HR Governance, Risk, Compliance and Accreditation

Introduction and Context

Human resource management in health care is inseparable from patient safety, professional accountability and organisational legitimacy. A hospital may possess sophisticated clinical technology, but it cannot deliver safe care if staff are inadequately qualified, improperly deployed, poorly supervised or permitted to practise beyond their competence. HR governance therefore extends beyond recruitment and payroll. It concerns the systems through which an organisation ensures that people are competent, authorised, supported, accountable and appropriately managed throughout the employment life cycle.

HR governance is the framework of structures, decision rights, policies, controls and reporting arrangements through which workforce-related decisions are directed and monitored. In health care, it intersects with clinical governance, corporate governance, information governance, safeguarding, occupational health and regulatory compliance. Its central question is not merely whether a person is employed, but whether the organisation can demonstrate that the person is safe and legally permitted to perform particular duties in a particular context.

This chapter examines credentialing, privileging, scope of practice, documentation, safeguarding, audit, risk management and accreditation. It also considers the relationship between compliance and organisational learning. Compliance is a minimum obligation; effective governance uses compliance information to identify system weaknesses, improve workforce capability and protect patients and staff.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain the meaning and strategic significance of HR governance in health care.
2. Distinguish credentialing, privileging, licensure, competence and scope of practice.
3. Design accountability structures for workforce-related risks.
4. Evaluate controls for recruitment, documentation, safeguarding and professional practice.
5. Develop an audit and assurance approach linked to clinical and corporate governance.
6. Analyse how accreditation and regulation influence HR systems.
7. Apply these concepts to a complex health-care case.

1. The Governance Architecture of Health-Care HR

1.1 Governance, management and compliance

Governance determines direction, accountability and oversight. Management translates that direction into operational decisions. Compliance is conformity with applicable law, regulation, professional standards, contracts, internal policies and accreditation requirements. These concepts are related but not interchangeable:

• Governance asks who has authority, who is accountable and how decisions are scrutinised.
• Management asks how work is organised and resources are deployed.
• Compliance asks whether required standards have been met.
• Assurance provides credible evidence that controls are designed and operating effectively.

A board may delegate operational responsibility for credentialing to a medical staff office, but it cannot delegate ultimate accountability for the safety of the governance system. Similarly, a human resources director may own employment records, while a clinical department chair owns assessment of clinical privileges. Clear allocation of responsibilities prevents both duplication and dangerous gaps.

1.2 Three lines of accountability

A useful model is the Three Lines Model:

The board, executive committee and relevant professional committees sit above these lines as governing authorities. The model is not a substitute for professional judgement. It clarifies that risk ownership remains with operational leaders; compliance personnel do not “own” every risk simply because they monitor it.

1.3 The accountability chain

An effective HR governance system connects five elements:

1. Authority: who may approve appointment, practice privileges, leave, suspension or return to work?
2. Evidence: what documents or observations support the decision?
3. Decision criteria: what standards must be satisfied?
4. Escalation: what happens when evidence is incomplete or risk is unacceptable?
5. Review: how and when is the decision reassessed?

For example, a surgeon’s authority to perform a procedure should not rest solely on a job title. It should be supported by current registration, verified qualifications, recent competence evidence, health clearance where relevant, peer review, defined privileges and a process for renewal or restriction.

2. Credentialing, Privileging and Scope of Practice

2.1 Credentialing

Credentialing is the formal process of collecting and verifying information about a practitioner’s identity, education, training, licensure, registration, employment history, professional standing, competence and conduct. It is primarily an evidence-verification process. Typical checks include:

• identity and right-to-work documentation;
• primary-source verification of qualifications and registration;
• references and employment history;
• disciplinary, malpractice or professional-conduct history, where legally permissible;
• immunisation, occupational health and infection-prevention requirements;
• mandatory training and competency records;
• declarations of conflicts of interest and health-related limitations relevant to safe practice.

