength: 1- Combined model

S Y Y Y S Y *Qualitative *Prospective *Systemic- humanistic *Holistic with emphasis on duties

All, specially for health care

Medium- high

High High

Problem-solving strategy with embedded Six Sigma methodology

1. Trained RM team; 2. The define phase; 3. Identify, classify and prioritize risk; 4. RCA; 5- Measures process capability; 6. Prioritize, implement, control and monitor. (see endnote 43 on page 28)

Strength: The validity of the model is proven.

Y S Y Y Y Y *Qualitative- quantitative *Systemic *Prospective *Holistic

All High High High

Table 5 (Continued).

Model Name Steps Characteristics Output and Information Attitude to

the Risk

Applicable

Type of

Environment

Cost Time Complexity

Establish

the

Context

Risk

Identification

Risk

Analysis

Risk

Evaluation

Risk

Treatment

Monitoring

Adaptation of

the ISO

31000:2009: Six

Sigma DMAIC

approach to

enterprise RM

(ERM)

1. Define phase(Mandate and

commitment); 2. Measure phase

included identify risk; 3. Analyze

phase included risk analysis;

4. Improve phase including risk

mitigation; 5. Control phase

including 5-1. The

recommended improvement

action plan be documented; 5–2.

Monitor and

review; 6. Communicate and

consult. 45

Strength:

1. Provides a

more accurate

decision for the

organization.

2. Creates value

for the

stakeholders of

the organization.

Y Y Y Y Y Y *Qualitative-

quantitative

*Systemic

*Prospective

*Holistic

All High High High

Error prevention

methods:

(HFMEA- RCA-

Structured

Analysis-

Dynamic

systems

development

method (DSDM)

1.

Defining a Topic; 2. Assembling

a Team; 3. Describing a

process; 4. Analyzing hazards

included 4-1. To identify and

assess potential

vulnerabilities; 4-2. The HFMEA

Decision Tree; 4-3. Identified

causes of errors; 5. Identifying

Actions and Expected

Outcomes; 6. Build Iteration;

and

Implementation; 7. Renovating

process. 50

Strength: Is an

effective way to

prevent errors in

organizations.

Y Y Y Y Y Y *Qualitative-

quantitative

*Systemic

*Prospective

*Holistic

All, special for

health care

High High High

Notes: In output and information item, the status of risk management in organization was determined based on each of the phases of proposed framework. (Y: Fully performed, S: Somewhat performed, N: Not implemented).

F e rd o si e t a l

D ovepress

su b m it yo

u r m a n u scrip

t | w w w .d o v e p re ss.c

o m

D ovePress

R isk

M a n a g e m e n t a n d H e a lth

c a re

P o lic y 2 0 2 0 :1 3

2 3 4

Risk Management and Healthcare Policy downloaded from https://www.dovepress.com/ by 165.215.209.15 on 18-Apr-2020

For personal use only.

P ow

ered by TC P

D F (w

w w

.tcpdf.org)

1 / 1

Model Name Steps Characteristics Output and Information Attitude to the Risk

Applicable Type of Environment

Cost Time Complexity

Establish the Context

Risk Identification Risk Analysis Risk Evaluation Risk Treatment Monitoring

Adaptation of the ISO 31000:2009: Six Sigma DMAIC approach to enterprise RM (ERM)

1. Define phase(Mandate and commitment); 2. Measure phase included identify risk; 3. Analyze phase included risk analysis; 4. Improve phase including risk mitigation; 5. Control phase including 5-1. The recommended improvement action plan be documented; 5�2. Monitor and review; 6. Communicate and consult. (see endnote 45 on page 28)

Strength: 1. Provides a more accurate decision for the organization. 2. Creates value for the stakeholders of the organization.

Y Y Y Y Y Y *Qualitative- quantitative *Systemic *Prospective *Holistic

All High High High

Error prevention methods: (HFMEA- RCA- Structured Analysis- Dynamic systems development method (DSDM)

1. Defining a Topic; 2. Assembling a Team; 3. Describing a process; 4. Analyzing hazards included 4-1. To identify and assess potential vulnerabilities; 4-2. The HFMEA Decision Tree; 4-3. Identified causes of errors; 5. Identifying Actions and Expected Outcomes; 6. Build Iteration; and Implementation; 7. Renovating process. (see endnote 50 on page 28)

Strength: Is an effective way to prevent errors in organizations.

Y Y Y Y Y Y *Qualitative- quantitative *Systemic *Prospective *Holistic

All, special for health care

High High High

diagrams,34,38,45,56,58 system diagram,8,34,62 integration

definition (IDEF),35 and hierarchical task analysis

Diagram (HTA) or task diagram,26,28,35,42,57,62 communi-

cation diagram,56,62 information diagram,35,56,62,63 organi-

zational diagram,35,56,62,63 stakeholder diagrams,56 swim

lane activity diagram,56 state transition diagram,56

sequence diagram,56 and data flow diagram.56

In general, process description tools are divided into

two categories of descriptive tools and process tools.

Radar charts, also called Kiviat diagrams, were built in

order to visualize initial and residual risks for each kind

process.34 ABS is process-oriented instead of being pro-

duct-oriented, moreover, this method lacks time

dimension.8 Also, a task diagram is used for describing

the hierarchy of operations and plans, system mapping for

how data is transmitted through activities, Information

diagrams for describing information hierarchies, organiza-

tional diagrams for describing organizational roles hierar-

chy and Communication diagrams for displaying

information flows between individuals and Business pro-

cesses and IDEF for linking between inputs and outputs in

organizational activities and resources, and Sequence dia-

grams for interacting information between stakeholders.

According to Cagliano et al, the flow chart included the

name or code of both process phase and activity at issue,

actors performing the activity; inputs (information, materi-

als, preliminary actions, orders, etc.); a detailed descrip-

tion of operations required by the activity; duration and

frequency; controls to monitor activity progress; tools

necessary to perform both the activity and related controls

and outputs (other activities, information, and data).8

Moreover, in Parand et al’s study, activities in flow chart

classified based on action, retrieval, checking, selection

and information, and communication.28 In general, as the

describing the process be stronger, the results of the risk

assessment can be more effective.

According to Simsekler et al36 and Jun et al.56 Studies,

specific types of diagrams were selected by stakeholders as

more useful than others in identifying different sources of

risks within the given system. In general, employees’

perception, the ease of use and usefulness are the main

variables for choosing the most optimal system modeling

tool.

Risk Identification

After drawing the process flowchart, at this stage, organi-

zational risks or organizational process risks are

determined. The applied frameworks for identifying risks

in executive levels of HCOs presented in Table 4.

Cause Identification

Based on some risk assessment models, the effective

causes and the root causes of the errors are identified at

this stage. Based on the Eindhoven model, the classes of

causes error classified into two main categories of latent

errors (technical and organizational) and active errors

(human errors and other factors).25 Furthermore, based

on the results of some studies, the causes of errors classi-

fied in the Institutional context factors, organizational and

management factors, work environment factors, team fac-

tors, communication factors, individual (staff) factors,

training and education factors, equipment factors, task

factors, and patient factors.35,36 In addition, based on the

results of some studies, the Ishikawa cause-effect diagram

can be used to determine the sources of errors.37,45,48

Risk Analysis At this stage, it is possible to estimate the risk, qualita-

tively, semi-qualitatively or quantitatively according to the

probability of the risk. The following steps considered for

risk analysis in executive levels of HCOs.

Risk Estimation (Severity and Consequences and

Likelihood Estimation)

At this stage, it is possible to risk estimation according to

the probability and severity of risk. There are numerous

qualitative, semi-quantitative and quantitative methods

that try to estimate individual components of risk for a

result to better reflect the reality.

Using verbal descriptors (low, medium, or high),26 risk

weights,25,34,38,49,59,61 encoding,30,40,52,60,61 scoring

tables,25–27,30,32,37 Bayesian methods,46 Monte Carlo

method,46,60 and historical data,49 suggested for estimating

the severity and probability of risk in executive levels of

HCOs.

