Risk Management and Safety in Health Care Organizations

Transcription

1 Risk Management and Safety in Health Care Organizations Fadi El-Jardali, MPH, PhD October 2016 Day 1 1

2 Objectives to increase the knowledge to effectively implement risk management and safety approaches and tools to prepare participants to develop risk management and safety plan for your organizations. provide participants with hands on experience and practical knowledge on risk management and safety in hospitals 2

3 Learning outcomes Understand the system approach related Risk Management and Safety in health organizations develop the knowledge regarding different type of risks in the health care organizations Understand and apply the risk management steps including identifying, analyzing, evaluating, treating, monitoring and communicating risk Conduct risk assessment using the Severity Assessment Code (SAC) score 3

4 Learning Outcomes (Cont d) Apply skills to implement common tools for identifying and addressing the root causes of critical incidences in organizations Failure mode and effects analysis (FMEA) Apply incident reporting and investigation by using the incident reporting system Develop skills to fill incident report Develop corrective action plan based on risk quantification results Apply skills on HOW to effectively develop, implement a risk management and safety plan Devise strategies to implementing the plan Identify indicators for risk management and safety plans to measure successes 4

5 When you usually get to the end of the day, you always find two things 1. You didn t accomplish everything you imagined you would. 2. Your day wasn t anything like how you d imagined.

6 This distinction between Work as Imagined (WAI) and Work As Done (WAD) is everywhere Thanks to Drs. Jeffrey Braithwaite and David Marx

7 What they do seems perfectly logical, obvious and feasible.

8 In health care, those doing WAI have designed, mandated or encouraged a bewildering range of tools, techniques and methods, to reduce harm to patients.

9 E.g., root cause analysis, hand hygiene campaigns, failure modes effects analysis... And there s lots of others

10 But the rate of harm has flatlined at 10%

11 Meanwhile work is getting done, often despite all the policies, rules and mandates

12 WAD workarounds

13 WAD fragmentation Doctors in Emergency Departments in a study: Were interrupted 6.6 times per hour. Were interrupted in 11% of all tasks. Multitasked for 12.8% of the time.

14 Doctors in Emergency Departments in a study: Spent on average 1:26 minutes on any one task. When interrupted, spent more time on tasks. And failed to return to approximately 18.5% of interrupted tasks.

15 So work-as-imagined often have some sort of linear, mechanistic view of the system.

16 Instead, health care is a complex adaptive system delivered by people on the front line who flex and adjust to the circumstances.

17 The amazing thing about health care isn t that it produces adverse events in 10% of all cases, but that it produces safe care in 90% of cases.

18 Few people have ever looked at why things go right so often

19 What none of them know is that there are 600+ policies in operation right now, meant to guide their work.

20 Then when we observe their behaviours and see them taking patients histories, or giving out medications, or doing procedures, or taking x-rays of patients, or tending to their needs, or caring for them

21 We can notice instead a lot of fraught, timepressed, relentlessly busy work going on virtually across the entire shift.

22 Sometimes it never, ever unfolds like a policy or procedure says it should.

23 So, health care doesn t look like this.

24 It looks like this.

25 And therefore the only real solution is to try and reconcile work-asimagined and work-as-done.

26 A health system where the work-asimagined policies, regulations, standards etc are much closer to an understanding of how work is actually done.

27 SUBWAY SAFETY NEW YORK CITY

28 THE PROBLEM, AND THE SOLUTION

29 WHAT ABOUT BETTER SYSTEM DESIGN?

30 YET, IT S NOT ONLY ABOUT SYSTEM DESIGN

31 Architecture examples

32 FOCUSING ON THE RIGHT THINGS Ø Monitor it all Ø But actively manage: System Design Safety Culture

33 SAFETY How do we prevent backing over a child?

34 Solutions TECHNOLOGICAL SYSTEMS Backup camera Backup sensor with automatic breaking Backup horn PROCEDURAL SYSTEMS Walk around back of car before getting in Use a spotter Yet, the most simple of steps, the walk around, most drivers do not do Is that our culture?

