Enterprise Risk Management and Emergency Preparedness

Introduction and Context

Hospitals operate in an environment of uncertainty. A medication may be prescribed incorrectly, a power supply may fail, a cyberattack may disable clinical systems, a pandemic may create demand beyond available capacity, or a strategic investment may expose the organization to financial and reputational harm. Because hospitals are highly interdependent systems, a disruption in one area can rapidly affect patient care, staff safety, public confidence and organizational viability.

Enterprise risk management (ERM) provides a systematic approach for identifying, assessing, treating, monitoring and communicating risks across the whole hospital. It differs from isolated departmental risk management because it considers connections among clinical, operational, environmental, financial, legal, technological and strategic risks. Emergency preparedness extends this work by ensuring that the hospital can prevent or reduce harm, respond effectively to incidents, maintain essential services and recover safely.

Risk management is not the elimination of all risk. Healthcare necessarily involves uncertainty, and excessive control may delay treatment or restrict beneficial innovation. The objective is informed decision-making: risks should be reduced to a level that is reasonably practicable while respecting patient rights, professional standards, law and available resources.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain the purpose and scope of enterprise risk management in hospitals.
2. Classify clinical, operational, environmental and strategic risks.
3. Construct and prioritize a hospital risk register.
4. Apply risk matrices, hazard analysis and Failure Mode and Effects Analysis (FMEA).
5. Distinguish risk prevention, mitigation, preparedness, response and recovery.
6. Design essential elements of a business continuity and emergency preparedness programme.
7. Evaluate crisis communication, governance, ethics and accountability.
8. Use incident learning and performance indicators to improve organizational resilience.

1. Foundations of Enterprise Risk Management

1.1 Meaning of risk

Risk is commonly understood as the effect of uncertainty on objectives. The effect may be positive, negative or both. In hospital management, objectives include safe and effective care, continuity of essential services, workforce safety, regulatory compliance, financial sustainability, equity and public trust.

A useful conceptual model expresses risk as a combination of the likelihood of an event and the consequences if it occurs. A simple quantitative representation is:

Likelihood is the estimated chance or frequency of an event, while consequence is the magnitude of harm or loss. This expression is a prioritization aid rather than a complete scientific law. It assumes that the scales used for likelihood and consequence are defined consistently and that multiplying them produces a meaningful ordering. It should not be interpreted as a precise probability of harm unless the variables are measured probabilistically.

Risk is different from a hazard. A hazard is a source or condition with the potential to cause harm, such as an oxygen-rich environment, an unsecured medicine cabinet or an infectious pathogen. Risk concerns the likelihood and consequence of that hazard under particular circumstances. A control is a measure that removes a hazard, reduces likelihood, limits consequences or improves recovery.

1.2 Enterprise perspective

Traditional risk management often assigns risks to departments: pharmacy manages medication risk, engineering manages utilities, and information technology manages cyber risk. ERM retains departmental expertise but adds an organization-wide view. It asks:

• Which risks could affect several services simultaneously?
• Which controls depend on another department or external supplier?
• Which risks may be individually moderate but collectively serious?
• What level of risk is acceptable to the governing body?
• How should scarce resources be allocated among competing risks?

For example, a hospital’s electronic health record outage is an information-technology problem, but it may also become a clinical documentation, medication, laboratory, revenue, communication and reputational crisis. ERM therefore requires integration rather than ownership in isolation.

1.3 Risk governance

Effective risk governance assigns clear accountability at four levels:

A sound governance system distinguishes accountability from blame. Individuals remain responsible for unsafe actions and misconduct, but most healthcare harm arises from interactions among people, processes, technology and conditions. A just culture supports reporting and learning while maintaining fair accountability for reckless or intentionally unsafe behaviour.

1.4 Risk appetite and tolerance

Risk appetite is the amount and type of risk an organization is willing to pursue or retain in achieving its objectives. Risk tolerance is the acceptable variation around a specific objective. A hospital may have a very low appetite for preventable patient identification errors, but a higher tolerance for limited financial volatility associated with service development. Risk appetite should be expressed in operational terms, such as maximum downtime for critical systems, acceptable waiting-time variation or thresholds for healthcare-associated infection.

2. Hospital Risk Categories

Clinical risks

Clinical risks arise directly from diagnosis, treatment, care processes and patient conditions. Examples include medication errors, delayed diagnosis, wrong-site surgery, patient falls, pressure injuries, healthcare-associated infections, deterioration not recognized and failures in clinical handover. Clinical risks are often influenced by workload, communication, staffing, equipment usability and the design of the care environment.

