Attempting to Organise Uncertainty: risk management in tomorrow’s world

1. Attempting to Organise Uncertainty: risk management in tomorrow’s world 15th July 2014

2. Every 24 hours the NHS touches the lives of more than 1.5 million patients and their families

3. We’re all part of that great achievement….

4. About 150,000 patients experience an adverse event every day in the NHS

5. that’s 104 patients involved in an adverse event every minute of every day….

7. There were 1,367,976 reported incidents involving or affecting patients in England and Wales in the 12 months ended June 2012 Source: NRLS, 2012

8. Clinical negligence expenditure: assuming constant growth of 22% per year: T2 = 3.2 years

10. What we’ll touch on today…. • Dealing with uncertainty • Features of governance in common in failing NHS trusts • A model for governing risk • Working with desirable risk • Board Assurance Mapping • Solid Risk Management Foundations

11. Uncertainty, Anticipation and Adaptation • Effective anticipation and adaptation are central to organisational survival in an evolving, fast-moving uncertain operating environment…. • Embracing uncertainty, complexity and chaos helps you to anticipate and adapt; it facilitates self-organisation in the presence of uncertainty. It is key to success or failure as an organisation

13. Uncertainty and Risk • Uncertainty is what you don’t know for sure • Risk is the effect of uncertainty on the entity’s objectives – any variation from desired or expected results • Anticipation uses uncertainty to reveal opportunities and threats; we adapt to maximise opportunity or minimise threats • The goal of risk management is to make uncertainty visible and the entity resilient to it’s harmful effects

14. Uncertainty and Risk • Experience, intuition and imagination are important concepts in making uncertainty visible but… • Normalisation can have a blinding effect…. …and unconsciously increase your risk appetite!

15. Key Questions • Can you demonstrate your risk management system supports your ability to develop and execute your business strategy?

16. Features of Governance Failure • Board Assurance Frameworks (BAFs) perceived as non value-added • Boards had difficulty using the BAF • Risk not visible – issue giving rise to intervention not identified on risk register • Complexity, blind-spots and normalisation combine as conditions under which failure may flourish • Resilience is seen as a discrete and intuitive activity • Risk disassociated from objectives • Internal Audit – significant assurances (Moore, 2012)

17. Learning from others - Failings of Risk Management • Confusion regarding the concept of risk • Lack of clarity of purpose and objectives • Incomplete identification and assessment of risk • Human errors in subjective judgements of risk • Ineffectual, but popular subjective scoring methods • Institutional factors – risk aware culture/taboos • Catastrophic overconfidence • Overwhelming complexity and the limits of expert knowledge and control • Insufficient accountability

18. Trust A (n=409) Trust B (n=280) Trust C (n=3670)

19. That’s not fair! I was going to say that… Moo Moo

20. Risk Management: aligning the basic elements of governance • As – ASSURANCEP – PURPOSER – RISK M - MONITORINGA - ACCOUNTABILITY Res – RESILIENCEO – OBJECTIVESC - CONTROLS RA – RISK APPETITE RT – RISK TOLERANCE

21. All exploration and discovery involves risk. Without risk there is no learning. Without learning there is no progress. Without progress we don't succeed. Paul Moore, 2014

23. Risk Appetite - driving whilst using a mobile phone Relying on your instinct what level of risk do you take?

24. Key Questions • Does your Board have a shared understanding of desirable risks and what it is prepared to do to realise them? • Is there sufficient political and stakeholder support to underwrite the Trust’s risk taking behaviours? How could this be assured?

26. Effective risk management requires….. • A simple process for risk management – make it easy for people to use • Organisational purpose and objectives to be understood by all • Hire for attitude, train for skill • Risk to be visible - learn to express risk: a failure to, caused by, may result in… • Anticipation of the crisis – be preoccupied with potential failure • Risk treatment – apply a forensic attention to control • Scan the horizon for emergent opportunities and threats • Disrupt normalisation by challenging what we think we know • Apply effective accountability

27. Summary • Managing risk is not easy – you need to have a process that works • Effective governance depends on clarity of purpose, effective control and robust accountability within an open and inquisitive culture • Your Trust has to take risk to maximise opportunity, but your colleagues need to know your acceptable limits of risk tolerance • Your governance model needs to be capable of protecting everything of value, enhancing your resilience and preventing regulatory intervention

28. ….. your next steps?

29. Paul Moore MSc BSc(Hons) RGN DPSN JP Managing Director, PM Governance Ltd paul.moore@pm-governance.co.uk +44 (0)7712 473235 Former Director of Risk & Governance (Chief Risk Officer) University Hospital of South Manchester NHS Foundation Trust Visiting Fellow, Manchester Business School