35 An Organization s Goal Should Be To prevent or minimize risk of harm to patients, staff, visitors, and volunteers, thereby reducing or eliminating any potential losses including financial ones Risk Management is about harm reduction which could be achieved by risk identification, risk assessment, risk control and evaluation 35

36 Risk Management in Healthcare Institutions Risk management in the healthcare industry is increasingly becoming an important area of concern for hospital governing boards, administrators, medical practitioners, insurers, consumer organizations and other key stakeholders. Hospitals, medical institutions and medical professionals must take pro active actions to ensure the minimization and elimination of medical errors Risk management in health care emerged as a result of the malpractice crisis of the 1970s. 36

37 Risk Management in Healthcare Institutions Objectives of include: The delivery of safe and quality healthcare to patients Ensuring safety among patients, staff and visitors Identifying and controlling hazards and injuries Protection of assets and other resources 37

38 Risk Management is a Proactive Strategy Its components include: Risk identification Risk assessment Risk control Evaluation of risk management activities 38

39 Evaluation of Risk Management Activities Organizations should regularly ask itself: How effective is our risk management system? Organization s risk management practices need to be evaluated. This includes: Reviewing the frequency and severity of losses Analyzing incident and occurrence trends Reviewing policies and procedures that might prevent or minimize risk Assessing new or increased risk Assessing the effectiveness of risk management education and communication strategies 39

40 We cannot change the human condition, but we can change the conditions under which humans work. (Reason 2000) 40

41 Exercise Identify patient safety issues in your organization 41

42 From a Traditional View to a System Approach Person approach to patient safety (practitioner as potential culprit to be blamed) System approach to patient safety 42

43 Some Reasons Why Errors Occur System Factors Complexity of health care processes Complexity of health care work environments Lack of consistent administration practices Deferred maintenance Clumsy technology Human Factors Limited knowledge Poor application of knowledge Fatigue Sub-optimal teamwork Attention distraction Inadequate training Reliance on memory Poor handwriting 43

44 Multi-Causal Theory Swiss Cheese diagram (Reason, 1991) Triggers Lack of Procedures Punitive policies Production Pressures Mixed Messages Zero fault tolerance Sporadic Training Attention Distractions Deferred Maintenance Clumsy Technology DEFENSES Adverse Event 44

45 The Swiss Cheese Model of Accident Causation Organizational Factors w Untested Equipment w Changing Patient Population Procedures wtailored to fit wis Support Communication Patterns w Loss of Situational Awareness w Method of Report Failures in the System Environment wlayout of Unit wnoise Level 45

46 Two Ends of Health Care Systems PATIENT Sharp End Practitioners Tools of the Trade Physical Infrastructure Health Plans, Payers Blunt End Regulations... Financing, policies

47 Quality & Safety Framework Continuous Assessment DEFENCES Report Survey Selfassessment THE GAPS Standard s External Review 47 Safe System Sustaining Improvement Priority Areas for Action Adapted from J. Reason

48 No Quality & Safety Framework DEFENCES Assessment Standards Continuous Improvement Identification THE GAPS Goals? Measurement? 48 Unsafe System Risk Management? Sustaining Improvements? Adapted from J. Reason

49 Life at the Sharp End PATIENT SAFETY TRIGGER (wrong drug prescribed) 1 st Defense (distracted nurse) 2 nd Defense (pharmacy) 3 rd Defense (another distracted nurse) Latent failure (understaffing) Latent failure (no Rx tracking) Latent failure (understaffing) 49 EVENT

50 Life at the Sharp End TRIGGER (wrong drug prescribed) 50 1 st Defense (distracted nurse) 2 nd Defense (pharmacy) 3 rd Defense (vigilant nurse) Adverse Event Averted Latent failure (understaffing) Latent failure (no Rx tracking) Latent failure (understaffing) Sources: Reason J Human error: Models and Management, BMJ, 18 March Cook R. University of Chicago,

51 Life at the Sharp End Standardized approaches can reduce variability and improve system efficiency TRIGGER (wrong drug prescribed) 1 st Defense Template Adverse Event Averted 51

52 What is the difference between focusing on the person and focusing on the system? Person approach Focus on individuals Blaming individuals for forgetfulness, inattention, or carelessness, poor production Methods: poster campaigns, writing another procedure, disciplinary measures, threat of litigation, retraining, blaming and shaming Target: Individuals System approach Focus on the conditions under which individuals work Building defenses to avert errors/poor productivity or mitigate their effects Methods: creating better systems Targets: System (team, tasks, workplace, organization) 52

53 System Approach to Human Error Humans are fallible and errors are to be expected, even in the best organisations. Focus: conditions under which individuals work 53