Operational risks

Operational risks affect the hospital’s ability to deliver routine services. Examples include staffing shortages, supply-chain interruption, equipment failure, laboratory delays, transport failure, inadequate bed capacity, poor maintenance and ineffective scheduling. Operational risks may not initially injure a patient, but prolonged service disruption can create clinical harm.

Environmental and occupational risks

These include fire, flood, earthquake, extreme heat, hazardous substances, radiation exposure, violence, infectious disease outbreaks, structural damage, water contamination and failure of heating, ventilation or oxygen systems. Environmental risks require cooperation with facilities, occupational health, public authorities and emergency services.

Strategic, financial and reputational risks

Strategic risks arise when decisions, assumptions or external changes undermine the hospital’s long-term direction. Examples include investing in an unsustainable service, failing to respond to demographic change, dependence on one supplier, loss of accreditation, regulatory sanctions, fraud, data breaches and erosion of public trust.

The categories overlap. A flood may be environmental, operational and financial; a cyberattack may be technological, clinical, legal and strategic. Classification helps assign responsibility, but it should not conceal interdependence.

3. The Hospital Risk Register

A risk register is a controlled record of significant risks, their causes, potential effects, ratings, controls, owners and treatment plans. It is a management instrument, not merely a compliance document.

A practical risk-register structure is shown below.

A risk statement should be precise. “Medication safety is poor” is too vague. A stronger statement is: “Because high-alert medicines are stored in two similar-looking locations and independent verification is inconsistent, a patient may receive the wrong concentration, resulting in serious harm.” This format links cause, event and consequence.

Risk identification methods

Useful methods include structured interviews, staff workshops, safety walk-rounds, patient complaints, incident reports, audit results, claims data, regulatory findings, process mapping, supplier reviews, scenario analysis and review of previous emergencies. Patients and families should be included because they often identify communication and access risks invisible to professionals.

Risk identification should consider normal operations, abnormal conditions, night and weekend work, staff turnover, vulnerable populations and simultaneous failures. The question is not only “What usually goes wrong?” but also “What could go wrong under pressure?”

Risk matrix

A common matrix scores likelihood and consequence on ordinal scales, for example from 1 to 5. The score is calculated as:

where R is the risk score, L is the likelihood score and C is the consequence score. The score is dimensionless because both inputs are rating categories, not physical measurements. A hospital must define each category and decision threshold in advance.

For example, if a medication error is rated likelihood 3 and consequence 5, then:

If the organization defines 15–25 as high risk, the event requires senior review and documented treatment. The matrix does not prove that the risk is exactly 15 units; it ranks the risk within the organization’s chosen scale. Different combinations, such as 5 × 3 and 3 × 5, may receive the same score even though their management implications differ. Therefore, high-consequence low-frequency events must not be dismissed merely because their numerical score is moderate.

A useful rating process considers both inherent risk and residual risk. Inherent risk is the exposure before controls; residual risk is the exposure after controls. A control should not be credited simply because it exists. Its design, reliability, compliance and evidence of effectiveness should be assessed.

4. Hazard Analysis and FMEA

4.1 Hazard analysis

Hazard analysis systematically examines a process, environment or system to identify hazards, initiating events, barriers and consequences. It is particularly useful for emergency planning and high-risk infrastructure. A hospital might analyze the oxygen supply by mapping storage, pressure regulation, distribution, alarm systems, maintenance, backup cylinders and clinical dependencies.

A bow-tie model is a useful way to structure analysis. On the left are causes and preventive barriers; in the centre is the top event; on the right are consequences and recovery barriers. For example:

• Causes: damaged pipeline, maintenance error, depleted backup supply.
• Top event: loss of central oxygen pressure.
• Preventive barriers: inspection, alarms, supplier controls and preventive maintenance.
• Consequences: ventilator interruption, cancelled procedures and patient deterioration.
• Recovery barriers: emergency cylinders, manual ventilation, clinical escalation and incident command.

The model encourages balanced investment in prevention and response.

4.2 Failure Mode and Effects Analysis

FMEA is a prospective method that examines how a process might fail before harm occurs. A multidisciplinary team maps the process, identifies failure modes, describes effects and causes, records existing controls, and selects improvement actions.