In quantitative risk estimation methods (Monte Carlo

and Bayesian), activities find a probabilistic form and a

distribution function is specified for them.46,60 In quali-

tative risk estimation methods, risks are prioritized

based on their potential impacts on project objectives

based on qualitative variables. Qualitative methods of

risk estimation can either lead to further analysis in

quantitative risk estimation or directly to risk response

planning.30,60

Dovepress Ferdosi et al

Risk Management and Healthcare Policy 2020:13 submit your manuscript | www.dovepress.com

DovePress 235

R

is k

M an

ag em

en t a

nd H

ea lth

ca re

P ol

ic y

do w

nl oa

de d

fr om

h ttp

s: //w

w w

.d ov

ep re

ss .c

om / b

y 16

5. 21

5. 20

9. 15

o n

18 -A

pr -2

02 0

F or

p er

so na

l u se

o nl

y.

Powered by TCPDF (www.tcpdf.org)

1 / 1

Interview with experts,32,53 questionnaire design,32,61

Delphi method or expert,60 and focus group,38,44,46,49-51,53

identified an applied method for risk estimation in execu-

tive levels of HCOs.

Risk Presentation

Present-estimated risks based on risk presentation formats,

included a single number index (e.g. 1/100,000),27,37

use failure space vs success space,54 fuzzy numbers

scales,30,32,40,41,52,61 tables (e.g. sizes or bands of

fatalities are 1–10, 11–100, and 101–1000),30,40 risk

matrix,25,33,43,52,53,57 graphs or diagrams (e.g. Frequency-

Number (F-N) curve),35,46 and maps (e.g. risk contour

plot).45

In sensitivity analysis, the management index (Risk

Index x Sensitivity) provided further ranking for those

risks that have equivalent Risk Indexes. Given its scope,

this analysis may not necessarily constitute an integrated

step of risk analysis.49

Conclusion

Synthesize information about the main risk elements

included risks and their causes and contributing causes,

frequency or probability, consequences due to risk, and

estimated risks.49

Risk Evaluation Risk evaluation is the process of comparing the results of

the risk analysis with the risk evaluation criteria defined

during the context establishment to determine whether the

cyber-risks are acceptable. In this step, the following steps

considered for risk evaluation in executive levels of

HCOs.

Select Risk Evaluation Criteria

There was a wide range of qualitative and quantitative risk

criteria or standards for evaluation of various types of

errors in executive levels of HCOs. Selection of risk

criteria may also depend on the results of the risk analysis

and how risks are estimated.60

Compare Estimated Risks Against the Risk Criteria

and Prioritize or Rank Risks

This step concerned with making decisions about prioriti-

zation and comparison of risks to be managed, based on

the outcomes of risk analysis.27

A simple method for risk filtering was a Pareto

analysis.26,30,58,60 Moreover, in some studies, decision

tree,25,28,49,57 priority matrix,25,30,35 criticality matrix,34,44

Criticality scale,34,38,49,60 and risk prioritization grid used

to determine acceptable and unacceptable risks.27

Furthermore, simple additive weighting (SAW),32 and

hazard totem pole (HTP)60 methods can be used as prac-

tical and quantitative methods for risk evaluation. SAW

was a simple and most applicable multi-attribute decision

method which is known as a weighted linear combination

or scoring technique.32

Risk Treatment This phase involved defining and implementing actions for

mitigating the determined risk level and verifying that the

residual risk level is acceptable.27

Determine Organization RM Strategies

The four common organization RM strategies options:

(I) Avoid: elimination involves elimination of risks at

the source.

(II) Reduce: The strategy of risk reduction involves

reduction, but not a complete elimination, of the

frequency of occurrence of undesirable risks and/or

the severity of their consequences.53,60

These comprise two fundamental approaches to risk reduc-

tion, which were:

● Prevention ● Mitigation: Reduce the occurrence probability of the

risk or the impact of the risk.

I. SHARE (spread or transfers): sharing the risk to

another entity and/or function. Risk sharing is

carried out in different ways, including risk shar-

ing by insurance and contract, risk transfer and

physical transfer.

II. Accept: Risk can be retained in cases where it

cannot be avoided or transferred.25,44,45,53,60

Moreover, theory of problem-solving by an inventive

method,25 Generating Options for Active Risk Control

(GO-ARC) Technique64 and dynamic systems develop-

ment method (DSDM)50 used to redesign the process and

improve strategies.

In the GO-ARC Technique, risk control options are

divided into 5 categories (elimination, design controls,

administrative controls, detection/situational awareness,

and preparedness). The first three consist of the 3-tiered

Ferdosi et al Dovepress

submit your manuscript | www.dovepress.com

DovePress Risk Management and Healthcare Policy 2020:13236

R

is k

M an

ag em

en t a

nd H

ea lth

ca re

P ol

ic y

do w

nl oa

de d

fr om

h ttp

s: //w

w w

.d ov

ep re

ss .c

om / b

y 16

5. 21

5. 20

9. 15

o n

18 -A

pr -2

02 0

F or

p er

so na

l u se

o nl

y.

Powered by TCPDF (www.tcpdf.org)

1 / 1

Prevention

Mitigation: Reduce the occurrence probability of the risk or the impact of the risk.

SHARE (spread or transfers): sharing the risk to another entity and/or function. Risk sharing is carried out in different ways, including risk shar- ing by insurance and contract, risk transfer and physical transfer.

Accept: Risk can be retained in cases where it cannot be avoided or transferred. (see endnote 25 on page 27 and endnotes 44, 45, 53 & 60 on page 28)

Avoid: elimination involves elimination of risks at the source. Reduce: The strategy of risk reduction involves reduction, but not a complete elimination, of the frequency of occurrence of undesirable risks and/or the severity of their consequences. (see endnotes 53 & 60 on page 28)

hierarchy of risk controls. The remaining two, detection/

situational awareness and preparedness help users consider

risk controls to reduce the severity of harm or prevent

harm in the midst of an on-going systems breakdown;

they are aimed at promoting resilience, as opposed to

focusing solely on preventing systems breakdowns in the

first place. In general, GO-ARC improves the trend of

producing risk control options. Use of the Generating

Options for Active Risk Control (GO-ARC) Technique

can lead to more robust risk control options.

On the other hand, the DSDM framework is compli-

cated to become a general framework for solving task

problems. At DSDM, the primary effort is to provide

software that is good enough to meet the needs of the

business and that it can progress to the next iteration.50

Additionally, the SWOT matrix with four strategy

areas, SO (maxi-maxi) and ST (maxi-mini) and WO

(mini-maxi) and WT (mini-mini), was used to determine

strategies and corrective actions.31

RM Measures and Decision-Making

RM strategies and measures were often difficult to compare

and evaluate executive levels of HCOs. The best decision is

the one that yields the greatest expected value. The inter-

ventions prioritized according to two criteria of their ability

to reduce the root causes (interventional power) and percep-

tion of their implementation based on what is anticipated

(reliability of intervention).26,30

The best performance measures can be selected based

on criteria such as safety, profitability, quality, efficiency,

effectiveness, time, cost, available resources, performance,

environmental conditions, and satisfaction.41,42,45,46,59 In

one study, AHP/ANP and BOCR (benefits, opportunities,

costs, and risks) used to select the best RM strategies.41

Planning and Implementation

Finally, a plan also defined risk ownership, roles and responsi-

bilities, and time frames to implement mitigation strategies.45

Risk governance structure was a useful tool for risk assessment

planning. In this method, the roles and responsibilities of each

employee determined in the RM plans.39,40,45 Moreover, using

the pilot study method43,59 and simulation,41,49 suggested

before the implementation in a wide range.

These steps are typically performed as iterative cycles

that controlled and triggered by two continuously running

activities: risk review and monitoring, communication, and

consultation.

Communication and Consultation Communication and consultation with internal and exter-

nal stakeholders needed to keep them informed of process

outputs and let them provide inputs.27

Risk-related information should be shared based on

appropriate access levels in the exchange organization or

between decision-makers and other stakeholders. These

should address the issues related to risk itself, its causes,

its consequences (if there is information about them), and

the measures taken to deal with it.

Communication and consulting with project stake-

holders can be a key factor in a favorable execution of

risk management and in achieving better results. In prac-

tice, regular reporting is of important components of com-

munication that helps senior managers identify the risks

they are faced with. Summary reports prepared from risks,

in fact reflect the status of the responding guidelines and

the trend index of risk occurrence.59

Work sessions,29,59 intranet-based calendars,59 reports

and gatherings,59 wiki page,45 and PMBOOK software,46

are suggested as tools for information exchange in execu-

tive levels of HCOs.

