ORIMS April 2013 Continuing Steps: SJHC ERM Program

1. ORIMSApril 2013 Continuing Steps: SJHC ERM Program

2. Objectives: • Describe SJHC’s journey implementing ERM • Understand why we moved to an ERM approach • Describe the ERM plan at St. Joseph Health Centre • Describe the roles of the Board, Senior Leadership and Operational staff in supporting a culture of ERM • Describe the integration & engagement throughout the organization • Discuss lessons learned

3. St. Joseph’s Health Centre at a Glance • Employing over 3,500 staff • 450 physicians • Beds 390 • Emergency department visits = 90,000 • Admissions 23,000 • Ambulatory care visits 210,000 • Births 3,100 • Diagnostic Imaging procedures 153,000 • Operating Room cases 26,000

4. Who Are We? Five clinical program areas: • Women's, Children's & Family Health • Surgery and Oncology Services • Emergency and Critical Care Services • Medicine, Ambulatory & Seniors Health • Mental Health & Addictions Services

5. SJHC Strategy:

6. So How Dangerous is Healthcare? Accepted Public Risk

7. What is Culture in Healthcare? • Doctor knows best • Litigation • US comparator • 100,000 Lives Campaign / Don Berwick (Ross Baker) • Dr. Google/ Dr. Oz • Personal experience • Legislation & Regulation • Infrastructure: old & new • Workforce • Funding • Public Reporting • Low Risk Tolerance Industry

8. What is ERM in Healthcare and Why is it Necessary?: What? • A structured analytical process that focuses on identifying and eliminating the financial impact and volatility of a portfolio of risks rather than risk avoidance alone (Risk Management Handbook for Healthcare Organizations – 4th edition). • Uses a process & systems to assess, evaluate and measure organizational risks, quantify, group into domains, and devise strategies to manage. Why? • Complexity of health care • Changes in orientation of Boards from understanding of fiduciary accountability as dollars and cents to full oversight for quality and safety • Moving from silos to integrated systems

9. Consequences • Patient Injury: death, injury, delayed diagnosis, misdiagnosis, extended length of stay, disease transmission, increased wait-times etc. • Visitor injury • Staff: injury, retention, fraud, workload, morale, breach of trust, etc. • Infrastructure loss: inability to exit safely, property damage, theft, difficulty accessing services etc. • Financial loss: future cash position, insufficient assets, overspending etc. • Medical-legal costs/ civil liability • Agreement non-compliance • Accreditation loss • Criminal action • Monetary fines • Legislative/regulatory non-compliance • Loss of reputation/ loss of external partners

11. Why ERM at SJHC? • Traditional approach to Risk Management with traditional structure and diffuse accountability • Board and management frustration • Alignment to strategy • Significant increase of Boards and Senior leaders for accountability of quality & patient/staff safety • Commitment to quality & patient safety as a strategic priority • An integrated risk management program, that is a continuously proactive and a systematic approach to understand, manage, and communicate risk from an organization-wide perspective.

12. Integrating Risk Identification Management Tool Improve governance Actively monitored and reviewed Provides reliable framework for decision-making Identifies issues at an early stage Reduces surprises Structures thinking Example: Risk Identification as a Tool: e-Care lab labeling: tool & requirement, provides framework of decision-making Risk Identification as Assessment: Interim CEO: no surprises, can happen, identifies issue at early stage Risk Identification as a Framework: HR & Risk review: legislation & regulation, thinking structured based on risk assessment

13. Enterprise Risk Management Cycle Identify: SJHC areas of risk, risk ratings Communicate: Understanding, accountability, transparency Mitigate: Risk strategies currently in place Track & Monitor: Material gaps & action plans, Internal & external audits Assess and Analyze: Risk assessment and risk calculation

14. Risk Information Gathering:

15. How Were Areas Identified? • Organisational priorities: • Mission, Vision & Values, • Strategic Plan (Board and Senior Leadership) • Categorize based on the risks the organization faces • High, medium, low risk areas based on the following: • Literature • Medical-legal cases • HIROC • Industry standards • Safety Reports • Safer Healthcare Now! • Accreditation Canada • GTA benchmarks/ experience • Risk analysis of the Programs and Services in the Health Centre were reviewed and grouped into high, med and low risk areas.