A traditional Risk Priority Number is:

where S is severity, O is occurrence and D is detectability, each usually scored on an ordinal scale such as 1–10. A high detectability score generally means that failure is difficult to detect before reaching the patient; the organization must define the direction clearly. RPN is a prioritization index, not a probability and not a measure with physical units. It assumes that multiplying ordinal scores is useful, an assumption that has recognized limitations.

Consider a specimen-labelling process:

The wrong-patient label receives the highest RPN and warrants urgent attention. However, a catastrophic failure with a low occurrence score should still receive priority. FMEA teams should therefore review severity separately, examine clusters of related failures and avoid treating RPN as an automatic ranking.

Strong FMEA recommendations follow the hierarchy of controls. Elimination and redesign are generally stronger than warnings or training alone. Examples include barcode patient identification, physically segregated medicines, forcing functions, standardized connectors, automated alerts and fail-safe defaults. Education remains valuable but is a weak control when the process itself invites error.

5. Risk Treatment and Monitoring

Risk treatment options include:

1. Avoidance: discontinue an unsafe activity or redesign the service.
2. Reduction: lower likelihood or consequence through controls.
3. Transfer or sharing: use insurance, contracts or partnerships, while recognizing that accountability cannot be completely transferred.
4. Retention: accept the risk with informed authorization and monitoring.
5. Exploitation: in positive-risk contexts, deliberately pursue an opportunity while controlling downside exposure.

Treatment plans should state the action, owner, resources, due date, expected risk reduction and evidence of completion. “Provide training” is incomplete unless it identifies the target group, competency standard, assessment method and follow-up measure.

Risk indicators may be leading or lagging. Leading indicators include completion of fire drills, percentage of critical equipment with preventive maintenance and staffing contingency readiness. Lagging indicators include adverse events, cancelled procedures, infection rates and financial losses. A balanced dashboard uses both.

Escalation rules should specify when a risk is reported to an executive, committee or governing body. Escalation may be triggered by a threshold breach, repeated control failure, rapid deterioration, legal notification requirement or risk interdependence with another major risk.

6. Emergency Preparedness and Business Continuity

6.1 The emergency management cycle

Emergency management is commonly organized as mitigation, preparedness, response and recovery.

• Mitigation reduces the probability or impact of hazards, for example flood barriers or infection prevention.
• Preparedness develops plans, training, supplies, agreements and exercises.
• Response protects life, stabilizes the incident, maintains command and delivers urgent services.
• Recovery restores services, supports affected people, repairs infrastructure and captures learning.

These phases overlap. Recovery findings should improve mitigation and preparedness; preparedness should be tested before response is needed.

6.2 Business impact analysis

A business impact analysis (BIA) identifies critical services, dependencies and maximum acceptable disruption. It asks what must continue, at what minimum level, and by when.

Important terms include:

• Maximum tolerable period of disruption (MTPD): longest period a service can be unavailable before unacceptable harm occurs.
• Recovery time objective (RTO): target time to restore a service after disruption.
• Recovery point objective (RPO): maximum acceptable period of data loss, relevant to information systems.
• Minimum business continuity objective: minimum staffing, equipment, space, information and supplies needed to operate safely.

RTO and RPO are not interchangeable. An RTO concerns time; an RPO concerns recoverable data measured in time. A critical laboratory may require an RTO of hours, while a noncritical administrative report may have an RTO of days. Such values must be set through clinical and operational analysis rather than copied from generic templates.

A BIA should map dependencies including electricity, water, oxygen, heating and ventilation, telecommunications, information systems, staff transport, suppliers, blood products, waste disposal and external referral pathways. It should also identify vulnerable patients who cannot be easily transferred or treated through informal workarounds.

6.3 Emergency operations plans

An emergency operations plan should contain:

• activation criteria and authority;
• incident command structure and alternates;
• notification and communication procedures;
• priorities for life safety and essential clinical services;
• staffing, personal protective equipment and welfare arrangements;
• evacuation, shelter-in-place and patient movement procedures;
• supply, pharmacy, blood and logistics arrangements;
• information-system downtime procedures;
• security, access control and family assistance;
• coordination with public health, emergency services and partner hospitals;
• documentation, financial control and legal advice;
• demobilization and recovery arrangements.

Plans must be accessible during power and network failure. Paper forms, contact lists, maps, radios and offline procedures may be necessary. A plan that exists only on an intranet is not a resilient plan.

