Put in place a risk management system*.

At a minimum, make sure your risk management system* has clear and documented processes* and roles and responsibilities* on:

• managing risks to:
  • older people
  • workers
  • your operations
  • business continuity
  • emergency and disaster management (Outcome 2.10)
  • emerging infectious diseases (Outcome 4.2)
  • your information management system* (Outcome 2.7) including data and digital records, such as cyber security risks.
• how to:
  • identify risks
  • assess risks
  • document risks
  • manage risks
  • review risks.
• the strategies to manage the risks you identify. Include how you:
  • prevent risks
  • control risks
  • minimise risks
  • eliminate risks.

Use your risk management system* to identify, manage and review risks.

Have clear processes* to:

• identify and escalate risks. Escalate new risks straight away as you identify them. You should use your broader performance monitoring to inform this (Outcome 2.3). In particular, reviews of feedback* and business data such as incidents and near misses. The risk management system* needs to encourage you to report and escalate issues. This makes sure you can deal with key risks promptly. This may mean you need to escalate certain risks to the governing body*. Risks found through this process* include any risks that can harm the organisation and its people. For example, risks to safety, older people, finances and reputation.
• assess risks. Once you identify risks, do a ‘risk assessment’ to check if there’s a chance of a negative outcome* and how severe that outcome would be. Document the risk assessment and use it to see if you can do an activity or take more actions to minimise the risk. You can also use a risk assessment to prioritise actions. In some cases, you may need a more detailed risk assessment. For example, an older person who is receiving home care services will need a risk assessment of their home environment when they start to have services in their home. You should also do this risk assessment regularly* to help identify possible risks to the older person or workers in the home (Outcome 4.1a).
• manage risks. Allocate actions and resources to minimise risks. Act to eliminate risks where possible. Use ways to control and minimise risks if you can’t eliminate them. Act to stop risks from happening again. This is particularly important if the risk is ‘high’. Actions may be related to key business goals, like workforce planning (Outcome 2.8). They could also relate to outcomes of the Quality Standards (Outcomes 5.4, 5.6 and 4.2). For example, using personal protective equipment to reduce the spread of an infection*.
• monitor risks. Gather and analyse data to make sure you continue to prevent or minimise risk as much as possible. Identify and address organisation-wide issues (Outcome 2.3).

Have at least one organisation-wide risk register and periodically review it for new and emerging risks and those already identified for any change in circumstances. If the organisation has multiple sites and locations, you may need a risk register for each one. You may also need to complete a separate assessment for high-risk activities.

Put in place strategies to help workers manage risk well.

Put in place policies* and procedures* that support you to use your risk management system* . Make sure these are:

• current and informed by the latest contemporary, evidence-based practices*
• regularly* reviewed
• clear and accessible for workers and relevant people.

Provide workers with guidance and training on how to use the risk management system* (Outcome 2.9). This needs to be in line with:

• the organisation’s policies* and procedures*
• workers’ roles and responsibilities*.

Make sure workers understand:

• their role in the risk management system*
• how to use the system* to manage risks when delivering care and services to older people. For example, how to report a risk.

The guidance for Outcomes 2.8 and 2.9 has more information about workforce* planning and human resource management.

Monitor how well you use the risk management system*.

Regularly* review your risk management system* to make sure it works well. Look for ways to improve the system*.

To check if your risk management system* works well, you can review:

• older people’s care and service documents (Outcome 3.1)
• complaints and feedback* (Outcome 2.6)
• incident* information (Outcome 2.5)
• worker* performance and how well they’re using the risk management system*. You can do this through quality assurance and system* reviews (Outcome 2.9).
• policies* and procedures*.

Also, talk with older people, their families and carers about the care and services they receive (Outcome 2.1). Ask them if they feel their provider engages with them to identify, manage and review their risks. These conversations can then inform continuous improvement* actions and planning (Outcome 2.1).

If you find any issues or ways you can improve through your reviews and assessments, you need to address them. If things go wrong, be open about it. Share what went wrong with older people, their family and carers (Outcome 2.3). Put in place strategies to mitigate the risk of things going wrong again.

The guidance on Outcome 2.3 has more information on monitoring the quality system*.