1. Risk Management
Infection prevention and control (IP&C) professionals have, amongst other things, duty to identify unsafe and hazardous IP&C practices and also to recommend cost-effective preventive measures and help health care facilities set priorities. This can be achieved by applying the concepts of risk management.

2. Objectives
Identify the four stages of risk management for infection prevention and control.
Develop a system for setting priorities for action based on risk management.
December 1, 2013

3. Time involved
40 minutes
December 1, 2013

4. Risk Management
Risk is defined as ‘possibility of incurring misfortune and loss’
Primary aim of risk management is
Proactive
Reduction of risks to the lowest level that is “reasonably practicable”
Ongoing process
December 1, 2013
Risk management is the identification, assessment, and prioritisation of risks followed by coordinated and economical application of resources to minimise, monitor, and control the probability and/or impact of unfortunate events or to maximise the realisation of opportunities.
The strategies to manage risk typically include transferring the risk to another party, avoiding the risk, reducing the negative effect or probability of the risk, or even accepting some or all of the potential or actual consequences of a particular risk.
In any industry, risk management addresses liability, both proactively and reactively. Risk management in health care considers patient safety, quality assurance and patients’ rights.
In the context of this presentation, risk management is the basis for preventing and reducing harms arising from healthcare-associated infection. 4

5. Risk Management
By applying concepts of risk management, the Infection Control Team can help healthcare facilities set priorities
Aim is to
Identify unsafe and hazardous practices
Recommend cost effective preventive measures
December 1, 2013
As healthcare settings differ greatly in their day-to-day function, it is not possible to provide a one size fits all approach to risk management. Even within a single setting (e.g. primary care), increasingly complex care is delivered by a range of health professionals with diverse qualifications and training. All healthcare facilities need to be able to determine the risks in their own context and select the appropriate course of action. Unsafe practices must be assessed for severity and frequency.
Examples of adverse events in health care are unexpected death, failure to diagnose or treat disease, surgical mistakes or accidents.

6. Risk Management
This approach can also be used for hazards or risks that arise from the environment or equipment, as well as patient-related risks
December 1, 2013
In IP&C, risk can be biological agents that have potential to cause infection or a mechanism that allows the transmission of an infectious agent to occur. 6

7. Four Stages of Risk Management
Risk identification
Risk analysis
Risk control
Risk monitoring
December 1, 2013
A stepwise approach to risk management allows continuous quality improvement and involves:
1- Risk Identification:-
This is the first and the most important step of risk management. One cannot do anything with the risk unless and until that risk has been clearly identified. Risk identification starts from where the problem originates. Risk identification can be objective based, scenario based, taxonomy based and common risk checking.
2- Risk Analysis:-
Risk analysis includes analysing the risk and measuring its vulnerability or its impact. Frequency and severity of the risk will be analysed as well.
3- Risk Control:-
After analysing the risk then decided that how can the risk be controlled. Risk control is the entire process of procedures, systems, policies an organisation needs to manage prudently for all the risks which are arising.
4- Risk Monitoring:-
It should be monitored that the desired results of the risk management are being achieved or not and if not then identifying that where the problem occurred.

8. Risk Identification
Identify tasks and activities that put patients, healthcare workers & visitors at risk
Identify the infectious agent(s) involved
Identify the mode of transmission
December 1, 2013
First you need to work out how people could be harmed. The aim of risk identification is to identify common problems/practices that have impact on a large number of patients or rarer problems which can cause severe infection or even death. Once the risk is identified, it has to be proven through an investigation and can involve observational or experimental studies. 8

9. Risk Analysis Why are infections happening?
How frequently they are happening?
What are the likely consequences if the appropriate action is not taken?
How much they are likely to cost to prevent it?
December 1, 2013
Having spotted the hazards, you then have to decide what to do about them. Analysis will help in this process. Consider the sources of risk, their consequences, the likelihood that those consequences may occur, and factors that affect consequences and likelihood (e.g. existing controls). 9

10. Evaluating risks
Compare level of risk found during the analysis process with previously established risk criteria
Using statistical analysis
Type I
Type II
Type III
December 1, 2013
Comparing the level of risk found during the analysis process with previously established risk criteria and assessing available options for ease of implementation and impact, resulting in a prioritised list of risks for further action.
These error terms are used to refer to flaws in reasoning. When comparing probability of risks using statistical tests, error testing can help determine the proper direction.
Statistical error is an integral part of testing hypotheses. The test requires an unambiguous statement of a null hypothesis. An alternative hypothesis is the negation of null hypothesis. The result of the test may be negative, relative to null hypothesis or positive. If the result of the test corresponds with reality, then a correct decision has been made. However, if the result of the test does not correspond with reality, then an error has occurred. Due to the statistical nature of a test, the result is never, except in very rare cases, free of error.