54 System Approach to Human Error Counter-measures based on assumption that though we cannot change the human condition, we can change the conditions under which humans work by building system defences to avert errors or mitigate their effect When an adverse event occurs, the important issue is not who blundered, but how and why the defences failed. 54

55 Errors are inevitable.but most are preventable 55

56 Not Who caused the accident but What caused the accident? Medical errors most often result from a complex interplay of multiple factors. Only rarely are they due to the carelessness or misconduct of single individuals. Lucien L. Leape, M.D. 56

57 We cannot change the human condition, but we can change the conditions under which humans work. (Reason 2000) 57

58 Questions Surveyors Might Ask Is there a reporting policy and process for actual and potential adverse events? Are improvements made following incident investigation and follow-up 58

59 Risk Management Focus on the system rather than the individual incident Is anticipatory not reactive in emphasis Incident investigation and reporting supports risk management by monitoring it 59

60 concepts--- Hazard versus Risk Safety culture & the elements of a safe and healthy work environment Classification (categorization) of hazards in a hospital The individual versus the work environment (Who is our concern?) 60

61 I. Hazard vs. Risk- 1 Hazard is any activity, situation or, substance that can cause harm. It is a potential source of risk. Risk is the probability (odds) of a hazard causing harm. 61

62 What is Risk? The chance of something happening that will have an impact on the objectives. It is measured in terms of consequences and likelihood 62

63 What is Risk? Risk is the possibility of exposure to such factors as financial loss, physical damage, injury or delay as a consequence of action or a lack of it. The level of risk exposure is the combination of the likelihood of risk occurring and consequences if it does occur. 63

64 What is Risk? Risks and their consequences might include, but are not limited to: Breach of legal or contractual responsibility Breach of security A threat to physical safety An adverse event during the care process Deficiencies in financial controls and reporting Failure of a project to reach its objectives Failure of equipment or computer system Fraud Patient or family dissatisfaction Unfavorable publicity In any healthcare organization risks can arise from internal and external sources 64

65 Hazard vs. Risk- 2 Risk = Hazard x f (Exposure) 65

66 Describing risk the 3 C s Risk is inherently negative, implying the possibility of adverse consequences. 1. Describe the potential consequences if the risk were to materialise 2. Describe the causal factors that could make the risk materialise 3. Ensure that the context of the risk is clear, e.g. is the risk target well defined (e.g. staff, patient, department, hospital, etc.) and is the nature of the risk clear (e.g. financial, safety, physical loss, perception, etc.) 66

67 Which of the following are adequate descriptions of risk? Risk to patients due to errors and unsafe clinical practice caused by reduced skill base and competence of junior and middle grade medical staff Needlestick injury OSH Reduced staff retention and increased sickness absence due to reduction in morale caused by increased workload, pressure and stress to achieve targets Inadequate patient transfer Budget overrun and financial deficit due to cost of introducing new technologies/medicines as required by NICE guidance Medication error 67

68 Why Risk Management? The culture, process and structures that are directed towards the effective management of potential opportunities and adverse effects 68

69 69 Risk Management: The Reactive Versus Proactive approach Hypothetically a patient who receives medicine that causes a point of care false high blood sugar. The patient receives treatment for the high blood sugar and shortly thereafter experiences hypoglycemia, which leads to the patient coding. In a reactive system, the patient would be coded and would potentially have devastating injuries because the staff and physicians were unaware of this false high blood sugar. Adversely, in a proactive system, the staff and physicians would have been educated on this medication, thereby causing a repeat laboratory blood glucose level, which would have been normal. This normal level would have prevented the treatment, keeping the patient safe. By educating the staff and physicians, an adverse event causing patient harm was avoided.

70 Accreditation Requirements The hospital must have a documented risk management plan that includes but not limited to: Information Technology service loss Major equipment failure Credit withdrawal/loan arrangements from external financiers Staff negligence and malpractice, etc. 70

71 71 Healthcare Risk Categories

72 A. Patient Care-related Risks 1. Inappropriate or incorrectly performed medical treatment 2. Confidentiality and appropriate release of information 3. Protection from abuse, neglect and assault 4. Securing appropriate informed patient consent for treatment 5. Nondiscriminatory treatment 72

73 A. Patient Care-related Risks 6. Protection of patient valuables from loss or damage 7. Appropriate triage and transfer of patients from ER 8. Patient participation in research studies 9. Utilization review decisions (timing of discharge, provision of medically necessary services) 10. Access to care 73