6.4 Incident command and coordination

An incident command system establishes a common structure for leadership during a crisis. Typical functions include incident command, operations, planning, logistics, finance and administration, with safety and liaison roles as required. The specific labels may vary by jurisdiction, but the principles are consistent: one clear command structure, defined authority, manageable span of control, common terminology, reliable situation reports and documented decisions.

Clinical command and administrative command must cooperate. The incident commander coordinates the whole response but should obtain specialist advice from clinical, engineering, infection prevention, legal, communications and security leads. Over-centralization can delay action; unclear delegation can produce conflicting orders.

6.5 Exercises and capability assurance

Preparedness is demonstrated through capability, not the existence of documents. Exercise types include:

• discussion-based tabletop exercises;
• communication and notification tests;
• functional exercises testing selected capabilities;
• full-scale exercises involving multiple agencies.

Every exercise should have objectives, assumptions, observers, safety controls, an evaluation method and an after-action process. Recommendations should be assigned to owners with deadlines. Repeating an exercise without closing previous actions creates an illusion of preparedness.

7. Crisis Communication, Ethics and Regulation

In a crisis, communication should be timely, accurate, empathetic, accessible and consistent. Hospitals should identify a spokesperson, verify facts before release, protect privacy and explain what is known, unknown and being done. Communication with patients and families must not be subordinated to reputation management. Delayed disclosure may increase distrust and legal exposure.

Ethical challenges include triage under scarcity, allocation of intensive care, evacuation of dependent patients, staff duty to care, privacy during public reporting and balancing individual needs with population protection. Decisions should use transparent criteria, clinical evidence, equity considerations, legal requirements and an appeal or review process where feasible. Scarcity decisions should not be improvised by exhausted individuals at the bedside without institutional guidance.

Hospitals must comply with applicable health, occupational safety, emergency management, privacy, medicines, building, fire and professional regulations. Accreditation standards can support improvement but should not replace risk analysis. Documentation should show decisions, authorizations, communications, deviations from normal procedure and the rationale for exceptional actions.

8. Technology, Data and Artificial Intelligence

Technology can strengthen risk management through electronic reporting, dashboards, barcode verification, predictive analytics, asset tracking, digital twins and automated alerts. However, technology introduces new risks: downtime, interoperability failure, cyberattack, automation bias, alert fatigue, poor data quality and inequitable performance.

Artificial intelligence may assist in detecting deterioration, forecasting demand or identifying unusual patterns in incident data. It should not be treated as infallible. Governance should address validation in the local population, human oversight, explainability appropriate to the use, privacy, cybersecurity, bias monitoring and clear responsibility when recommendations are followed or rejected. A model that performs well in development data may fail after workflow, patient mix or disease prevalence changes.

Technology controls should be included in emergency exercises. Hospitals need tested downtime procedures, backup and restoration, privileged-access controls, network segmentation, patch management, supplier assurance and communication channels independent of the primary system.

9. Illustrative Case: Flooding and Loss of Critical Services

Background

This fictional case illustrates application of the chapter’s methods. Riverside General Hospital is a 350-bed facility located near a river. Its emergency department, imaging department and main electrical switchgear are in the lower level. A severe rainfall warning is issued after several years of increasingly intense storms.

Problem

The hospital’s risk register lists flooding as an environmental risk, but it is rated moderate because no major flood has occurred in recent memory. A review identifies that the same lower level contains the oxygen manifold alarm panel, network distribution equipment and a storeroom containing sterile supplies. The hospital has a generator, but fuel deliveries depend on a bridge that may close.

Analysis

A multidisciplinary team performs hazard analysis. The initiating event is water entering the lower level. Potential effects include loss of electricity, imaging, information systems, oxygen monitoring, sterile supplies and emergency department capacity. The team identifies weak barriers: incomplete flood doors, no alternative network route, insufficient dry storage and an untested agreement with a neighbouring hospital.

The team then conducts a BIA. Emergency care, oxygen-dependent treatment, medication dispensing, laboratory testing and patient communication are classified as critical. The RTO for medication dispensing is set at two hours, while a nonurgent outpatient booking system has an RTO of 48 hours. These targets are operational decisions based on patient harm and service dependencies, not arbitrary technical values.

Approach and solution

The executive team authorizes immediate mitigation: move supplies above flood level, test the generator under load, stage portable pumps, confirm fuel alternatives, protect network equipment, establish a manual medication process and activate a mutual-aid agreement. A tabletop exercise tests evacuation, diversion of ambulances, patient prioritization and public communication.