Monitoring and Review: (Re-Assessment

– a Continuous and Cyclic Process) Effective risk management requires a reporting and reviewing

structure in order to ensure that risks are effectively identified

and evaluated and responses and controls are in a timely

manner. In this phase, policies and following of standards

should be regularly verified and the performance of standards

should be reviewed to identify improvement opportunities.27

Various methods such as risk compliance readiness

template,45 risk project update template,45 data management

system,60 variance analysis,46 risk reassessment,46 Wiki page

as collaborative workspace,45 control chart,43 trend analysis,46

risk auditing,39,46 visual process control,43 and communication

plan43 recognized to monitor and evaluate the effective and

efficient RM cycle in executive levels of HCOs.

By conducting continuous monitoring and reviewing of

risk, it is ensured that new risks are being identified and

managed, and executive programs are effectively imple-

mented and developed.46

Discussion Given different and dynamic nature of organizations, var-

ious frameworks and techniques are used in managing and

accessing organization risks. Therefore, recognizing

Dovepress Ferdosi et al

Risk Management and Healthcare Policy 2020:13 submit your manuscript | www.dovepress.com

DovePress 237

R

is k

M an

ag em

en t a

nd H

ea lth

ca re

P ol

ic y

do w

nl oa

de d

fr om

h ttp

s: //w

w w

.d ov

ep re

ss .c

om / b

y 16

5. 21

5. 20

9. 15

o n

18 -A

pr -2

02 0

F or

p er

so na

l u se

o nl

y.

Powered by TCPDF (www.tcpdf.org)

1 / 1

organization RM framework is an important step in RM in

executive levels of HCOs. In this study, based on a review

of studies, frameworks and tools that can be used to

implement organizational risk management in the execu-

tive level of HCOs are proposed.

According to the first question of this study, healthcare

organizations may be faced with risks that may prevent the

mission and achievement of the organization’s objectives,

so at the first step of risk management, risk resources

should be identified with optimal tools.17 In the present

study, using an innovative approach, a framework for

identifying and classifying risks in the executive levels

of HCOs was proposed. The proposed framework included

three steps of input, process, and output.

Input phases considered a spectrum of inputs to help

increase understanding of the system, and awareness of

potential organization risks that can occur in complex and

changeable healthcare systems.36 Input phases consist of

(Risk Sources,8,36 Nature of Hazards,36 and Time).36 At

the process stage, the tools that can be used as intra- or

inter-organization and retrospective-prospective in the

executive levels of healthcare organizations are

determined.55 Finally, in the presence of the risk stage

(output stage), the identified risks were clearly registered

in executive levels of HCOs.8

Using this framework is a helpful guide for managers

to identify potential error in the executive levels of HCOs.

Based on the results of the study by Pott et al57 and

Similker et al,17 different approaches should be used to

identify risks in organizations, and data from different

resources should be integrated to gain a general view

into the risks of a system.

We have no standard answer as to which one of the risk

identification tools is a more optimal tool. Each tool is

used to identify a range of risks, so the best approach to

identify all risks is to integrate retrospective and prospec-

tive analysis to understand a broader scope of the risks.

Based on the results of the studies, organizational

risks,8,26,31,45,59 technological supports,8,31,34,40,45,60 and

information and communication,8,31,34,40,55,59 were identi-

fied as the most important resources of risk in most stu-

dies, so treatment of these risks is of high importance in

the executive levels of HCOs.

In today’s world, when being faced with healthcare

organization risks, managers have realized the need to

develop a risk management framework at the organization

level. According to the second and third questions of this

study provides a state of the art based on the review of

studies and it tried to propose a framework for risk man-

agement and techniques applicable to each of the stages of

risk management and risk assessment in executive levels

of HCOs. The term “framework” has a broader scope than

the term “technique.” The risk management framework

includes guidelines for analyzing, assessing, and managing

risks in healthcare organizations. In contrast, management,

and risk assessment techniques considered as analytical

tools for analyzing data and risk information.

In general, the risk management framework has

required stability, but there is no strong and complete

risk assessment and risk management techniques that can

be applied completely for risk management in organiza-

tions, and managers of healthcare organizations must make

the decisions necessary to determine the optimal tool for

risk management and assessment at each time and based

on specific conditions and position of the organization.

Therefore, Table 5 presents limitations, strengths and

weaknesses and factors influencing the selection of each

of the models for risk management and risk assessment in

executive levels of HCOs. Therefore, the content of this

table can help risk analysts, healthcare managers and other

stakeholders to make rational decisions about identifying

risk management and risk assessment models in executive

levels of HCOs.

According to the results of the studies, there was a

wide range of well-known and successful tools for single

and combined risk assessment and a hierarchy of risk

analysis models suggested for executive levels of HCOs.

Hierarchy of risk analysis and risk assessment models

divided:

High-level tools: At this level, risk assessment tools

cover a wide range of risk scenarios and provide various

information for the organization based on risk scenarios.

However, such tools should not be used when the details

need to be emphasized in risk assessment. Some risk

assessment tools employed at this level are All the com-

bined models presented in Table 5 for analysis and risk

assessment,30,35,38,40,42,43,45,50,52 Six Sigma,43,45

IRMAS,59 CREA (Clinical Risk and Error Analysis).35

Mid-level tools: Implementing risk assessment tools at

this level makes it possible to provide the modest informa-

tion and details for the organization considering risk scenar-

ios. Some risk assessment tools employed at this level are

Health failure mode and effect analysis (HFMEA),25,42,50

HFMEA/FMEA/FMECA,8,25,26,28,30,37,38,49 root cause ana-

lysis (RCA),38,43,50 bow-tie model,48,51 hazard and oper-

ability analysis (HAZOP).35

Ferdosi et al Dovepress

submit your manuscript | www.dovepress.com

DovePress Risk Management and Healthcare Policy 2020:13238

R

is k

M an

ag em

en t a

nd H

ea lth

ca re

P ol

ic y

do w

nl oa

de d

fr om

h ttp

s: //w

w w

.d ov

ep re

ss .c

om / b

y 16

5. 21

5. 20

9. 15

o n

18 -A

pr -2

02 0

F or

p er

so na

l u se

o nl

y.

Powered by TCPDF (www.tcpdf.org)

1 / 1

Low-level tools: At this level, risk assessment tools

evaluate the limited range of risk scenarios, but with

more details for the organization. Some risk assessment

tools employed at this level are: Preliminary risk analysis

method (PRA),34 fault tree analysis (FTA),54 change risk

assessment model (CRAMS),46 change analysis (CHA),46

human reliability assessment (HRA),8 Pareto analysis

(PA),26,30 relative ranking/risk indexing (RI),32,60 5 whys

technique,8,36 hazard checklists (HCl),35 change analysis

(CA),28 strategic risk analysis (SRA).31

Optimal implementation of the risk management pro-

cess is nothing but the adoption of the most appropriate

techniques and tools available in each phase. However,

there is no strong and complete risk assessment and risk

management techniques that can be applied completely for

risk management in organizations, and managers of health-

care organizations must make the decisions necessary to

determine the optimal tool for risk management and

assessment at each time and based on scope of risk analy-

sis, legal requirements, results/information needed data,

resources and time available, complexity and size of risk

analysis and type of activity or system and concerning

issues. As a general rule, the best risk management tool

is to overcome the participants’ mental judgment.

Most of the models extracted from the results of the

study were somewhat similar and presented the same

components. The three main factors that were found in

all risk management models included measurement, man-

agement, and monitoring. Therefore, based on the results

of the studies and the nature of healthcare organizations,

the risk management process had one primary phase and

four main phases. In the primary phase, the objectives and

prerequisites for risk management are set out for execu-

tion. The main phases are as follows: Risk assessment

(identifying potential risks, determining the likelihood

and consequence of the identified risk and determining

the level of the risk), risk treatment (how to reduce the

impact of unacceptable risks and selecting appropriate

responses to them), monitoring and reviewing (effective-

ness of measures) and the latest activity of the process of

communication and consultation with the stakeholders on

the trend have been carried out.

The proposed framework of this study is very similar

to the iso13000 framework, with the difference that more

details are provided in the framework of the present study.