Primary-source verification means obtaining confirmation from the issuing institution or an authoritative register, rather than relying solely on a photocopy supplied by the applicant. The exact requirements vary by jurisdiction and profession. Organisations must therefore map their process to applicable law, professional regulation and accreditation standards.

2.2 Privileging

Privileging is the formal authorisation granted by an organisation to perform specified clinical activities. A practitioner may hold a valid professional licence yet lack organisational privileges for a particular procedure. Privileges should be:

• specific rather than vague;
• based on demonstrated competence and available facilities;
• limited to the organisation’s scope of services;
• approved by an authorised committee or executive;
• reviewed at defined intervals and after significant concerns.

A privilege such as “surgery” is usually too broad for effective governance. A more defensible system specifies procedure, setting, patient population, required equipment, supervision requirements and evidence of competence.

2.3 Scope of practice

Scope of practice defines the activities a worker is educated, competent, authorised and permitted to perform. It is influenced by four boundaries:

1. Professional boundary: what the profession’s regulator permits.
2. Individual competence boundary: what the person can perform safely.
3. Organisational boundary: what the employer authorises.
4. Contextual boundary: what is appropriate given the patient, resources, supervision and environment.

Scope is therefore dynamic. A registered nurse may be legally able to perform a task but not competent to perform it independently in a specialised unit. Conversely, a worker may have competence from prior employment but lack current organisational authorisation.

2.4 Appointment, credentialing and privileging workflow

A robust workflow generally follows this sequence:

1. Define the role and inherent risks.
2. Advertise and recruit against objective criteria.
3. Collect documents using a controlled checklist.
4. Verify primary sources and investigate discrepancies.
5. Conduct structured selection and references.
6. Obtain professional, occupational-health and safeguarding clearances.
7. Make a conditional appointment if evidence remains outstanding.
8. Assess competence and recommend scope or privileges.
9. Approve appointment and privileges through delegated authority.
10. Monitor practice, incidents, complaints and continuing competence.
11. Recredential and reapprove at scheduled intervals or after triggers.

No worker should be permitted to perform restricted duties merely because recruitment pressure is high. If provisional practice is permitted by law and policy, it must have explicit limits, supervision and an expiry date.

3. HR Risk Management in Clinical Organisations

3.1 Risk identification

HR risks may arise from people, processes, technology, culture or external conditions. Important categories include:

• unverified qualifications or fraudulent documents;
• expired registration, certification or work authorisation;
• inadequate staffing, fatigue or unsafe workload;
• skill mix that does not match patient acuity;
• unreported impairment or conflicts of interest;
• violence, harassment, discrimination or retaliation;
• safeguarding failures involving children, older adults or vulnerable persons;
• privacy breaches and inappropriate access to records;
• poor documentation and inability to demonstrate compliance;
• weak induction, supervision or competency assessment;
• inappropriate use of agency, temporary or contracted staff.

Risk assessment should consider both likelihood and consequence. A simple qualitative matrix may classify risks as low, moderate, high or extreme. Numerical scoring can support prioritisation, but it should not create false precision. A rare event with catastrophic consequences may require stronger controls than a frequent event with minor consequences.

3.2 The control hierarchy

Controls can be structured as:

• Preventive controls: eligibility checks, segregation of duties, minimum staffing requirements and access restrictions.
• Detective controls: expiry reports, file audits, incident reporting, supervision records and exception monitoring.
• Corrective controls: retraining, restriction of duties, investigation, disciplinary action and system redesign.
• Directive controls: policies, standards, role descriptions and clinical protocols.

A mature system does not rely on annual training alone. It combines preventive design with continuous detection and proportionate correction.

3.3 Risk appetite and escalation

The board should define, or approve, the organisation’s tolerance for workforce risks. There should generally be no tolerance for falsified credentials, deliberate concealment of impairment, abuse or practice by an unlicensed person. Other risks may be managed within limits—for example, temporary staffing shortages—provided escalation, mitigation and monitoring are documented.