When heavy rain begins, the incident commander activates the plan early. Nonurgent procedures are postponed, vulnerable patients are transferred, the emergency department is partially relocated and the regional authority is notified. A cyber-independent radio and paper documentation process is used when network equipment is isolated as a precaution.

Outcome

Water enters the lower level, but critical clinical services remain available. Two planned barriers fail: a supplier does not deliver the expected sandbags and one communication list contains outdated contact details. These findings are entered into the corrective-action register. The hospital later relocates network equipment, revises supplier contracts, updates contact verification and includes flood risk in capital planning.

Learning points

1. A low historical frequency does not imply low strategic importance.
2. Dependencies can convert one environmental hazard into a clinical emergency.
3. Early activation may reduce harm more effectively than waiting for visible failure.
4. Business continuity objectives must be defined service by service.
5. Exercises reveal weaknesses that plans alone cannot reveal.
6. Recovery should include investment decisions, not merely restoration of the previous vulnerable state.

10. Challenges and Limitations

Risk matrices create false precision when categories are poorly defined or when scores are manipulated to avoid escalation. FMEA can become a paperwork exercise if frontline staff are excluded or if recommendations rely mainly on training. Risk registers become ineffective when they contain too many trivial risks, lack owners or are reviewed only annually.

Low-frequency, high-consequence events are difficult to estimate because historical data are sparse. Interdependent and cascading failures may be underestimated by tools designed for single events. Human behaviour changes under stress, and controls that work during routine operations may fail during crowding, fatigue or resource scarcity. Preparedness also competes with immediate service pressures, making leadership commitment essential.

No framework replaces professional judgment. Quantitative scores should support, not override, clinical expertise, patient perspectives, legal duties and ethical reasoning. Risk assessment should be revisited after incidents, organizational change, new technology, construction, epidemics or changes in regulation.

Best-Practice Principles

1. Link risk management to the hospital’s strategic and clinical objectives.
2. Use clear risk statements that identify causes, events and consequences.
3. Combine quantitative ratings with expert judgment and narrative analysis.
4. Prioritize high-severity and poorly controlled risks even when numerical scores are modest.
5. Prefer resilient system redesign over reminders and retraining alone.
6. Assign one accountable risk owner and specify evidence of control effectiveness.
7. Include patients, families, frontline workers and external partners in analysis.
8. Test business continuity plans under realistic conditions.
9. Maintain offline capabilities for critical services.
10. Convert incidents and exercises into tracked, verified improvement actions.
11. Communicate honestly and protect privacy during crises.
12. Review the risk profile when technology, infrastructure, demand or strategy changes.

Chapter Summary

Enterprise risk management provides a hospital-wide method for understanding uncertainty in relation to patient care, operations, environment, finance and strategy. A risk register records significant risks, controls, owners and actions, while a risk matrix supports consistent prioritization. FMEA and hazard analysis provide prospective methods for examining failure modes, barriers and consequences; their numerical scores are aids to judgment rather than precise probabilities.

Emergency preparedness converts risk knowledge into capability. Mitigation reduces exposure, preparedness builds capacity, response protects life and essential services, and recovery restores and improves the organization. Business impact analysis establishes critical services, dependencies, recovery objectives and minimum operating requirements. Incident command, crisis communication, ethical decision-making, exercises and after-action learning are essential components of governance.

Resilient hospitals recognize interdependence, design stronger controls, maintain tested downtime arrangements and use technology responsibly. The ultimate measure of risk management is not the absence of all incidents, but the organization’s ability to anticipate hazards, reduce preventable harm, respond coherently and learn continuously.

Key Terms

Risk: The effect of uncertainty on objectives.

Hazard: A source or condition with the potential to cause harm.

Control: A measure that prevents, detects, reduces or manages risk.

Enterprise risk management: An integrated organization-wide approach to risk.

Risk appetite: The amount and type of risk an organization is willing to retain or pursue.

Risk tolerance: The acceptable variation around a specific objective.

Risk register: A structured record of risks, controls, owners and treatments.

Inherent risk: Risk assessed before controls are considered.

Residual risk: Risk remaining after controls are applied.

Risk matrix: A grid that combines likelihood and consequence ratings.

Hazard analysis: Systematic examination of hazards, initiating events, barriers and consequences.

FMEA: A prospective method for identifying and prioritizing process failure modes.

RPN: Risk Priority Number calculated from severity, occurrence and detectability scores.