11. Why Are They Happening? - Type I Error
December 1, 2013
Sources of performance deficit
These occur due to an act of omission
Example: failure to comply with current professionally accepted practice
Could be due to:
Lack of knowledge
Inadequate provision of education, training and supervision
Lack of communication
Lack of availability/regular supply of goods
Lack of knowledge is the basic cause of type I error. In low resource settings, the lack of availability of goods is a frequent contributor to type I error.
A type I error is the incorrect rejection of a true null hypothesis. A type I error is a false positive. Usually a type I error leads one to conclude that a thing or relationship exists when really it doesn't, for example, that a patient has a disease being tested for when really the patient does not have the disease, or that a medical treatment cures a disease when really it doesn't.
A Type I error occurs when there really is no difference (association, correlation..) overall, but random sampling caused your data to show a statistically significant difference (association, correlation...). So your conclusion that the two groups are really different (associated, correlated) is an error.

12. Why Are They Happening? - Type II Error
December 1, 2013
Sources of performance deficit
These occur due to an act of commission
an act should not have been committed
Could be due to:
Lack of commitment
Lack of consideration for others
A type II error is the failure to reject a false null hypothesis. A type II error is a false negative. Examples of type II errors would be a blood test failing to detect the disease it was designed to detect, in a patient who really has the disease; or a clinical trial of a medical treatment failing to show that the treatment works when really it does.
A Type II error occurs when there really is a difference (association, correlation) overall, but random sampling caused your data to not show a statistically significant difference. So your conclusion that the two groups are not really different is an error.
This is more complex and may also require management reinforcement

13. Why Are They Happening? – Type III Error
December 1, 2013
Occurs when we fail to understand the true nature of the problem
Real solutions are adopted to deal with the wrong problems, rather than incorrect solutions to real problems
Often due to lack of communication or misinterpretation of information
A Type III error occurs when you get the right answer to the wrong question. Another definition is that a Type III error occurs when you correctly conclude that the two groups are statistically different, but you are wrong about the direction of the difference.

14. How frequently are they happening?
December 1, 2013
This is quantitative information
Can be achieved by on-going surveillance or by prevalence study
Frequency can be measured as the percentage or rate of persons who developed infection
If there are no infection data, probability can be used instead
The notion of risk is basically a combination of two concepts: probability and severity. That is, we decide how risky something is by asking two questions:
● How likely is this to happen? (probability, likelihood)
● How bad would it be if this did happen? (severity, consequences)
The fundamental difficulty in risk assessment is determining the rate of occurrence since statistical information is not available on all kinds of past incidents. Furthermore, evaluating the severity of the consequences (impact) is often quite difficult. Infection data can be gathered from other sources: as a part of outbreak investigation, local prevalence data, data published in the literature, or clinical evidence.

15. Risk Probability - Frequency
Rating
Probability
Comments 4
1: 10
Almost certain or very likely to occur 3
1: 100
Highly probable that they will occur. 2
1: 1000
It is possible that they may occasionally occur 1
≥ 1: 10000
They are rare and do not believe/expect to occur
December 1, 2013
If there is no local data, this probability is based on the clinical evidence and literature data and is very important for planning risk control action.

16. What are the likely consequences?
December 1, 2013
Consequences are expressed by severity
Severity is measured by morbidity/mortality of infection involved
Very important (maybe the most important) point in risk analysis are potential consequences of the risk involved, or severity of the risk if no action is taken. The severity risk is shown in the next slide.

17. Risk Probability - Severity
Rating
Description
Consequence/Impact
Comments
20-30
High or major
Major impact on patient which may lead to death or long term consequences
Urgent action is required
10-19
Moderate
Moderate impact which may lead to short term consequences
Action required
1-9
Low risk or minor
Minimum impact with no or minor consequences
Keep under review
December 1, 2013

18. Prioritising Risks December 1, 2013
This is a matrix that is used to define the various levels of risk as the product of the harm probability categories and harm severity categories. This is a simple mechanism to increase visibility of risks and assist management decision making.
You calculate what levels of risk you can take with different events. This would be done by weighing up the risk of an event occurring against the cost to implement safety and the benefit gained from it.
Combining risk severity and risk frequency you are very near to make your priorities. You only need to add a „moderate” row/column to this table if necessary in your identified risk. Or, you can grade the probability to even more grades (almost certain, likely, possible, unlikely, rare), and consequences to insignificant, minor, moderate, major and extreme – in that case you will have more detailed risk assessment to critical risk (stop activity!), high risk (stop activity!), moderate risk and low risk.
Another matrix example – at