The ISO13000 approach describes the organization’s risk

management in a comprehensive, strategic, and holistic

way.45

Also, the model developed in the present study has

several specific features compared with the previous mod-

els: 1) In the present research it was tried that the research

literature be integrated in the field of risk management and

provide a framework that is more comprehensive; 2)

According to the search strategy, all risk management

frameworks of healthcare organizations and organizations

adaptable with healthcare organizations were examined

and there was no particular dependence on the specific

industry and from this perspective, they have more advan-

tages compared to some frameworks that were established

regarding a specific industry; 3) The proposed framework

is provided based on the internal and external flows domi-

nant on healthcare organization. Managers of healthcare

organizations today need a structured and coherent

approach to identify, analyze, and manage risk across a

range of intra- and inter-organizational activities; 4) With

the establishment of the proposed model in the organiza-

tion, the basic assumptions dominant on healthcare orga-

nizations are examined in specific time periods and, if

necessary, continuous improvement in healthcare organi-

zations is done in a dynamic cycle.

Regarding the status of healthcare organizations in

establishing each of the main phases of the proposed risk

management framework, studies have identified and eval-

uated the risk, and the treatment phase and risk monitoring

were neglected in most studies. However, risk manage-

ment should be done throughout the life of the organiza-

tion. New risks need to be identified and managed at every

stage of the organization’s life. Also, based on Table 5,

most studies were not done at the phase of risk assessment,

process mapping, and cause identification. While many

system mapping approaches have been widely used in

various industries, healthcare organizations have only

used a limited number of them to process mapping.62

Each process mapping tool has a specific application, and

managers and professionals should use the most useful of

them to identify sources of risk in healthcare organiza-

tions. The most important phase, guiding the risk manage-

ment process, and determines the main policies in risk

management is the phase of planning and setting objec-

tives, which is done incompletely in most studies. Risk

managers should pay great attention to risk planning;

obviously, if this is not done in a fully transparent manner,

the execution of risk management will be subject to some

uncertainty.43,46

Based on the results of Table 5, in most studies (89.6%

of studies), risk management attitude was prospective and

Dovepress Ferdosi et al

Risk Management and Healthcare Policy 2020:13 submit your manuscript | www.dovepress.com

DovePress 239

R

is k

M an

ag em

en t a

nd H

ea lth

ca re

P ol

ic y

do w

nl oa

de d

fr om

h ttp

s: //w

w w

.d ov

ep re

ss .c

om / b

y 16

5. 21

5. 20

9. 15

o n

18 -A

pr -2

02 0

F or

p er

so na

l u se

o nl

y.

Powered by TCPDF (www.tcpdf.org)

1 / 1

in few studies, each of prospective and retrospective risk

management approaches was emphasized. Whereas, based

on the results of the Kessele-Habraken et al study, the

integration of prospective and retrospective analysis is

important in improving the safety and optimization of

organizational processes.58

As we proposed, information about incidents and their

retrospectively reported frequencies could be used as a

reference point in the prospective analyses, which might

facilitate frontline staff in the risk assessment. Conversely,

prospectively developed failure scenarios could be used as

guideline for retrospective.

Further Research Avenues and Limits In this study, a framework for the execution of risk man-

agement in the executive levels of HCOs was proposed.

Like any other management framework, successful imple-

mentation of the organization RM framework in executive

levels of HCOs necessitate organizational commitment,

establishing a stimulating culture, accurate planning, sta-

keholder engagement, strong and effective management,

and use of available resources to implement the stages.

Based on the results, it can be suggested that studies of

risk management are increasing over time; however, there

are still new cases that need further investigation and

researches, some of which are mentioned below.

1. Studies evaluating the effectiveness of risk manage-

ment frameworks were very scarce and the effec-

tiveness of risk management models should be

examined in the future.

2. The amount of outcome studies was not significant

with respect to the investigated period (2000–2018).

The outcome of most studies was also partial and lacks

the necessary comprehensiveness. In most studies, the

identification and assessment of risk were dealt with,

and the phases of risk treatment and monitoring was

neglected. Future studies, therefore, need to be imple-

mented with a holistic view of the risk management

process in healthcare organizations.

3. In most studies, the sample size was very small, and

risk management was performed at a micro level in

the healthcare organization and organizations adap-

table with the terms of healthcare. Therefore, the

risk management needs to become dominant in a

more comprehensive way and in larger-scales in

the healthcare organization.

4. Based on the results, various tools have been identi-

fied to achieve the risk management framework at

different phases. The variety of the materials col-

lected, together with the limited evidence for each

topic, make it difficult to come to general conclu-

sions, so it is necessary to conduct a cost-benefit

analysis of risk assessment techniques.

5. In this study, risk sources have been identified theoreti-

cally and for staff areas of healthcare organizations and

some risks may not have been identified, although

maybe a significant threat to the health system.

Therefore, we cannot claim that this framework can be

extended to other organizations in the health system.

6. The volumes of the most studies of risk management

in healthcare organizations are related to risk assess-

ment, so it is recommended that all future phases of

risk management in healthcare organizations be

established.

7. For some phases of organization risk management,

there were only conceptual studies; therefore, a fea-

sibility study is needed to effectively implement

various phases of RM in organizations.

8. Development of the organization RM framework for

other areas of healthcare, development of advanced

technological solutions to facilitate risk assessment,

development of tools or criteria for effective and effi-

cient implementation of organization RM frameworks,

managers’ perceptions of organization RM frameworks

are factors which should be considered for further

research.

One limitation of this study was that the number of find-

ings in the systemic review was dependent on the selection

of keywords and input/output criteria. Therefore, more

models can be extracted for organizational risk manage-

ment. Also, non-English studies were not included and

there may, therefore, be a bias towards inclusion of studies

performed in English-speaking countries. In addition, arti-

cles were exclusively selected from journals, hence, other

parts of literature, such as books, book sections, and gray

literature were excluded from the process as journal arti-

cles are readily available in journal databases and are

usually used as a mean of scientific communication.

Despite these limitations, this study has several

strengths. First, all models of risk management and eva-

luation in healthcare organizations and organizations that

could be modeled for the executive levels of the HCOs

Ferdosi et al Dovepress

submit your manuscript | www.dovepress.com

DovePress Risk Management and Healthcare Policy 2020:13240

R

is k

M an

ag em

en t a

nd H

ea lth

ca re

P ol

ic y

do w

nl oa

de d

fr om

h ttp

s: //w

w w

.d ov

ep re

ss .c

om / b

y 16

5. 21

5. 20

9. 15

o n

18 -A

pr -2

02 0

F or

p er

so na

l u se

o nl

y.

Powered by TCPDF (www.tcpdf.org)

1 / 1

Studies evaluating the effectiveness of risk manage- ment frameworks were very scarce and the effec- tiveness of risk management models should be examined in the future. The amount of outcome studies was not significant with respect to the investigated period (2000�2018). The outcome ofmost studies was also partial and lacks the necessary comprehensiveness. In most studies, the identification and assessment of risk were dealt with, and the phases of risk treatment and monitoring was neglected. Future studies, therefore, need to be imple- mented with a holistic view of the risk management process in healthcare organizations.

In most studies, the sample size was very small, and risk management was performed at a micro level in the healthcare organization and organizations adap- table with the terms of healthcare. Therefore, the risk management needs to become dominant in a more comprehensive way and in larger-scales in the healthcare organization.

Based on the results, various tools have been identi- fied to achieve the risk management framework at different phases. The variety of the materials col- lected, together with the limited evidence for each topic, make it difficult to come to general conclu- sions, so it is necessary to conduct a cost-benefit analysis of risk assessment techniques.

In this study, risk sources have been identified theoreti- cally and for staff areas of healthcare organizations and some risks may not have been identified, although maybe a significant threat to the health system. Therefore, we cannot claim that this framework can be extended to other organizations in the health system.

The volumes of the most studies of risk management in healthcare organizations are related to risk assess- ment, so it is recommended that all future phases of risk management in healthcare organizations be established.

For some phases of organization risk management, there were only conceptual studies; therefore, a fea- sibility study is needed to effectively implement various phases of RM in organizations.