74 B. Employee-related Risks 1. Occupational illness and injury Infections Exposure to toxic chemicals Electrical hazards Sprains and back injuries Burnout 2. Allegations of discrimination in recruitment, hiring, and promotion based on age, race, sex, national origin, disability; wrongful termination 3. Sexual harassment 4. Impaired physicians and other providers who pose a threat to patient or employee safety 74

75 C. Risks related to visitors 1. Infections 2. Injuries caused by slips, falls, and other mishaps 75

76 D. Property-related Risks 1. Buildings and valuable equipment: risk of losses due to fires, floods, etc 2. Paper and/or electronic records (patient, business and financial): risk of damage, destruction 3. Cash, cheques, valuables: risk of loss of theft 4. Property and liability losses due to operation of ambulances, trucks, cars owned or leased by the organization 76

77 E. Financial Risks 1. Risks associated with new ventures or services 2. Continued financial viability of organization's traditional services 3. Liability imposed from suits by stakeholders 77

78 Reducing harm by identifying and controlling hazards 78

79 What is a hazard? In safety, a HAZARD is anything that can put somebody or something at risk of damage or injury or harm. In medicine, hazards are called risk factors. 79

80 Why focus on hazards and harm? In medicine, if we want to reduce the incidence rate of a disease we Look for risk factors Figure out how they contribute to the disease Figure out how to reduce or eliminate the risk factor. In safety, if we want to reduce adverse events, we Look for hazards Figure out they contribute to the adverse events Figure out how to reduce or eliminate the hazard. 80

81 How do you identify safety hazards? Proactive techniques, such as Healthcare Failure Mode and Effect Analysis (preventive medicine) Focused upon complex, face-paced areas of the hospital Accomplished prior to implementing new software or new devices Reactive techniques, such as Root Cause Analysis (RCA) (acute care medicine) Based on reports of close calls Based on reports of injuries 81

82 How do you control hazards? CONTROL THEM so that they cannot do harm To control hazards, we prefer to follow the safety engineering hierarchy of hazard control Eliminate hazard Guard against hazard Train to avoid hazards Effectiveness Warn against hazard 82

83 Barriers, Controls and Defences 83 Human Action Barriers Administrative Barriers Physical Barriers Natural Barriers time, distance, placement Checking the drug dosage before administering Checking the temperature of a bath Protocols and procedures e.g. Implementation of a drug administration policy Supervision and training Lead apron for radiographers Bed side rails Isolation of MRSA patients (placement)

84 Contributory Factors 1. Individual factors 2. Team and social factors 3. Communication factors 4. Task factors 5. Education and training factors 6. Equipment and resources factors 7. Working conditions 8. Organizational and strategic factors 9. Patient factors 84

85 IV. Types (classes) of hazards Biological (infectious) Chemical Physical Ergonomic Psycho-social Health hazards Safety 85

86 Examples of hazards in a hospital Biological Chemical Physical Ergonomic Psychosocial Safety Hepatitis (B, C); Tuberculosis; HIV; Rubella Anti-neoplastics; Ethylene oxide; Anesthetic gases; Mercury; Asbestos; Formaldehyde Noise; Ionizing radiation; Laser Work stations; Lifting & manual handling Stress; Shift work; Violence Personal (Falls)/ Institutional (fire, explosions) 86

87 87 Risk perception

88 88 Risk perception

89 89 Risk perception

90 90

91 91

92 92

93 93

94 94 Daily Telegraph 20 August 2002

95 Clinicians Premature discharge of patients leading to death or poor outcome due to bed shortage Delay or missed diagnosis/treatment resulting in increased mortality & morbidity Risk of harming patients associated with invasive procedures Long waiting lists resulting in increased morbidity & complaints Medication error Harm to staff due to violent patients 95

96 Anaesthetists (1) Risk associated with equipment failure Risk associated with inadequate supervision of trainees Risk of giving the wrong drug to patient due to mislabeling Risk of overdosing patient Risk of making unsound judgement after long hours of duty 96

97 Anaesthetists (2) Risk of malfunctioning of resuscitation equipment due to lack of maintenance Risk of improper use of Level I rapid transfuser in emergency due to inadequate training Risk of staff injury and equipment failure due to cables & power cords lying on the OT floor Risk of injury to staff Bumping of head against theatre light Slip & fall after mopping of OR 97

