Risk Assessment Techniques and Risk Management Practices in Healthcare: A Comparative Survey of the United States and United Kingdom

This comparative survey of 200 healthcare risk managers in the United States and United Kingdom reveals significant differences in risk assessment techniques and organizational practices, highlighting a need for stronger institutional support and a shift toward prospective, multidisciplinary approaches to improve patient safety.

The Gist

Imagine the healthcare system as a massive, bustling ship sailing through stormy seas. The goal is to keep the passengers (patients) safe and the ship running smoothly. Risk management is the crew's job of spotting potential storms, leaks, or engine failures before they happen, or figuring out what went wrong after a crash.

This paper is like a report card comparing how two different ship captains (the United States and the United Kingdom) are handling their safety duties. The researchers asked the actual safety officers on board: "What tools are you using? Are you looking forward or backward? And do you have enough fuel and crew to do the job?"

Here is the breakdown in simple terms:

1. The Toolbox: What Tools Are They Using?

Every captain has a toolbox, but the US and UK captains reached for different hammers.

• The US Captain (The "Crash Investigator"):

  • Favorite Tool: Root Cause Analysis (RCA). Think of this as a detective's magnifying glass. It's used after something goes wrong. If a patient gets the wrong medication, the US team digs deep to find out exactly why it happened so they can fix that specific mistake.
  • Second Favorite: FMEA (Failure Modes and Effects Analysis). This is like a "pre-flight checklist" to imagine everything that could go wrong before the plane takes off. The US uses this, but not as much as they should.
  • The Vibe: The US approach is very retrospective (looking backward). They are excellent at fixing things after a crash, but they admit they spend too much time reacting to past mistakes rather than preventing future ones.

• The UK Captain (The "Simple Map Reader"):

  • Favorite Tool: Risk Matrices. Imagine a simple grid with colors: Red (Danger!), Yellow (Caution), Green (Safe). It's a quick way to sort problems.
  • Second Favorite: SWOT Analysis (Strengths, Weaknesses, Opportunities, Threats). This is like a business brainstorming session: "What are we good at? What are we bad at?"
  • The Vibe: The UK approach is surprisingly prospective (looking forward). They say they want to prevent accidents more than the US does. However, they rely on these simple, quick tools rather than the complex, deep-dive engineering tools used in other high-risk industries (like aviation or nuclear power).

2. The Crew: Who Is Doing the Work?

• Team Size: The US teams are like a full committee meeting (often 5+ people). The UK teams are like a small huddle (usually just 2 or 3 people).
• The Missing Passengers: In both countries, the most important people—the patients—are almost never invited to the safety meetings. It's like designing a new car seat without ever asking the people who will sit in it what feels comfortable.
• The Doctors: While some doctors are involved, they aren't always there. It's like trying to fix a plane engine without the pilot in the room.

3. The Fuel Tank: Do They Have Enough Resources?

Both captains are running on empty.

• The Problem: About half of the safety officers in both countries said, "We don't have enough time, staff, or money to do this job properly."
• The Analogy: It's like asking a mechanic to rebuild a Ferrari engine while also mowing the lawn, washing the car, and cooking dinner, all in the same hour. They simply can't give the engine the attention it needs.

4. The Results: Do the Fixes Actually Happen?

This is the most critical part. You can have the best safety plan in the world, but if you don't actually do the repairs, the ship still sinks.

• The Reality: Only about half of the recommended safety fixes are actually implemented.
• The Analogy: Imagine a doctor telling a patient, "You need to stop eating sugar and start running." The patient nods, says "Okay," and then goes home and eats a donut. In healthcare, the safety officers often say, "We need to change this process," but the hospital administration or busy staff just keep doing things the old way.

5. The "High-Tech" Tools Nobody Uses

The paper mentions some fancy, modern tools (like FRAM or STPA) that are like "self-driving car software" for safety. They are designed to understand complex systems and human behavior.

• The Catch: Almost nobody in the US or UK is using them. It's like having a state-of-the-art GPS in your car but still using a paper map because it's what you're used to. The safety science literature is full of these advanced tools, but in the real world, people stick to the old, simple methods.

The Bottom Line

The study concludes that while both the US and UK care deeply about patient safety, they are both stuck in a bit of a rut.

• The US is great at cleaning up messes but needs to look forward more.
• The UK wants to look forward but is using tools that might be too simple for the job.
• Both are struggling with a lack of time, money, and the inclusion of patients in the conversation.

The Takeaway: To make healthcare safer, hospitals need to stop just reacting to crashes, start inviting passengers (patients) to the planning meetings, and actually follow through on the safety fixes they promise to make. They need to move from "putting out fires" to "fireproofing the building."

Technical Summary

1. Problem Statement

Despite the recognized importance of effective risk management for patient safety, there is a significant lack of empirical evidence regarding how risk assessment techniques are actually utilized in routine healthcare practice.

• Knowledge Gap: Current understanding is largely inferred from guidelines, policy recommendations, or bibliometric analyses of academic literature. These sources often reflect "ideal" practices or research-focused applications rather than the reality of daily operations.
• Maturity Concerns: Comparative research suggests healthcare risk management may be less mature than in other safety-critical industries (e.g., aerospace, oil and gas).
• Specific Deficiencies: It is unclear which techniques are dominant, whether organizations favor prospective (proactive) or retrospective (reactive) approaches, and what organizational barriers (resources, team composition) hinder effective implementation. Furthermore, evidence regarding UK practices is particularly scarce compared to the US.