Development of the organization RM framework for other areas of healthcare, development of advanced technological solutions to facilitate risk assessment, development of tools or criteria for effective and effi- cient implementation of organization RM frameworks, managers� perceptions of organization RM frameworks are factors which should be considered for further research.

were examined in this study. Second, this paper contri-

butes to the field of risk management research in health-

care. Third, the tools and techniques for risk assessment

and management that are applicable to staff areas of

healthcare organizations are mentioned.

Conclusion Based on the findings and considering the ISO31000

model, a comprehensive yet simple framework for risk

management is developed for the executive levels of

HCOs. It includes five main phases: establishing the con-

text, risk assessment (risk identification, risk analysis, and

risk evaluation), risk treatment (strategy determination,

designing corrective actions, planning, and implementa-

tion), Monitoring, and review, and communication and

consultation.

Tools and techniques were also suggested for use at

each phase of the proposed risk management framework.

These techniques have been selected to best apply to non-

clinical risks in healthcare organizations. Managers of

healthcare organizations who seek to ensure high quality

should use a range of risk management methods and tools

in their organizations, based on their need, and not assume

that each tool are comprehensive.

Acknowledgments We would like to thank all the staff members who assisted

with our research.

Disclosure The authors report no conflicts of interest in this work.

References 1. Sekhri Feachem N, Afshar A, Pruett C, Avanceña AL. Mapping

healthcare systems: a policy relevant analytic tool. Int Health. 2017;9(4):252–262. doi:10.1093/inthealth/ihx005

2. Crema M, Verbano C. Investigating the connections between health lean management and clinical risk management: insights from a sys- tematic literature review. Int J Health Care Qual Assur. 2015;28 (8):791–811. doi:10.1108/IJHCQA-03-2015-0029

3. Cagliano AC, Grimaldi S, Rafele C. Choosing project risk manage- ment techniques. A theoretical framework. J Risk Res. 2015;18 (2):232–248. doi:10.1080/13669877.2014.896398

4. Alhassan RK, Nketiah-amponsah E, Spieker N, et al. Effect of com- munity engagement interventions on patient safety and risk reduction efforts in primary health facilities: evidence from Ghana. PLoS One. 2015;10(11):1–20. doi:10.1371/journal.pone.0142389

5. Franca M. Quality, risk management and patient safety: the challenge of effective integration. World Hosp Health Serv. 2008;44(4):21.

6. Levett JM, Fasone JM, Smith AL, et al. Enterprise Risk Management in Healthcare. Surgical Patient Care. Springer; 2017:67–86.

7. Rubbio I, Bruccoleri M, Perrone G. Introducing “Healthcare Resilience” in Clinical Risk Management. Italy: University of Palermo; 2016.

8. Cagliano AC, Grimaldi S, Rafele C. A systemic methodology for risk management in healthcare sector. Saf Sci. 2011;49(5):695–708. doi:10.1016/j.ssci.2011.01.006

9. El-jardali F, Jaafar M, Dimassi H, Jamal D, Hamdan R. The current state of patient safety culture in Lebanese hospitals: a study at base- line. Int J Qual Health Care. 2010;22(5):386–395. doi:10.1093/ intqhc/mzq047

10. Santelices E, Muñiz P, Arriagada L, Delgado M, Rojas J. Adjusted clinical groups as a risk assessment model for healthcare resource allocation. Rev Med Chil. 2014;142(2):153–160. doi:10.4067/S0034-98872014000200002

11. Møller AH, Hansen L, Jensen MS, Ehlers LH. A cost-effectiveness analysis of reducing ventilator-associated pneumonia at a Danish ICU with ventilator bundle. J Med Econ. 2012;15(2):285–292. doi:10.3111/13696998.2011.647175

12. Thomya W, Saenchaiyathon K. The effects of organizational culture and enterprise risk management on organizational performance: A conceptual framework. Int Business Manage. 2015;9(2):158–163.

13. Standardization IOF. Information technology–Security techniques– Information security management systems–requirements(First Edition). British BS ISO/IEC27005; 2005; 34.

14. Lau CY. Quality improvement tools and processes. Neurosurg Clin N Am. 2015;26(2):177–187. doi:10.1016/j.nec.2014.11.016

15. Eugene Fibuch M, Arif Ahmed B. The role of failure mode and effects analysis in health care. Physician Exec. 2014;40(4):28.

16. Qazi A, Quigley J, Dickson A, editors. Supply chain risk manage- ment: systematic literature review and a conceptual framework for capturing interdependencies between risks. Industrial Engineering and Operations Management (IEOM), 2015 International Conference on; 2015: IEEE.

17. Simsekler M, Card AJ, Ward JR, Clarkson PJ. Trust-level risk iden- tification guidance in the NHS East of England. Int J Risk Saf Med. 2015;27(2):67–76. doi:10.3233/JRS-150651

18. Ward J, Clarkson P, Buckle P, Berman J, Lim R, Jun G. Prospective Hazard Analysis: Tailoring Prospective Methods to a Healthcare Context. UK: University of Cambridge University of Surrey; 2010.

19. Card AJ, Ward JR, Clarkson PJ. Trust-level risk evaluation and risk control guidance in the NHS east of England. Risk Analysis. 2014;34 (8):1469–1481. doi:10.1111/risa.2014.34.issue-8

20. Card AJ. The Active Risk Control (ARC) toolkit: a new approach to designing risk control interventions. J Healthcare Risk Manage. 2014;33(4):5–14. doi:10.1002/jhrm.21137

21. Card AJ, Klein VR. A new frontier in healthcare risk management: working to reduce avoidable patient suffering. J Healthcare Risk Manage. 2016;35(3):31–37. doi:10.1002/jhrm.21207

22. McConnell CR. The Effective Health Care Supervisor. Jones & Bartlett Publishers; 2011.

23. Arksey H, O’malley L. Scoping studies: towards a methodological framework. Int J Soc Res Methodol. 2005;8(1):19–32. doi:10.1080/ 1364557032000119616

24. Levac D, Colquhoun H, O’brien KK. Scoping studies: advancing the methodology. Implement Sci. 2010;5(1):69. doi:10.1186/1748-5908- 5-69

25. Taleghani YM, Rezaei F, Sheikhbardsiri H. Risk assessment of the emergency processes: healthcare failure mode and effect analysis. World j Emerg Med. 2016;7(2):97–105. doi:10.5847/wjem.j.1920- 8642.2016.02.003

26. Gervais B, D’arcy DM. Quality risk analysis in a cGMP environ- ment: multiple models for comprehensive failure mode identification during the computer system lifecycle. Drug Dev Ind Pharm. 2014;40 (1):46–60. doi:10.3109/03639045.2012.744417

27. Bernardini G, Paganelli F, Manetti M, Fantechi A, Iadanza E. SYRMA: a tool for a system approach to risk management in mission critical systems. Int J Business Inf Syst. 2013;13(1):21–44. doi:10.1504/IJBIS.2013.054166

Dovepress Ferdosi et al

Risk Management and Healthcare Policy 2020:13 submit your manuscript | www.dovepress.com

DovePress 241

R

is k

M an

ag em

en t a

nd H

ea lth

ca re

P ol

ic y

do w

nl oa

de d

fr om

h ttp

s: //w

w w

.d ov

ep re

ss .c

om / b

y 16

5. 21

5. 20

9. 15

o n

18 -A

pr -2

02 0

F or

p er

so na

l u se

o nl

y.

Powered by TCPDF (www.tcpdf.org)

1 / 1

1. Sekhri Feachem N, Afshar A, Pruett C, Avance￱a AL. Mapping healthcare systems: a policy relevant analytic tool. Int Health. 2017;9(4):252�262. doi:10.1093/inthealth/ihx005

2. Crema M, Verbano C. Investigating the connections between health lean management and clinical risk management: insights from a sys- tematic literature review. Int J Health Care Qual Assur. 2015;28 (8):791�811. doi:10.1108/IJHCQA-03-2015-0029

3. Cagliano AC, Grimaldi S, Rafele C. Choosing project risk manage- ment techniques. A theoretical framework. J Risk Res. 2015;18 (2):232�248. doi:10.1080/13669877.2014.896398

4. Alhassan RK, Nketiah-amponsah E, Spieker N, et al. Effect of com- munity engagement interventions on patient safety and risk reduction efforts in primary health facilities: evidence from Ghana. PLoS One. 2015;10(11):1�20. doi:10.1371/journal.pone.0142389

5. Franca M. Quality, risk management and patient safety: the challenge of effective integration. World Hosp Health Serv. 2008;44(4):21.

