In healthcare, risk management and strategy development often proceed on different tracks and at different rates, in silos with just the results shared between the teams in charge of each. With the emergence of COVID-19, and the unintended consequences of this approach now at the forefront, it has become evident to many leaders that public health “risk assessments”, much like other assessments, such as technology, competitive, community, regulatory, operating reviews assessments, must formally become part of the strategic planning process.

Leaders Must Prioritize Public Health Risk Assessments

The first step in prioritizing public health risk assessments is to actively engage the teams assigned to both risk management and strategic planning, and secure buy-in from the board and executive management. To facilitate this, a few commonly asked questions include:

• What do those responsible for strategy need and want to know? Interview executive management to identify risks that may be of use to them in their decision-making;
• Is information already being shared? A brief review of existing strategic planning and risk management documents will reveal what information, if any, is already being shared;
• Would the results and other information derived from a risk assessment have made a difference in achieving the objectives in previous planning cycles? A high-level analysis of prior strategic plans will help determine if proper consideration of risks would have improved results; and
• Does the organization have a process in place already to document the risks associated with strategic initiatives and to develop plans in the event the risks manifest?

As Leaders We Must More Robustly Address Public Health Risks in Our Strategy

In the public health arena, a risk assessment identifies health risks to the community, including employees and other stakeholders in the organization, the probability and potential impact of these risks, and the organization’s level of preparedness if the risks manifest themselves. Based on this, the assessment can then apply quantitative analysis to understand the comparative risks and provide recommendations on available and appropriate measures to address each risk. These recommendations typically fall into one of the following four categories:

1. Risk Assumption: We should simply assume certain risks as the “cost of doing business”, either because the risks are unlikely to occur, would have a nominal impact were they to occur and/or would require an “unreasonable and disproportionate” expenditure of capital and other resources to address. An example of this might be quarantining with your family rather than in isolation when no one is showing symptoms and you have been together for more than 14 days.

2. Risk Elimination: Certain risks must be eliminated at all costs, typically because they would have a very significant, if not catastrophic impact should they occur. An example of this might be a COVID-19 “vaccine”, with the time and investment that entails.

3. Risk Mitigation: Some risks cannot be or need not be eliminated, instead calling for reasonable measures to reduce or mitigate the likelihood and/or impact of the risks. An example of this is Social Distancing.

4. Risk Transfer: Risk transfer mechanisms include insurance policies and other contracts that expressly define the “owner” of a risk and the damages that may be caused if that risk manifests itself. Insurance against the losses caused by a global pandemic does exist – as Wimbledon showed us. Today, we also are seeing the idea of “risk transfer” in the debate between Governors and the Federal Government over which is the “owner” of what part of the pandemic response.

Armed with this information, leaders are much better positioned to assess the feasibility, expense and potential public health risks, and indeed with risks associated with each of organization’s strategic objectives. Leaders will have a more “evidence based” approach to priority setting and to capital allocation, relying on a deeper understanding of the risks and ROI associated with the different strategies and initiatives.

More importantly perhaps, the organization will be more agile in adapting to future circumstances, more prepared if and when risks manifest, and less vulnerable to “unknown” events that may have been underestimated. By integrating risk management and strategic planning, leaders may eliminate a lack of preparedness for unforeseen events in the future that inevitably require even greater use of time, personnel, capital and other resources.

One of the lasting legacies of the current public health crisis will surely be that risk management will no longer be viewed as separate from or as an obstacle to strategic planning. Rather, as in the aftermath of other crises, risk management will likely come to be viewed as a fundamental first step in enabling informed decision-making and priority setting.

What is often forgotten is the simple truth that the only alternative to risk management is crisis management – which is more costly, more time consuming, and more damaging to an organization’s reputation. Ultimately, sound risk management practices in healthcare may just be the best way to ensure we “do no harm”.