Escalation criteria should be explicit. Examples include expired registration, unexplained gaps in employment, serious safeguarding allegations, repeated competency failure, unsafe staffing ratios or an inability to verify a critical qualification. Escalation may involve temporary removal from duty, supervision, referral to a professional committee, investigation or notification to a regulator, subject to law and due process.

4. Documentation, Data Quality and the Employment Record

4.1 The employment record as a control system

HR documentation is not administrative decoration. It is evidence that the organisation made reasonable, consistent and lawful decisions. A complete file may include recruitment records, identity verification, qualifications, registration, job description, employment contract, orientation, training, competency assessments, performance reviews, occupational-health information, incidents, accommodations, disciplinary processes and privilege decisions.

Records should be accurate, current, accessible to authorised users and retained for legally specified periods. Sensitive information should be separated or access-restricted according to confidentiality requirements. The principle of data minimisation requires collecting and retaining only information necessary for a legitimate purpose.

4.2 Documentation principles

Good documentation is:

• contemporaneous: created close to the event;
• attributable: identifies the author and authorisation;
• accurate: reflects what occurred without misleading omissions;
• complete: includes decisions, rationale and follow-up;
• secure: protected against unauthorised access or alteration;
• retrievable: available for operational and assurance purposes;
• disposition-controlled: retained, archived and destroyed according to policy.

Electronic HR systems should use role-based access, audit trails, version control, alerts for expiry and controlled workflows. Automation improves reliability only when source data and governance rules are sound. A dashboard displaying “100% compliant” may be misleading if records are incomplete or status definitions are poorly designed.

4.3 Data quality and audit indicators

Useful indicators include the proportion of active workers with current registration evidence, the proportion of privileges reviewed by their due date and the number of unresolved documentation exceptions. If a rate is calculated, its denominator must be defined. For example:

The formula assumes that the organisation has a reliable list of active practitioners and a clearly defined set of required evidence. It measures documented completion, not actual competence. A high rate cannot compensate for weak criteria or superficial verification.

5. Safeguarding and Fair Process

Safeguarding concerns the prevention and response to abuse, neglect, exploitation and avoidable harm, particularly involving children, older people, people with disabilities and others in vulnerable situations. HR has responsibilities before, during and after employment.

Pre-employment controls may include identity checks, references, criminal-record checks where lawful, and safeguarding-specific interview questions. During employment, organisations require training, codes of conduct, supervision, speaking-up channels and procedures for responding to concerns. After an allegation, the organisation must protect the person at risk, preserve evidence, prevent retaliation and follow reporting obligations.

Safeguarding controls must be balanced with employment rights, confidentiality and procedural fairness. An allegation is not automatically proof of misconduct, but it may justify interim risk controls while facts are established. Investigations should be timely, impartial, documented and proportionate. Managers must distinguish performance concerns, professional misconduct, criminal conduct, ill health and organisational failure; each may require different processes.

A psychologically safe reporting culture is a governance control. If staff fear punishment for raising concerns, formal compliance indicators may look positive while risks remain hidden. Non-retaliation policies, confidential reporting and visible executive responses are therefore substantive—not merely cultural—controls.

6. Auditing, Assurance and Accreditation

6.1 Compliance audit and clinical assurance

An HR compliance audit tests whether required processes and evidence exist. Clinical assurance asks whether those processes are producing safe practice. Both are necessary. A file may contain a completed competency form while observation, incident data or peer review indicates that competence is not sustained.

An audit programme should be risk-based. High-risk activities—such as anaesthesia, medication administration, invasive procedures, emergency response and safeguarding—deserve more frequent or deeper review than low-risk administrative tasks.