6. Levett JM, Fasone JM, Smith AL, et al. Enterprise Risk Management in Healthcare. Surgical Patient Care. Springer; 2017:67�86.

7. Rubbio I, Bruccoleri M, Perrone G. Introducing �Healthcare Resilience� in Clinical Risk Management. Italy: University of Palermo; 2016.

8. Cagliano AC, Grimaldi S, Rafele C. A systemic methodology for risk management in healthcare sector. Saf Sci. 2011;49(5):695�708. doi:10.1016/j.ssci.2011.01.006

9. El-jardali F, Jaafar M, Dimassi H, Jamal D, Hamdan R. The current state of patient safety culture in Lebanese hospitals: a study at base- line. Int J Qual Health Care. 2010;22(5):386�395. doi:10.1093/ intqhc/mzq047

10. Santelices E, Mu￱iz P, Arriagada L, Delgado M, Rojas J. Adjusted clinical groups as a risk assessment model for healthcare resource allocation. Rev MedChil. 2014;142(2):153�160. doi:10.4067/S0034-98872014000200002

11. M￸ller AH, Hansen L, Jensen MS, Ehlers LH. A cost-effectiveness analysis of reducing ventilator-associated pneumonia at a Danish ICU with ventilator bundle. J Med Econ. 2012;15(2):285�292. doi:10.3111/13696998.2011.647175

12. Thomya W, Saenchaiyathon K. The effects of organizational culture and enterprise risk management on organizational performance: A conceptual framework. Int Business Manage. 2015;9(2):158�163.

13. Standardization IOF. Information technology�Security techniques� Information security management systems�requirements(First Edition). British BS ISO/IEC27005; 2005; 34.

14. Lau CY. Quality improvement tools and processes. Neurosurg Clin N Am. 2015;26(2):177�187. doi:10.1016/j.nec.2014.11.016

16. Qazi A, Quigley J, Dickson A, editors. Supply chain risk management: systematic literature review and a conceptual framework for capturing interdependencies between risks. Industrial Engineering and Operations Management (IEOM), 2015 International Conference on; 2015: IEEE.

17. Simsekler M, Card AJ, Ward JR, Clarkson PJ. Trust-level risk identification guidance in the NHS East of England. Int J Risk Saf Med. 2015;27(2):67�76. doi:10.3233/JRS-150651

19. Card AJ, Ward JR, Clarkson PJ. Trust-level risk evaluation and risk control guidance in the NHS east of England. Risk Analysis. 2014;34 (8):1469�1481. doi:10.1111/risa.2014.34.issue-8

20. Card AJ. The Active Risk Control (ARC) toolkit: a new approach to designing risk control interventions. J Healthcare Risk Manage. 2014;33(4):5�14. doi:10.1002/jhrm.21137

21. Card AJ, Klein VR. A new frontier in healthcare risk management: working to reduce avoidable patient suffering. J Healthcare Risk Manage. 2016;35(3):31�37. doi:10.1002/jhrm.21207 22.

22. McConnell CR. The Effective Health Care Supervisor. Jones & Bartlett Publishers; 2011.

23. Arksey H, O�malley L. Scoping studies: towards a methodological framework. Int J Soc Res Methodol. 2005;8(1):19�32. doi:10.1080/ 1364557032000119616

24. Levac D, Colquhoun H, O�brien KK. Scoping studies: advancing the methodology. Implement Sci. 2010;5(1):69. doi:10.1186/1748-5908- 5-69

25. Taleghani YM, Rezaei F, Sheikhbardsiri H. Risk assessment of the emergency processes: healthcare failure mode and effect analysis. World j Emerg Med. 2016;7(2):97�105. doi:10.5847/wjem.j.1920- 8642.2016.02.003

26. Gervais B, D�arcy DM. Quality risk analysis in a cGMP environment: multiple models for comprehensive failure mode identification during the computer system lifecycle. Drug Dev Ind Pharm. 2014;40 (1):46�60. doi:10.3109/03639045.2012.744417

27. Bernardini G, Paganelli F, Manetti M, Fantechi A, ladanza E. SYRMA: a tool for a system approach to risk management in mission critical systems. Int J Business Inf Syst. 2013:13(1):21-44. doi:10.1504/1JBIS.2013.054166

28. Parand A, Faiella G, Franklin BD, et al. A prospective risk assess- ment of informal carers’ medication administration errors within the domiciliary setting. Ergonomics. 2018;61(1):104–121. doi:10.1080/ 00140139.2017.1330491

29. Sendlhofer G, Brunner G, Tax C, et al. Systematic implementation of clinical risk management in a large university hospital: the impact of risk managers. Wien Klin Wochenschr. 2015;127(1–2):1–11. doi:10.1007/s00508-014-0620-7

30. Lopez F, Bartolo CD, Piazza T, et al. A quality risk management model approach for cell therapy manufacturing. Risk Anal. 2010;30 (12):1857–1871. doi:10.1111/j.1539-6924.2010.01465.x

31. Emblemsvåg J, Endre Kjølstad L. Strategic risk analysis–a field version. Manage Decision. 2002;40(9):842–852. doi:10.1108/ 00251740210441063

32. Jaberidoost M, Olfat L, Hosseini A, et al. Pharmaceutical supply chain risk assessment in Iran using analytic hierarchy process (AHP) and simple additive weighting (SAW) methods. J Pharm Policy Pract. 2015;8(1):9. doi:10.1186/s40545-015-0029-3

33. Wierenga PC, Lie-a-huen L, de Rooij SE, Klazinga NS, Guchelaar H- J, Smorenburg SM. Application of the bow-tie model in medication safety risk analysis. Drug Saf. 2009;32(8):663–673. doi:10.2165/ 00002018-200932080-00005

34. Niel-lainé J, Martelli N, Bonan B, et al. Interest of the preliminary risk analysis method in a central sterile supply department. BMJ Qual Saf. 2011;20:698–773. doi:10.1136/bmjqs.2010.048074

35. Trucco P, Cavallin M. A quantitative approach to clinical risk assess- ment: the CREA method. Saf Sci. 2006;44(6):491–513. doi:10.1016/j. ssci.2006.01.003

36. Simsekler ME, Ward JR, Clarkson PJ. Design for patient safety: a systems-based risk identification framework. Ergonomics. 2018;61 (8):1–19. doi:10.1080/00140139.2018.1437224

37. Bonnabry P, Cingria L, Sadeghipour F, Ing H, Fonzo-christe C, Pfister R. Use of a systematic risk analysis method to improve safety in the production of paediatric parenteral nutrition solutions. BMJ Qual Saf. 2005;14(2):93–98. doi:10.1136/qshc.2003.007914

38. Rezaei F, Yarmohammadian MH, Haghshenas A, Fallah A, Ferdosi M. Revised risk priority number in failure mode and effects analysis model from the perspective of healthcare system. Int J Prev Med. 2018;9.