16. Risk Domains Risk: loss potential or exposure, any factor that creates uncertainty and impacts the achievement of outcomes or organizational objectives Human Resources hiring, termination, & compensation, harassment, unionization etc. Strategy ability to grow and expand through mergers, joint ventures etc. Operational core business (i.e. clinical services) Patient Legal & Regulatory statutory & regulatory compliance Finance earn, raise, or access capital Technology use of biomedical & information technology

17. Identification Questions • What can go wrong? • How bad? • How often? • Is there a need for action? (HIROC IRM Tool) Risks are identified to minimize: • Exposure • Frequency • Severity • or Prevent the risk and/or its reoccurrence

18. Who Participated? • All specific high risk areas • Focus groups for non-specific areas e.g. Emergency response • Depending on area front-line staff, managers, educators, directors, physicians • Interprofessional • Enterprise-wide

19. Methodology Followed Status  Confirm catalogued risk domains and review mitigation strategies (controls). Meetings with Programs  Conduct detailed risk analysisof domains. RiskAnalysis Identify and determine monitoringstrategies.  Determination of Monitoring Prepare and implement action plansto address material gaps.  ActionPlans

20. Transitioning from Operational to Enterprise Risk Management • Roles: • Board of Directors • CEO • Chief of ERM • Senior Leader’s • Manager • Front line staff • Buy-in • Traditional Risk Manager role • Engaging at all levels (Leadership, staff, patients) • Reporting • Matrix • Quarterly • Annually

21. Board of Directors Role at SJHC At SJHC, the whole Board is responsible for oversight of overall ERM program. Oversight of technical aspects delegated to: - Audit committee: financial viability risks, ICFR - Quality committee: operational risk (patient safety and quality), business viability, mission and intangible risks - Annual Joint Quality and Audit committee meeting • Review/monitor ERM progress • Risk position versus risk appetite • Effectiveness of controls and mitigation strategies • Ensure management has implemented an effective process to manage the strategic, operational and financial risks of the hospital • Holding Leadership accountable for embedding an enterprise risk management culture • Education and “buy in” at Board level for risk strategy • Review/Approve aggregate and specific risk appetite and related risk limits • Develop ownership of risk management oversight at Board level.

22. What is the CEO’s Role? Ultimate accountability and responsibility for: • Shaping the culture • Working with Board and Leadership to determine the risk appetite for the organization • Ensuring that the leadership understands the “enterprise” part of ERM • Positioning the Chief of Enterprise Risk Management for success • Holding leaders accountable for execution

23. What is the Chief of ERM Role? • Full member of Senior leadership team • Accountable and responsible for the operation of the Enterprise Risk Management function • Supports the development of a culture of Enterprise Risk Management • Advises organization on new strategies to manage and mitigate risk

24. What is the Senior Leader’s Role? • Accountable and responsible for managing risk in their portfolios • Work with colleagues to ensure that ERM is integrated across the organization • Work with direct reports to establish culture of ERM • Oversee the implementation and compliance of policies and procedures within portfolio • Oversee the implementation of risk reduction and mitigation strategies within portfolio

25. What is the Manager Role? • Accountable and responsible for managing risk at the unit level (what risks am I accountable for?) • Work with colleagues to ensure that ERM is integrated across the organization • Work with direct reports to establish culture of ERM • Ensure compliance of policies and procedures at the unit level • Ensure implementation of risk reduction and mitigation strategies at the unit level

26. Acceptable Risk: Asking the Right Questions

27. Risk Calculation Sentinel

28. Acceptable Risk Example

29. Quarterly Report

30. How to Prioritize Next Steps • Organisational priorities: Mission, Vision & Values, Strategic Plan (Board and Senior Leadership) • Numbers vs colours (visual or audit management) • Strategic plan • Corporate compliance requirements • Need for monitoring (audits) • Risk/Sentinel events • Risk Assessment & Action Plans arising • Critical controls and current risk control techniques in place

31. Learning from our Experience • The organization must understand what ERM is and is not • Appropriate resources must be committed to ensure success • The Chief must be situated for success • The Board must be educated • The Board Audit Committee, Quality Committee and the full Board must be on the same page • The CEO, the CFO and the Chief of ERM need to be on the same page – and the CFO gives up a piece of his/her pie • Health Care Insurance Reciprocal of Canada risk assessment is a valuable tool • Look at the new initiatives and how ERM ties in e.g. QIP • Always refresh and revisit : • Literature search to ensure evidence informed best practices in ERM • Review scorecard indicators • Assess need for ERM policy • Refine reporting process • Responding to Legal / Regulatory Changes e.g. Freedom of Information Act • It takes time…..and it never ends………….

32. QUESTIONS??