A practical audit cycle is:

1. Define the standard and population.
2. Identify the risk and control objective.
3. Select a representative or risk-targeted sample.
4. Examine documents, systems and practice observations.
5. Record exceptions using consistent definitions.
6. Analyse root causes rather than only counting failures.
7. Agree corrective actions, owners and deadlines.
8. Re-test and report residual risk to the appropriate committee.

6.2 Accreditation

Accreditation is an external evaluation against recognised standards. It can strengthen consistency, transparency and public confidence, but it may also encourage symbolic compliance if organisations focus on preparing documents for inspection rather than improving daily practice. Accreditation should be integrated into the organisation’s quality and risk system, not treated as a periodic event.

HR-related accreditation evidence commonly concerns:

• workforce planning and staffing competence;
• orientation and mandatory education;
• credentialing and privileging;
• performance evaluation;
• health and safety of staff;
• safeguarding and conduct;
• incident reporting and learning;
• records, privacy and information security.

The precise standards differ across jurisdictions and accrediting bodies. Leaders must avoid assuming that one accreditation framework is legally equivalent to a regulator’s requirements. Accreditation may supplement, but cannot replace, statutory compliance.

6.3 Audit metrics and interpretation

A dashboard may include completion rates, overdue renewals, time to close exceptions, serious incidents involving scope-of-practice issues, agency-worker compliance and staff reporting indicators. Metrics should be interpreted with context. A decline in reported incidents may indicate improvement—or fear of reporting. A rise may reflect deterioration—or a healthier reporting culture.

Where a sample estimate is used, uncertainty should be acknowledged. For a simple proportion, the estimated rate is:

where x is the number of compliant cases and n is the number reviewed. This estimate is descriptive and does not by itself establish that all workers are compliant. Sampling design, case selection and definitions affect interpretation.

7. Integrating HR Governance with Clinical and Corporate Governance

HR risks should appear in the same governance conversations as finance, quality, information security and enterprise risk. Important linkages include:

• Clinical governance: competence, staffing, supervision, incident review and professional accountability.
• Corporate governance: legal compliance, reputation, workforce strategy, financial sustainability and executive accountability.
• Information governance: confidentiality, access rights, cyber awareness and data quality.
• Occupational health and safety: fatigue, violence prevention, infection exposure and safe work design.
• Ethics governance: fairness, conflicts of interest, dignity, non-discrimination and proportionality.

A strong committee architecture avoids isolated decision-making. For example, a serious medication incident involving an agency nurse may require review by nursing leadership, HR, quality and risk, occupational health, information governance and executive management. The purpose is not to distribute blame, but to determine whether recruitment, induction, supervision, workload, reporting or system design contributed to the event.

8. Ethical and Legal Tensions

HR governance frequently involves competing values. Organisations must protect patients while respecting employee privacy, due process and equality. They must act rapidly in emergencies while avoiding arbitrary decisions. They must use data for assurance while preventing surveillance that undermines trust.

Key principles include:

• legality and proportionality;
• fairness and consistency;
• confidentiality and need-to-know access;
• transparency of criteria and decisions;
• non-discrimination and reasonable accommodation;
• independence in investigation;
• documentation of rationale;
• right of review or appeal where applicable.

Credentialing should not become a tool for exclusion unrelated to patient safety. Conversely, concerns about discrimination must not prevent an organisation from imposing legitimate competence or safeguarding requirements. Policies should be reviewed for disparate impact, and decision-makers should be trained to distinguish evidence-based risk controls from stereotypes.

9. Technology, Automation and Artificial Intelligence

Digital credentialing platforms can integrate registration databases, training systems, expiry alerts, incident data and privilege management. They reduce manual error but create new risks: incorrect data linkage, access breaches, automation bias and overreliance on incomplete records.

Artificial intelligence may assist with anomaly detection—for example, identifying unusual expiry patterns, duplicate identities or inconsistencies between privileges and documented training. It should not make unreviewable decisions about suspension, employability or professional competence. Human oversight, explainability, data protection, validation and bias testing are essential. AI outputs should be treated as risk signals requiring investigation, not as proof of misconduct.