98 Radiology/Pathology Risk associated with missing specimen or X ray films Patient Identification Medication, Xray & Path reports Miss labeling of specimen Risk associated with Equipment Maintenance & Validation Risk associated with Manual handling Risk associated with chemical waste handling Risk associated with understaffing 98

99 IT Concerns Non-human events: these events typically happen on an unpredictable basis without direct human influence local infrastructure failure: Emergency room is disconnected from the network backbone but some emergency help must be provided to patients. major industrial accidents: A large number of injuries must be treated while a power failure caused by that accident hinders provision of health care natural disasters: They may cause injury to the local community as well as to the local infrastructure. A power failure may hinder the operation of the medical equipment, but many injuries flood the emergency room at the same time. 99

100 24-Elements that Increase Risk in the ED: hour operation (someone has to work night shifts) EDs frequently operate in excess of capacity Patient-provider relationship not established ED patients are high acuity Multiple distractions to providers in the ED No provider continuity due to shift work Patients are stressed, not always in ED of own free will Long patient waits 100

101 Strategic challenges for Hospital Epidemics Resources availability Funding Beds Staffing People capacity Service expansion/demand New technology Evolution of cluster management 101

102 How to control hazards RISK MANAGEMENT For example, in the case of occupational health and safety (OHS): Hazard mapping Job safety (hazard) analysis 102

103 Example of Effective RISK MANAGEMENT (OHS related) Leadership and support, with a broader role for OHS committee (specialists) Developing knowledge, ability and motivation Solid, local understanding of OHS principles. Proactive, systematic and comprehensive identification of hazards, assessment and control of risks. Solutions to control risks 103

104 Steps in risk management Step 1 Step 2 Step 3 Step 4 Step 5 Identify hazards and hazardous jobs Assign priority for each hazard and hazardous job Assess the risk to find out exactly what makes it hazardous Work through the hazards and hazardous jobs in order of priority Control the risk(s) or fix the problem(s) Evaluate periodically to verify how successfully OHS risks are being managed 104

105 Hospital hazards by group at risk HAZARD Staff Patient Guest Biological Chemical Physical Ergonomic Psychosocial Safety 105

106 Who is the staff? Office workers Clerks on floors Physicians Physicians-in-training Medical students Nurses/ Midwives Nursing students Orderlies/nursing assistants Nursing supervisors Pharmacists Nutritionists Social workers Lab technologists Radiology technicians Protection officers Housekeeping Drivers Staff in laundry Staff in kitchen Staff in restaurants Mortician Technicians (electricity, painting, plumbing, mechanic) 106

107 How do we group people (staff)? Knowledge and Skill (What they know) Work Process (Process or activity) Business Function (Basic function in the organization) Time (When work is done shifts) Output (Service provided) Client/Patient (Type of patient) Place 107

108 Patient safety Fall protection Prevention of uncontrolled self injury No access or exposure to drugs, biohazards, radiation, or leftover needles No hospital-acquired infections Clear exit routes in case of emergencies Knowledge of where to report emergencies 108

109 Hospital hazards by department HAZARD Laboratory Operating room Biological Etc.. Chemical Physical Ergonomic Psychosocial Safety 109

110 110

111 111

112 112

113 113

114 Hazard mapping tool Name of staff/ officer: Work area Date Area Diagram Key Hazards Control measure

115 Hazard mapping chart Severity High Avoid Reduce/Prevent Moderate Transfer Low Retain 115 Almost never Slight Moderate Severe Frequency

116 Job Hazard (Safety) Analysis Best if employee is observed doing the job The job, not the individual, is being studied Clearly explained to the employee The work procedure is broken into several specific tasks Each separate task should be analyzed to complete a job safety analysis for that procedure The correct work procedure is presented in a step-by-step outline Employee who carries out the tasks should be consulted in developing the procedure 116

117 Control measures Engineering/ structural control Administrative changes Personal measures 117

118 Engineering/ structural control Assumption: Best not to depend on people for prevention but to change and redesign the work environment Examples: Hoods Anti-slippery floors Positive pressure ventilation Building codes Stairs, Light, Doors, Floor Disabled-friendly 118

119 Administrative control Training and awareness Maintenance Reduction of duration of exposure/ Rotating employees Modify job descriptions/ Change work practices Staff management Shift Relief 119