2. Methodology

The study employed a cross-sectional survey design targeting practicing healthcare risk managers in the United States (USA) and the United Kingdom (UK).

• Participants:
  • USA: 160 eligible respondents recruited via the American Society for Health Care Risk Management (ASHRM) mailing list (~2,000 members).
  • UK: 40 eligible respondents recruited through NHS quality management forums and the Institute of Risk Management.
  • Eligibility: Defined as individuals who regularly conduct risk management activities (investigating incidents, assessing risks, planning controls). Clinical staff limited to incident reporting were excluded.
• Instrument: An original survey instrument developed based on BS IEC 31010:2019 and literature reviews. It included:
  • Demographic questions.
  • Familiarity and frequency of use for 12 specific risk assessment techniques (e.g., RCA, FMEA, Risk Matrices, SWOT, HRA, STPA, FRAM).
  • Organizational practices (team composition, resource sufficiency, prospective vs. retrospective orientation).
• Data Analysis: Quantitative analysis using Likert scales converted to numerical values (0–4) for frequency. Chi-squared tests were used to determine statistical significance between countries regarding practice orientation and resource sufficiency.

3. Key Contributions

• Empirical Baseline: Provides the first direct empirical data comparing actual risk management practices in the US and UK, moving beyond theoretical guidelines.
• Technique Adoption Gap: Highlights a stark disconnect between the sophisticated risk assessment techniques proposed in safety science literature (e.g., FRAM, STPA) and those actually used in routine practice.
• Systemic Comparison: Offers a nuanced comparison of two major healthcare systems, revealing that despite different regulatory environments, both face similar implementation barriers.
• Implementation Reality: Quantifies the "implementation gap," showing that a significant portion of risk improvement recommendations are not being acted upon.

4. Key Results

A. Risk Assessment Techniques

• United States:
  • Dominant Technique: Root Cause Analysis (RCA) was the most frequently used (57% used it at least half the time).
  • Secondary: Failure Modes and Effects Analysis (FMEA) was familiar to 77% but used frequently by only 17%.
  • Orientation: Practice is heavily retrospective (65% reported their org is "mostly reactive"), despite a stated preference for proactive approaches.
• United Kingdom:
  • Dominant Technique: Risk Matrices were the most common (65% used them frequently), followed by SWOT analysis.
  • Underutilization: RCA was rarely used (55% "never" used it); FMEA familiarity was low (35%).
  • Orientation: Practice is more prospective than in the US (27% reported "mostly prospective" vs. 7% in the US), though this often occurs via informal discussions rather than structured prospective techniques.

B. Organizational Practices & Resources

• Resource Constraints: Approximately 50% of respondents in both countries reported insufficient resources.
  • Top Constraints: Lack of Time (73% US, 77% UK) and Staffing (71% US, 59% UK).
• Team Composition:
  • Team Size: US teams were larger (85.5% had 3+ members); UK teams were smaller (66.6% had 2–3 members).
  • Clinical/Patient Involvement: While clinical representatives were included "most of the time" (~50-55%), patient representatives were rarely involved (86–92% reported "infrequently" or "never").
• Implementation of Recommendations:
  • Only ~4% of respondents reported recommendations were "always" implemented.
  • A majority (50%) reported implementation "most of the time," but **43–47%** reported implementation only "half the time or less."
  • Correlation: In the US, organizations with sufficient resources were significantly more likely to implement recommendations ($p < 0.01$).

C. Advanced Techniques

• Techniques designed for socio-technical systems (e.g., FRAM, STPA) and Human Reliability Assessment (HRA) were rarely recognized or used by respondents in either country (<5% usage for most).

5. Significance and Implications

• Policy and Regulation: The findings suggest that regulatory mandates (e.g., The Joint Commission requiring prospective FMEA in the US) may be driving "compliance" rather than genuine cultural integration, as evidenced by the low frequency of actual FMEA use despite high familiarity.
• Maturity of Healthcare Risk Management: The field lags behind other safety-critical industries. The reliance on simple tools (Risk Matrices) and retrospective methods (RCA) indicates a reactive maturity level, despite a stated desire for proactive management.
• Barriers to Safety: The study identifies organizational resources (time/staff) and multidisciplinary engagement (specifically patient inclusion) as critical bottlenecks. Without addressing these, risk assessments remain theoretical exercises with limited impact on patient safety.
• Future Directions: To mature healthcare risk management, organizations must:
  1. Invest in structural resources (time/staff).
  2. Move beyond simple retrospective tools toward structured prospective techniques.
  3. Actively integrate patient representatives into risk assessment teams.
  4. Focus on the implementation of risk controls, not just the assessment itself.

Conclusion: The paper concludes that while healthcare risk managers in the US and UK share a desire for proactive safety, their practices remain constrained by resource limitations and a reliance on retrospective or simplistic tools. Bridging the gap between safety science literature and routine practice requires systemic changes in organizational support and team composition.