Technology governance should specify data ownership, source authority, correction procedures, audit logs, retention, cybersecurity and responsibility for false alerts. A technically sophisticated system cannot compensate for unclear accountability.

10. Illustrative Case: The Unverified Specialist

Background

Northbridge Medical Centre, a fictional regional hospital, recruited a specialist physician during a severe staffing shortage. The physician supplied a certificate of specialist training and reported current registration. HR entered the data into the workforce system, but primary-source verification was incomplete. The clinical department granted broad procedural privileges on the basis of a senior manager’s recommendation. The hospital’s policy required annual review, but the privilege review queue was not monitored.

Problem

Six months later, a patient experienced a serious complication during a procedure. The investigation found that the physician had performed a technique rarely used at Northbridge and had not completed the hospital’s required competency assessment. The registration record was current, but the specialist certificate could not initially be confirmed. The physician had also been working excessive hours because of rota gaps.

Analysis

The event was not solely an individual failure. Multiple controls failed:

• recruitment prioritised speed over verification;
• the role description did not distinguish general from specialised procedures;
• credentialing and privileging were treated as one activity;
• the committee approved broad privileges without procedure-specific evidence;
• fatigue risk was not incorporated into roster governance;
• the electronic system generated no effective escalation for incomplete verification;
• the board dashboard reported “credential files complete” without defining completion.

The hospital also faced ethical and legal duties: immediate patient safety action, fair investigation, notification of relevant authorities where required and protection of confidential information.

Approach and solution

Northbridge immediately restricted the physician’s high-risk privileges while preserving employment rights and providing due process. An independent review verified the physician’s registration, qualifications and prior experience. The hospital introduced procedure-specific privileges, supervised competency assessment, expiry alerts and a rule that no practitioner could perform a restricted procedure until all evidence was approved.

It also created a joint HR–medical staff credentialing committee, established a monthly exception report, added fatigue indicators to workforce risk reporting and audited a sample of agency and permanent staff files. The board required quarterly reporting of overdue credentials, unresolved high-risk exceptions and corrective-action closure.

Outcome

The physician was permitted to continue lower-risk clinical work under defined supervision after evidence was clarified, but the disputed procedure remained restricted until competence was demonstrated. The hospital identified several additional incomplete files and corrected them before harm occurred. The review concluded that disciplinary action alone would not address the system weaknesses.

Learning points

1. A current licence does not prove competence for every organisational privilege.
2. Broad titles conceal risk; privileges should be specific.
3. Staffing pressure explains a control failure but does not justify it.
4. HR, clinical and corporate governance must share risk information.
5. A metric is useful only when its definitions and evidence are reliable.
6. Fair process and immediate safety controls can operate together.

11. Implementation Framework for Health-Care Leaders

Leaders introducing or strengthening HR governance can proceed through the following staged framework:

Stage 1: Establish the risk universe

Map regulated roles, high-risk procedures, vulnerable populations, critical records and external obligations.

Stage 2: Clarify authority

Create a responsibility matrix identifying who recommends, verifies, approves, monitors, escalates and assures each workforce decision.

Stage 3: Standardise controls

Use controlled checklists, primary-source verification, role-specific competencies, privilege criteria, expiry alerts and documented exception processes.

Stage 4: Integrate information

Connect HR, learning, registration, incident, rostering and privilege systems while preserving privacy and access controls.

Stage 5: Assure effectiveness

Conduct risk-based audits, observation, peer review and trend analysis. Test whether controls work in practice, not merely whether forms are completed.

Stage 6: Learn and improve

Use incidents, complaints, staff concerns, audit findings and accreditation feedback to redesign systems. Track corrective actions to closure and communicate lessons without compromising confidentiality.