Business impact analysis: Assessment of service consequences, dependencies and recovery requirements after disruption.

RTO: Target time for restoring a service.

RPO: Maximum acceptable period of data loss.

Incident command: A structured system for directing and coordinating emergency response.

Business continuity: The capability to maintain or restore essential functions during disruption.

Just culture: An approach that supports learning while maintaining fair accountability.

After-action review: A structured evaluation of what occurred, what worked, what failed and what must improve.

Review Questions

5 Short Answer Questions

1. Distinguish between a hazard, a risk and a control.
2. What information should be included in a hospital risk register?
3. Explain the difference between inherent and residual risk.
4. Define recovery time objective and recovery point objective.
5. Why should emergency plans be tested through exercises?

5 Long Answer Questions

1. Explain how enterprise risk management differs from departmental risk management in a hospital.
2. Describe the process of constructing and maintaining a risk register.
3. Explain the strengths and limitations of risk matrices and FMEA.
4. Discuss the relationship among mitigation, preparedness, response and recovery.
5. Analyze the governance, ethical and communication requirements of a major hospital crisis.

3 Analytical / Application Questions

1. A hospital identifies a high-consequence medication error with likelihood 2 and consequence 5 on a five-point matrix. Interpret the score cautiously and recommend additional analysis and controls.
2. Design a business impact analysis for a hospital laboratory information-system outage. Identify critical functions, dependencies, minimum operating requirements and suitable recovery objectives.
3. Using the Riverside General case, propose three additional controls and explain whether each reduces likelihood, consequence, or recovery time.

Multiple Choice Questions with Answers

Question 1

Which statement best describes enterprise risk management in a hospital?

A. It assigns every risk exclusively to the department where it originates.

B. It integrates risks across clinical, operational, environmental and strategic objectives.

C. It focuses only on risks that have already caused patient harm.

D. It eliminates the need for emergency preparedness plans.

Correct Answer: B. It integrates risks across clinical, operational, environmental and strategic objectives.

Question 2

A hazard is best defined as:

A. The numerical product of likelihood and consequence

B. The amount of risk accepted by the governing body

C. A source or condition with the potential to cause harm

D. A completed corrective-action report

Correct Answer: C. A source or condition with the potential to cause harm

Question 3

If likelihood is rated 4 and consequence is rated 5, what is the risk-matrix score using R = L × C?

A. 9

B. 20

C. 25

D. 45

Correct Answer: B. 20

Question 4

Which item is most appropriate for a risk register?

A. A risk owner and documented treatment action

B. Only the name of the department involved

C. A list of staff who made previous errors

D. An unverified prediction without a risk statement

Correct Answer: A. A risk owner and documented treatment action

Question 5

In FMEA, the traditional RPN is calculated as:

A. Severity + occurrence + detectability

B. Severity × occurrence × detectability

C. Occurrence ÷ severity × detectability

D. Severity − occurrence − detectability

Correct Answer: B. Severity × occurrence × detectability

Question 6

Which is an example of a leading risk indicator?

A. Number of patients harmed by falls last year

B. Total cost of a previous flood

C. Percentage of critical equipment receiving scheduled maintenance

D. Number of legal claims already settled

Correct Answer: C. Percentage of critical equipment receiving scheduled maintenance

Question 7

What does a recovery time objective specify?

A. The maximum acceptable period of data loss

B. The target time for restoring a disrupted service

C. The probability that an emergency will occur

D. The number of staff required for a routine shift

Correct Answer: B. The target time for restoring a disrupted service

Question 8

Which action represents mitigation rather than recovery?

A. Repairing damaged equipment after a flood

B. Conducting an after-action review

C. Installing flood barriers before flooding occurs

D. Returning transferred patients after services resume

Correct Answer: C. Installing flood barriers before flooding occurs

Question 9

Why should a high-severity, low-frequency risk receive special attention?

A. A moderate numerical score may conceal catastrophic consequences.

B. Low-frequency events never require controls.

C. Severity is irrelevant in a risk matrix.

D. Such risks can always be transferred to insurers.

Correct Answer: A. A moderate numerical score may conceal catastrophic consequences.

Question 10

Which principle is most consistent with a just culture?

A. Punish every individual involved in an adverse event.

B. Suppress incident reports to protect reputation.

C. Support learning while maintaining fair accountability for reckless conduct.

D. Allow staff to ignore established safety procedures without review.

Correct Answer: C. Support learning while maintaining fair accountability for reckless conduct.