39. Domański J. Risk categories and risk management processes in non- profit organizations. Found Manage. 2016;8(1):227–242. doi:10.1515/ fman-2016-0018

40. Ramkumar M. A modified ANP and fuzzy inference system based approach for risk assessment of in-house and third party e-procurement systems. Strategic Outsourcing. 2016;9(2):159–188. doi:10.1108/SO-12-2015-0030

41. Beauchamp-Akatova E, Curran R. From initial risk assessments to system risk management. J Model Manage. 2013;8(3):262–289. doi:10.1108/JM2-01-2011-0008

42. Faiella G, Parand A, Franklin BD, et al. Expanding healthcare failure mode and effect analysis: a composite proactive risk analysis approach. Reliab Eng Sys Safety. 2018;169:117–126. doi:10.1016/j. ress.2017.08.003

43. Usman Tariq M. A Six Sigma based risk management framework for hand- ling undesired effects associated with delays in project completion. Int J Lean Six Sigma. 2013;4(3):265–279. doi:10.1108/IJLSS-05-2013-0028

44. Famiyeh S, Adaku E, Kissi-mensah L, Amoatey CT. Risk management for a tailings re-mining project in Ghana. Int J Managing Proj Business. 2015;8 (2):241–255. doi:10.1108/IJMPB-04-2014-0033

45. Choo BS-Y, Goh JC-L. Pragmatic adaptation of the ISO 31000: 2009 enterprise risk management framework in a high-tech organization using Six Sigma. Int J Account Inf Manage. 2015;23(4):364–382. doi:10.1108/IJAIM-12-2014-0079

46. Apostolopoulos C, Halikias G, Maroukian K, Tsaramirsis G. Facilitating organisational decision making: a change risk assessment model case study. J Model Manage. 2016;11(2):694–721. doi:10.1108/JM2-05-2014-0035

47. Delcea C, Ioana-alexandra B. Fostering risk management in health- care units using grey systems theory. Grey Syst. 2016;6(2):216–232. doi:10.1108/GS-12-2015-0078

48. Abdi Z, Ravaghi H, Abbasi M, Delgoshaei B, Esfandiari S. Application of Bow-tie methodology to improve patient safety. Int J Health Care Qual Assur. 2016;29(4):425–440. doi:10.1108/IJHCQA-10-2015-0121

49. Chu K-C, Hung L-P. Adaptive failure identification for healthcare risk analysis and its application on E-healthcare. J Appl Math. 2014;2014:1–17. doi:10.1155/2014/865241

50. Prijatelj V, Rajkovič V, Šušteršič O. A model for risk assessment in health care using a health care failure method and effect analysis. Slovenian J Public Health. 2013;52(4):316–331. doi:10.2478/sjph-2013-0032

51. Kerckhoffs MC, van der Sluijs AF, Binnekade JM, Dongelmans DA. Improving patient safety in the ICU by prospective identification of missing safety barriers using the bow-tie prospective risk analysis model. J Patient Saf. 2013;9(3):154–159. doi:10.1097/PTS.0b013e318288a476

52. Vahidnia S, Tanrıöver ÖÖ, Askerzade I. An early phase software project risk assessment support method for emergent software orga- nizations. Int J Advan Comp Sci Appl. 2017;8(5):105–118. doi:10.14569/IJACSA.2017.080514

53. Leung F, Isaacs F. Risk management in public sector research: approach and lessons learned at a national research organization. R&d Manage. 2008;38(5):510–519. doi:10.1111/radm.2008.38.issue-5

54. Zeng Y, Skibniewski MJ. Risk assessment for enterprise resource planning (ERP) system implementations: a fault tree analysis approach. Enterprise Inf Syst. 2013;7(3):332–353. doi:10.1080/17517575.2012.690049

55. Simsekler ME, Card AJ, Ruggeri K, Ward JR, Clarkson PJ. A comparison of the methods used to support risk identification for patient safety in one UK NHS foundation trust. Clin Risk. 2015;21 (2–3):37–46. doi:10.1177/1356262215580224

56. Jun GT, Ward J, Clarkson PJ. Systems modelling approaches to the design of safe healthcare delivery: ease of use and usefulness per- ceived by healthcare workers. Ergonomics. 2010;53(7):829–847. doi:10.1080/00140139.2010.489653

57. Potts HW, Anderson JE, Colligan L, Leach P, Davis S, Berman J. Assessing the validity of prospective hazard analysis methods: a comparison of two techniques. BMC Health Serv Res. 2014;14 (1):41. doi:10.1186/1472-6963-14-41

58. Kessels-Habraken M, Van der Schaaf T, De Jonge J, Rutte C, Kerkvliet K. Integration of prospective and retrospective methods for risk analysis in hospitals. Int J Qual Health Care. 2009;21 (6):427–432. doi:10.1093/intqhc/mzp043

59. Kayis B, Zhou M, Savci S, et al. IRMAS–development of a risk management tool for collaborative multi-site, multi-partner new pro- duct development projects. J Manufactur Technol Manage. 2007;18 (4):387–414. doi:10.1108/17410380710743770

60. Tummala R, Schoenherr T. Assessing and managing risks using the supply chain risk management process (SCRMP). Supply Chain Manage. 2011;16(6):474–483. doi:10.1108/13598541111171165

61. Rathore R, Thakkar JJ, Jha JK. A quantitative risk assessment meth- odology and evaluation of food supply chain. Int J Logistics Manage. 2017;28(4):1272–1293. doi:10.1108/IJLM-08-2016-0198

62. Simsekler MCE, Ward JR, Clarkson PJ. Evaluation of system map- ping approaches in identifying patient safety risks. Int J Qual Health Care. 2018;30(3):227–233. doi:10.1093/intqhc/mzx176

63. Kumar S,J, Himes K,P, Kritzer C. Risk assessment and operational approaches to managing risk in global supply chains. J Manufactur Technol Manage. 2014;25(6):873–890. doi:10.1108/JMTM-04-2012-0044

64. Card AJ, Simsekler MCE, Clark M, Ward JR, Clarkson PJ. Use of the Generating Options for Active Risk Control (GO-ARC) technique can lead to more robust risk control options. Int J Risk Saf Med. 2014;26(4):199–211. doi:10.3233/JRS-140636

Ferdosi et al Dovepress

submit your manuscript | www.dovepress.com

DovePress Risk Management and Healthcare Policy 2020:13242

R

is k

M an

ag em

en t a

nd H

ea lth

ca re

P ol

ic y

do w

nl oa

de d

fr om

h ttp

s: //w

w w

.d ov

ep re

ss .c

om / b

y 16

5. 21

5. 20

9. 15

o n

18 -A

pr -2

02 0

F or

p er

so na

l u se

o nl

y.

Powered by TCPDF (www.tcpdf.org)

1 / 1

28. Parand A, Faiella G, Franklin BD, et al. A prospective risk assess- ment of informal carers� medication administration errors within the domiciliary setting. Ergonomics. 2018;61(1):104�121. doi:10.1080/ 00140139.2017.1330491

29. Sendlhofer G, Brunner G, Tax C, et al. Systematic implementation of clinical risk management in a large university hospital: the impact of risk managers. Wien Klin Wochenschr. 2015;127(1�2):1�11. doi:10.1007/s00508-014-0620-7

30. Lopez F, Bartolo CD, Piazza T, et al. A quality risk management model approach for cell therapy manufacturing. Risk Anal. 2010;30 (12):1857�1871. doi:10.1111/j.1539-6924.2010.01465.x

31. Emblemsv￥g J, Endre Kj￸lstad L. Strategic risk analysis�a field version. Manage Decision. 2002;40(9):842�852. doi:10.1108/ 00251740210441063

32. Jaberidoost M, Olfat L, Hosseini A, et al. Pharmaceutical supply chain risk assessment in Iran using analytic hierarchy process (AHP) and simple additive weighting (SAW) methods. J Pharm Policy Pract. 2015;8(1):9. doi:10.1186/s40545-015-0029-3

33. Wierenga PC, Lie-a-huen L, de Rooij SE, Klazinga NS, Guchelaar H- J, Smorenburg SM. Application of the bow-tie model in medication safety risk analysis. Drug Saf. 2009;32(8):663�673. doi:10.2165/ 00002018-200932080-00005

34. Niel-lain￩ J, Martelli N, Bonan B, et al. Interest of the preliminary risk analysis method in a central sterile supply department. BMJQual Saf. 2011;20:698�773. doi:10.1136/bmjqs.2010.048074

35. Trucco P, Cavallin M. A quantitative approach to clinical risk assess- ment: the CREA method. SafSci. 2006;44(6):491�513. doi:10.1016/j. ssci.2006.01.003

36. Simsekler ME, Ward JR, Clarkson PJ. Design for patient safety: a systems-based risk identification framework. Ergonomics. 2018;61 (8):1�19. doi:10.1080/00140139.2018.1437224

37. Bonnabry P, Cingria L, Sadeghipour F, Ing H, Fonzo-christe C, Pfister R. Use of a systematic risk analysis method to improve safety in the production of paediatric parenteral nutrition solutions. BMJ Qual Saf. 2005;14(2):93�98. doi:10.1136/qshc.2003.007914

39. DomaDski J. Risk categories and risk management processes in non- profit organizations. Found Manage. 2016;8(1):227�242. doi:10.1515/ fman-2016-0018