Challenges and Limitations

Several difficulties persist. Regulations may be fragmented across professions and jurisdictions. Temporary and contract workers may be managed through different systems. Small organisations may lack specialist credentialing staff. Digital records may be incomplete or incompatible. Excessive bureaucracy can delay recruitment and encourage workarounds, while weak controls expose patients and organisations to serious harm.

There is also a measurement problem: documentation is easier to count than competence, culture or ethical judgement. Leaders should therefore combine quantitative indicators with interviews, observation, case review and staff feedback. Finally, no governance system eliminates risk. The objective is defensible, proportionate and continuously improving control, supported by professional judgement and a culture of accountability.

Best-Practice Principles

• Treat credentialing and privileging as distinct but connected processes.
• Define scope of practice at the level of actual tasks and contexts.
• Use primary-source verification for critical qualifications and registration.
• Make exceptions visible, time-limited and owned by a named person.
• Link HR dashboards to clinical incidents, staffing and patient-safety indicators.
• Audit high-risk roles more deeply and more often.
• Protect confidentiality while ensuring appropriate escalation.
• Provide fair investigation, appeal and non-retaliation mechanisms.
• Use technology to strengthen—not replace—professional judgement.
• Ensure the board receives meaningful assurance about workforce risk.

Chapter Summary

HR governance in health care establishes the authority, evidence, controls and accountability needed to ensure that workers are qualified, competent, authorised and safe to practise. Credentialing verifies a practitioner’s background and professional standing; privileging authorises specified activities; scope of practice defines the intersection of professional regulation, individual competence, organisational permission and clinical context.

Effective governance uses preventive, detective and corrective controls across recruitment, documentation, safeguarding, supervision, rostering and performance management. Risk-based auditing tests both documentary compliance and actual practice. Accreditation can strengthen systems, but it supplements rather than replaces legal and professional obligations. HR risks must be integrated with clinical, corporate, information, occupational-health and ethics governance.

The strategic task is to create reliable systems that support safe care while preserving fairness, privacy, proportionality and due process. Mature organisations use incidents and audit findings for learning, maintain clear escalation routes and hold governing bodies accountable for the effectiveness of workforce controls.

Key Terms

Accreditation: External evaluation of an organisation against recognised standards.

Assurance: Evidence-based confidence that governance and controls are designed and operating effectively.

Clinical governance: Structures and processes through which organisations maintain and improve clinical quality and safety.

Competence: The knowledge, skills, judgement and behaviours required to perform a task safely.

Credentialing: Verification of a practitioner’s identity, qualifications, registration, experience and professional standing.

Due process: Fair, transparent and procedurally appropriate investigation and decision-making.

First line: Operational managers and professionals who own and manage risks.

HR governance: Direction, accountability and oversight of workforce-related decisions and controls.

Primary-source verification: Confirmation of credentials directly from the issuing authority.

Privilege: Organisational authorisation to perform specified clinical activities.

Professional registration: Formal inclusion on a regulatory register permitting professional practice under applicable law.

Risk appetite: The level and type of risk an organisation is willing to accept.

Safeguarding: Prevention and response to abuse, neglect, exploitation and avoidable harm.

Scope of practice: The activities a person is educated, competent, authorised and permitted to perform.

Second line: Specialist functions that advise, set standards and monitor risk.

Third line: Independent internal or external assurance, commonly audit.

Three Lines Model: A framework distinguishing operational risk ownership, oversight and independent assurance.

Workforce compliance: Conformity of workforce practices with law, policy, professional requirements and standards.

Review Questions

Short Answer Questions

1. What is the difference between credentialing and privileging?
2. Identify the four boundaries that influence scope of practice.
3. What is the purpose of primary-source verification?
4. Name three examples of preventive HR controls in health care.
5. Why should accreditation not be treated as a substitute for legal compliance?