120 Personal measures Least effective and require ongoing training and awareness programs Use of gloves and goggles Proper disposal of needles and biohazards Use of proper masks and overalls Personal hygiene Washing hands is best method to control spread of infections in a hospital Abide by regulations such as no entry to radiology rooms 120

121 121 Eliminating and Controlling Hazards

122 122 Medical Units

123 Operating Room and Surgical Units 123

124 124 Emergency Rooms

125 125 Hazard Analysis and Control Sheet

126 Training General Workplace/ job specific 126

127 Orientation manual Commitment of hospital to health and safety of its employees, patients, and guests Orientation to different departments and activities in the hospital Analysis of potential hazards in one s job Options for prevention and control Access to information about hazards Incident and accident reporting 127

128 Topics for training Emergencies (e.g., fire) Work-related accidents Fall protection Hazardous material Ergonomics Bloodborne pathogen exposure Radiation Lab safety Personal protection 128

129 Hazard communication Inventories Material Safety Data Sheet Warning/ Signs and labels Containers Departments Exits Training Employee s right to know Procedure in case of emergency 129

130 130

131 Excercise 1. Think about yourself and your colleagues list 3 issues or concerns you have at work. 2. Now think about patients list 3 issues or concerns you might have in relation to the safety or quality of care provided to patients in your department, hospital, PHC, etc. 3. Finally, think about your organisation list 3 issues or concerns.. 131

132 Risk Management Process Systematic application of management policies, procedures and practices to the tasks of establishing the context, identifying, analyzing, evaluating, treating, monitoring and communicating risk 132

133 133 Risk Management Process

134 Risk Management Process: Phase 1. Establish the Context Establishing the context involves the following steps: 1. Establish the strategic context 2. Establish the organizational context 3. Establish risk management context 4. Develop risk evaluation criteria 5. Define the structure 134

135 Risk Management Process: Phase 2. Identify Risks) Comprehensive identification using a wellstructured systematic process is critical because a potential risk is not identified at this stage is excluded from further analysis and treatment. All risks should be identified whether or not they are under the control of the organization. 135

136

137

138 138

139 Information Sources for Risk Identification 1. Incident reporting 2. Generic occurrence screening 3. Patient complaints and satisfaction survey results 4. Claims data of prior professional liability, property and casualty, and workers compensation 139

140 Information Sources for Risk Identification 5. Surveys by accrediting bodies, insurers, or risk management consultants 6. Licensure surveys 7. Information from facility s infection control and quality improvement functions 8. Workplace inspections/audits 140

141 Information Sources for Risk Identification 1. Incident reporting 2. Generic occurrence screens 3. Patient complaints/satisfaction surveys 4. Claims 5. Accreditation/insurers surveys 6. Licensure surveys 7. Infection/QI reports 8. Workplace inspections/audits 9. Informal discussions 141

142 Risk Management Process: Phase 3. Analyze Risks The objectives of risk analysis are: Separate minor acceptable risks from major risks Provide data to assist in the evaluation and treatment of risks Risk analysis includes determining existing controls by identifying existing management, technical systems and procedures to control risks, and assess their strength and weaknesses. 142

143 Risk analysis is the process of determining the potential severity of the loss associated with an identified risk, and the probability that such a loss will occur 143

144 Severity Assessment Code (SAC) Adapted

145

146

147

148

149 SAC Consequence Score 1. Actual consequence 2. Potential consequence (worst case scenario if incident recurred) 149

150 Assessing the level of Risk Two elements are determined when assessing the level of risk posed by the risk that has been identified; (i) The likelihood that a risk may occur or reoccur. (ii) The impact of harm to service users, staff, services, environment or the organization. 150

151 Likelihood Scoring Likelihood scoring is based on the expertise, knowledge and actual experience of the group scoring the likelihood. In assessing likelihood, it is important to consider the nature of the risk. Risks are assessed on the probability of future occurrence; how likely is the risk to occur? How frequently has this occurred? It should be noted that in assessing risk, the likelihood of a particular risk materializing depends upon the effectiveness of existing controls. In assessing the likelihood, consideration should be given to the number and robustness of existing controls in place, with evidence available to support this assessment. Generally the higher the degree of controls in place, the lower the likelihood. The assessment of likelihood of a risk occurring is assigned a number from 1-5, with 1 indicating that there is a remote possibility of its occurring and 5 indicating that it is almost certain to occur. 151

152 152 Exercise

153 153 Wrap up Day 1