40. Ramkumar M. A modified ANP and fuzzy inference system based approach for risk assessment of in-house and third party e-procurement systems. Strategic Outsourcing. 2016;9(2):159�188. doi:10.1108/SO-12-2015-0030

41. Beauchamp-Akatova E, Curran R. From initial risk assessments to system risk management. J Model Manage. 2013;8(3):262�289. doi:10.1108/JM2-01-2011-0008

42. Faiella G, Parand A, Franklin BD, et al. Expanding healthcare failure mode and effect analysis: a composite proactive risk analysis approach. Reliab Eng Sys Safety. 2018;169:117�126. doi:10.1016/j. ress.2017.08.003

43. Usman Tariq M. A Six Sigma based risk management framework for hand- ling undesired effects associated with delays in project completion. Int JLean Six Sigma. 2013;4(3):265�279. doi:10.1108/IJLSS-05-2013-0028

44. Famiyeh S, Adaku E, Kissi-mensah L, Amoatey CT. Risk management for a tailings re-mining project in Ghana. Int JManaging Proj Business. 2015;8 (2):241�255. doi:10.1108/IJMPB-04-2014-0033

45. Choo BS-Y, Goh JC-L. Pragmatic adaptation of the ISO 31000: 2009 enterprise risk management framework in a high-tech organization using Six Sigma. Int J Account Inf Manage. 2015;23(4):364�382. doi:10.1108/IJAIM-12-2014-0079

46. Apostolopoulos C, Halikias G, Maroukian K, Tsaramirsis G. Facilitating organisational decision making: a change risk assessment model case study. J Model Manage. 2016;11(2):694�721. doi:10.1108/JM2-05-2014-0035

47. Delcea C, Ioana-alexandra B. Fostering risk management in health- care units using grey systems theory. Grey Syst. 2016;6(2):216�232. doi:10.1108/GS-12-2015-0078

48. Abdi Z, Ravaghi H, Abbasi M, Delgoshaei B, Esfandiari S. Application of Bow-tie methodology to improve patient safety. Int J Health Care Qual Assur. 2016;29(4):425�440. doi:10.1108/IJHCQA-10-2015-0121

49. Chu K-C, Hung L-P. Adaptive failure identification for healthcare risk analysis and its application on E-healthcare. J Appl Math. 2014;2014:1�17. doi:10.1155/2014/865241

50. Prijatelj V, Rajkovi V, `uaterai O. Amodel for risk assessment in health care using a health care failure method and effect analysis. Slovenian J Public Health. 2013;52(4):316�331. doi:10.2478/sjph-2013-0032

51. Kerckhoffs MC, van der Sluijs AF, Binnekade JM, Dongelmans DA. Improving patient safety in the ICUby prospective identification ofmissing safety barriers using the bow-tie prospective risk analysis model. JPatient Saf. 2013;9(3):154�159. doi:10.1097/PTS.0b013e318288a476

52. Vahidnia S, Tanr1￶ver ￖￖ, Askerzade I. An early phase software project risk assessment support method for emergent software organizations. Int J Advan Comp Sci Appl. 2017;8(5):105�118. doi:10.14569/IJACSA.2017.080514

53. Leung F, Isaacs F. Risk management in public sector research: approach and lessons learned at a national research organization. R&d Manage. 2008;38(5):510�519. doi:10.1111/radm.2008.38.issue-5

54. Zeng Y, Skibniewski MJ. Risk assessment for enterprise resource planning (ERP) system implementations: a fault tree analysis approach. Enterprise InfSyst. 2013;7(3):332�353. doi:10.1080/17517575.2012.690049

55. Simsekler ME, Card AJ, Ruggeri K, Ward JR, Clarkson PJ. A comparison of the methods used to support risk identification for patient safety in one UK NHS foundation trust. Clin Risk. 2015;21 (2�3):37�46. doi:10.1177/1356262215580224

56. Jun GT, Ward J, Clarkson PJ. Systems modelling approaches to the design of safe healthcare delivery: ease of use and usefulness per- ceived by healthcare workers. Ergonomics. 2010;53(7):829�847. doi:10.1080/00140139.2010.489653

57. Potts HW, Anderson JE, Colligan L, Leach P, Davis S, Berman J. Assessing the validity of prospective hazard analysis methods: a comparison of two techniques. BMC Health Serv Res. 2014;14 (1):41. doi:10.1186/1472-6963-14-41

58. Kessels-Habraken M, Van der Schaaf T, De Jonge J, Rutte C, Kerkvliet K. Integration of prospective and retrospective methods for risk analysis in hospitals. Int J Qual Health Care. 2009;21 (6):427�432. doi:10.1093/intqhc/mzp043

59. Kayis B, Zhou M, Savci S, et al. IRMAS�development of a risk management tool for collaborative multi-site, multi-partner new pro- duct development projects. J Manufactur Technol Manage. 2007;18 (4):387�414. doi:10.1108/17410380710743770

60. Tummala R, Schoenherr T. Assessing and managing risks using the supply chain risk management process (SCRMP). Supply Chain Manage. 2011;16(6):474�483. doi:10.1108/13598541111171165

61. Rathore R, Thakkar JJ, Jha JK. A quantitative risk assessment meth- odology and evaluation of food supply chain. Int J Logistics Manage. 2017;28(4):1272�1293. doi:10.1108/IJLM-08-2016-0198

62. Simsekler MCE, Ward JR, Clarkson PJ. Evaluation of system map- ping approaches in identifying patient safety risks. Int J Qual Health Care. 2018;30(3):227�233. doi:10.1093/intqhc/mzx176

63. Kumar S,J, Himes K,P, Kritzer C. Risk assessment and operational approaches to managing risk in global supply chains. J Manufactur TechnolManage. 2014;25(6):873�890. doi:10.1108/JMTM-04-2012-0044

64. Card AJ, Simsekler MCE, Clark M, Ward JR, Clarkson PJ. Use of the Generating Options for Active Risk Control (GO-ARC) technique can lead to more robust risk control options. Int J Risk Saf Med. 2014;26(4):199�211. doi:10.3233/JRS-140636

Risk Management and Healthcare Policy Dovepress Publish your work in this journal Risk Management and Healthcare Policy is an international, peer- reviewed, open access journal focusing on all aspects of public health, policy, and preventative measures to promote good health and improve morbidity and mortality in the population. The journal welcomes submitted papers covering original research, basic science, clinical & epidemiological studies, reviews and evaluations,

guidelines, expert opinion and commentary, case reports and extended reports. The manuscript management system is completely online and includes a very quick and fair peer-review system, which is all easy to use. Visit http://www.dovepress.com/testimonials.php to read real quotes from published authors.

Submit your manuscript here: https://www.dovepress.com/risk-management-and-healthcare-policy-journal

Dovepress Ferdosi et al

Risk Management and Healthcare Policy 2020:13 submit your manuscript | www.dovepress.com

DovePress 243

R

is k

M an

ag em

en t a

nd H

ea lth

ca re

P ol

ic y

do w

nl oa

de d

fr om

h ttp

s: //w

w w

.d ov

ep re

ss .c

om / b

y 16

5. 21

5. 20

9. 15

o n

18 -A

pr -2

02 0

F or

p er

so na

l u se

o nl

y.

Powered by TCPDF (www.tcpdf.org)

1 / 1

Risk Management and Healthcare Policy is an international, peer- reviewed, open access journal focusing on all aspects of public health, policy, and preventative measures to promote good health and improve morbidity and mortality in the population. The journal welcomes submitted papers covering original research, basic science, clinical & epidemiological studies, reviews and evaluations, guidelines, expert opinion and commentary, case reports and extended reports. The manuscript management system is completely online and includes a very quick and fair peer-review system, which is all easy to use. Visit http://www.dovepress.com/testimonials.php to read real quotes from published authors.

Submit your manuscript here: https://www.dovepress.com/risk-management-and-healthcare-policy-journal

© 2020. This work is licensed under https://creativecommons.org/licenses/by-nc/3.0/ (the “License”).

Notwithstanding the ProQuest Terms and Conditions, you may use this content in accordance with the terms of the License.

ﾩ 2020. This work is licensed under https://creativecommons.org/licenses/by-nc/3.0/ (the �License�). Notwithstanding the ProQuest Terms and Conditions, you may use this content in accordance with the terms of the License.