Long Answer Questions

1. Explain how HR governance contributes to patient safety and organisational legitimacy.
2. Discuss the application of the Three Lines Model to workforce risk in a hospital.
3. Analyse the relationship between documentation quality, audit and assurance.
4. Explain the ethical tensions involved in restricting a practitioner’s duties after an allegation.
5. Design a governance framework for credentialing and privileging in a specialist hospital.

Analytical / Application Questions

1. A hospital has current registration evidence for 98% of its clinicians, but repeated incidents involve staff working beyond approved privileges. Analyse what the metric fails to show and propose corrective controls.
2. An AI system flags several clinicians as having unusual credential records. Develop a fair and legally defensible response process that uses the alerts without treating them as proof of misconduct.
3. A rural facility faces an urgent shortage of qualified staff. Evaluate how it could use provisional appointments or supervised practice while maintaining patient safety, documentation and accountability.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes credentialing from privileging?

A. Credentialing authorises procedures, while privileging verifies identity.

B. Credentialing verifies professional evidence, while privileging authorises specified organisational activities.

C. Credentialing applies only to nurses, while privileging applies only to physicians.

D. Credentialing is voluntary, while privileging is always imposed by a regulator.

Correct Answer: B. Credentialing verifies professional evidence, while privileging authorises specified organisational activities.

Question 2

Which is an example of a preventive HR control?

A. Reviewing an incident after patient harm occurs

B. Counting overdue training records at year end

C. Verifying a practitioner’s registration before appointment

D. Conducting a retrospective external audit

Correct Answer: C. Verifying a practitioner’s registration before appointment

Question 3

A practitioner has a current professional licence but no evidence of competence for a specialised procedure. What is the most appropriate governance response?

A. Permit the procedure because the licence is current

B. Grant unrestricted privileges because the practitioner is experienced

C. Restrict the procedure until competence is assessed and approved

D. Terminate employment automatically without investigation

Correct Answer: C. Restrict the procedure until competence is assessed and approved

Question 4

In the Three Lines Model, who primarily owns day-to-day workforce risk?

A. Operational managers and clinical professionals

B. External accrediting organisations

C. The internal audit department

D. The information technology vendor

Correct Answer: A. Operational managers and clinical professionals

Question 5

What does primary-source verification mean?

A. Accepting a photocopy supplied by the applicant

B. Confirming a credential with the issuing authority

C. Asking a colleague whether the applicant is competent

D. Using an unverified online biography

Correct Answer: B. Confirming a credential with the issuing authority

Question 6

Which statement about accreditation is most accurate?

A. Accreditation replaces statutory regulation

B. Accreditation evaluates organisations against recognised standards and supplements legal compliance

C. Accreditation proves that every employee is continuously competent

D. Accreditation eliminates the need for internal audit

Correct Answer: B. Accreditation evaluates organisations against recognised standards and supplements legal compliance

Question 7

If 45 of 50 sampled practitioner files contain all required credentialing evidence, what is the documented completion rate?

A. 5%

B. 45%

C. 90%

D. 95%

Correct Answer: C. 90%

Question 8

Why should an AI-generated credentialing alert not automatically result in suspension?

A. AI systems are never useful in HR governance

B. An alert is a risk signal requiring human review and due process

C. Suspension is never permitted in health care

D. Credential records do not require verification

Correct Answer: B. An alert is a risk signal requiring human review and due process

Question 9

Which practice best supports psychologically safe safeguarding reporting?

A. Punishing staff who raise concerns that are not substantiated

B. Removing all confidentiality protections

C. Providing non-retaliation protections and clear reporting routes

D. Allowing only senior physicians to report concerns

Correct Answer: C. Providing non-retaliation protections and clear reporting routes

Question 10

Why should a privilege be defined by specific procedures rather than a broad title such as “surgery”?

A. Specific privileges link authorisation to competence, context and available resources

B. Broad titles are always illegal

C. Specific privileges eliminate the need for professional registration

D. Broad titles improve audit accuracy

Correct Answer: A. Specific privileges link authorisation to competence, context and available resources