19. Calculating Risk
Risk Factor = Frequency (Probability) X Consequence (Impact) Surveillance data provides probability or frequency of infection from a task or a procedure Risk assessment provides impact or consequence to patient as a result of a task or a procedure
December 1, 2013
Composite Risk Index = Impact of Risk event x Probability of Occurrence
The impact of the risk event is commonly assessed on a scale of 1 to 5, where 1 and 5 represent the minimum and maximum possible impact of an occurrence of a risk (usually in terms of financial losses). However, the 1 to 5 scale can be arbitrary and need not be on a linear scale.
The probability of occurrence is likewise commonly assessed on a scale from 1 to 5, where 1 represents a very low probability of the risk event actually occurring while 5 represents a very high probability of occurrence. Again, the 1 to 5 scale can be arbitrary or non-linear depending on decisions by subject-matter experts. 19

20. How much does it cost to prevent ?
December 1, 2013
Estimated cost is important as it helps to target IP&C resources to specific procedure
where risk was identified
where they will deliver the greatest advantage in terms of preventing harm for patients
Often it is not possible to have exact cost estimated cost is acceptable

21. Priorities for action
Once all information on the severity, frequency of occurrence and cost of prevention are available
Priorities for action can be calculating as follows:
RISK RATING = SEVERITY x FREQUENCY
December 1, 2013
Risk rating with the highest score would merit immediate attention. Calculation of the risk rating helps IP&C team set priorities in the most effective way.
Risk mitigation measures are usually formulated according to one or more of the following major risk options, which are:
Design a new business process with adequate built-in risk control and containment measures from the start.
Periodically re-assess risks that are accepted in ongoing processes as a normal feature of operations and modify mitigation measures.
Transfer risks to an external agency (e.g. an insurance company).
Avoid risks altogether.

22. Priority for Action December 1, 2013
You can put in this diagram different values and will have different priorities. Even very costly but severe and frequent risk will merit action, so cost is not key factor for critical and high risk tasks/procedures.

23. Risk Control - 1
Put an agreed risk reduction plan in place in the problem area
Eliminate risk, if possible
Reduce risk to acceptable level, if needed
Transfer risk to a third party
May need to accept risk in short term
December 1, 2013
Once the risk analysis has been completed, review the possible solutions. Ideal situation is complete elimination and thus avoiding of identified risk, but this is not possible in every situation. So the risk could be reduced, transferred to third party or sometimes (if low risk) could be accepted.

24. Risk Control : Think possible solutions !
Identify Risks
December 1, 2013 ↓
Control
Avoid
Prevent
Transfer
Accept
Analyse
(Evaluate & Rank) ↓
Risk Control : Think possible solutions !
How they can be avoided eg minimize/avoid use of sharps
How they can be prevented eg use aseptic techniques
Can it be transferred eg outsource waste management
Can you accept it eg low risk/high cost intervention

25. Risk Monitoring Feedback and reporting
To ensure that risk reduction plans are followed
Performed by
regular audit
process surveillance
outcome surveillance
Feedback provided to relevant staff and senior management
December 1, 2013
Once appropriate measures are in place to reduce risk, it is essential to monitor their effectiveness.
Monitoring and review is an essential component of the risk-management process. This ensures that:
new risks are identified;
analysis of risk is verified against real data, if possible; and
risk treatment is implemented effectively.

26. The audit process Audit process can identify infection risks
When risk reduction plan in process, audit can
identify new risks
analyse risk against evidence-based practice
identify any gaps in practice
Key elements of the audit process
communication
consultation
timely feedback
December 1, 2013
Audits can be performed by reviewing of documentation (guidelines, reports of previous audits), interviewing staff to assess their knowledge and practice, and observational visits to the wards using validated audit tool.

27. Summary: Risk Management
December 1, 2013
Risk management should:
create value – resources expended to mitigate risk should be less than the consequence of inaction, or the gain should exceed the pain
be an integral part of organisational processes
be part of decision making process
explicitly address uncertainty and assumptions
be systematic and structured
be based on the best available information
be tailorable
take human factors into account
be transparent and inclusive
be dynamic, iterative and responsive to change
be capable of continual improvement and enhancement
be continually or periodically re-assessed

28. References
Roberts G. Risk Management in Healthcare. 2nd ed. London: Witherby & Co. 2002
Australian Standard: Risk management.AS/N2S 4360:
Australian Guidelines for the Prevention and Control of Infection in Healthcare (2010)
December 1, 2013

29. Quiz
Risk management is a retroactive approach and its aim is to minimise harm. T/F
In setting priorities for action, which of these is needed?
Severity or consequences
Frequency
Cost of implementing plans
All of the above  
December 1, 2013
False D

30. International Federation of Infection Control
IFIC’s mission is to facilitate international networking in order to improve the prevention and control of healthcare associated infections worldwide. It is an umbrella organisation of societies and associations of healthcare professionals in infection control and related fields across the globe .
The goal of IFIC is to minimise the risk of infection within healthcare settings through development of a network of infection control organisations for communication, consensus building, education and sharing expertise.
For more information go to
December 1, 2013