Selected Podcast

Change or Die: How to Make Sure Your ERM Program Keeps Up in a World of Constant Change

Given the dizzying pace of change and the speed with which emerging risks appear, ERM leaders need to ensure their programs are keeping up with the times and with their organization’s changing strategies. This podcast, the fourth in a series of five covering the 5 components of the COSO Framework, will talk about the COSO component of review and revision, which leads the organization to assess substantial changes, review risk and performance, and pursue improvement in ERM.
Change or Die: How to Make Sure Your ERM Program Keeps Up in a World of Constant Change
Featuring:
Rebecca Cady, Esq., BSN, CPHRM, DFASHRM, FACHE | Denise Shope, RN, MHSA, ARM-E, CPHRM, DFASHRM
Rebecca Cady, Esq., BSN, CPHRM, DFASHRM, FACHE is Vice President, Chief Risk Officer at Children’s National Medical Center in Washington, D.C. She is a Bachelor of Science in Nursing graduate of Georgetown University, and a graduate of the University of San Diego School of Law. Prior to coming to CNMC in 2008, Rebecca was a partner at Grace, Hollis, Lowe, Hanson and Schaeffer, a California law firm, where she practiced in the areas of malpractice defense, healthcare, and professional licensure law. She has published extensively in the area of nursing and the law, and is a frequent lecturer to healthcare providers. She was Editor in Chief of the Journal of Nursing Administration's Healthcare Law, Ethics, and Regulation from 2002-2013. She was named the 2018 Risk Manager of the Year by RIMS, the Risk and Insurance Management Society, a global professional organization of risk professionals from all industries. She was also named the 2018 Risk Manager of the Year by ASHRM, the American Society for Healthcare Risk Management. She was recognized as a 2018 Woman to Watch by Business Insurance Magazine in December, 2018. Rebecca is a Distinguished Fellow of ASHRM as well as a Certified Professional Health Care Risk Manager (CPHRM). She is also a board certified healthcare executive, holding the FACHE designation from the American College of Healthcare Executives. Rebecca holds a Certificate in Strategic Decision and Risk Management from Stanford University. She has been an active volunteer with ASHRM, helping to write a variety of publications including Pearls on Medication Safety and Applying Enterprise Risk Management, and the Risk Financing Playbook and Healthcare Claims and Litigation Playbook. She has served on multiple ASHRM committees and task forces including Chair, ASHRM Federal Legislative Advocacy Task Force; Member, ASHRM Nominating Committee; Member, ASHRM Journal Review Board; Member, ASHRM ERM Committee; and Member, ASHRM Bylaws Committee. 

Denise Shope joined RCM&D in 2008 as a Risk Management Consultant within the Healthcare Division. She is a nationally recognized healthcare enterprise risk management professional with over 30 years of healthcare experience, more than 20 of which specializing in risk management, regulatory compliance, quality improvement and patient safety. In her current role, Denise is Team Leader for the RCM&D/SISCO risk and liability claims management services. She provides program leadership and works directly with clients to implement risk mitigation strategies in clinical and non-clinical areas across the healthcare enterprise. In addition, she provides comprehensive professional support services to help clients comply with new and changing regulatory requirements, evaluate emerging exposures through onsite risk assessments, navigate claims processes and develop recommendations and solutions for today’s complex risks. In addition, Denise currently leads RCM&D’s Healthcare Enterprise Risk Management (ERM) service line. Denise is a former President of the American Society for Healthcare Risk Management (ASHRM). She has also served on the Board for ASHRM for two terms. She is currently an active member of ASHRM affiliated chapters in several states. Denise sits on ASHRM’s Enterprise Risk Management Task Force and the ASHRM Leadership Task Force. She is a faculty member for ASHRM’s ERM Certificate program and Healthcare Risk Management Certificate program. She recently co-authored ASHRM’s second edition of the “ERM Playbook for Healthcare.” Denise speaks nationally on several healthcare enterprise risk management topics. Denise has 29 years of healthcare risk management experience. She has presented nationally at ASHRM's Annual Conference on multiple occasions over the years She presented multiple presentations in-person and virtual at state and local chapters. She has been an invited guest speaker to numerous organizations. She is ASHRM faculty.
Transcription:

Bill Klaproth (host): Welcome to the ASHRM Podcast, made possible by the American Society for Healthcare Risk Management to support efforts to advance safe and trusted healthcare through enterprise risk management. You can visit ASHRM, that's A-S-H-R-M.org/membership to learn more and to become an ASHRM member. I'm Bill Klaproth.

On this podcast, we're going to talk about how to make sure your ERM program keeps up in a world of constant change. With me is Denise Shope, team leader, Risk and Claims Management with RCM&D Unison Risk Advisers, and Rebecca Cady, Vice-president, Chief Risk Officer at Children's National Medical Center in Washington, DC.

Rebecca and Denise, thank you so much for your time. We appreciate it. So there is so much change happening around us, how do you keep up with all of that? So, how do you keep your finger on the pulse of what's happening and how do you prioritize what to address?

Rebecca Cady: Thanks, Bill. Glad to be here. So I would look at this in terms of a communication strategy. So you want to read as much as you can. Get on listservs, get signed up for newsletters, really have a good situational awareness of what's happening in your industry and what's happening in your local area. You want to talk to the people in your organization. Talk to the legal department, what deals are they working on? Talk to the strategic planning folks. What things are we considering in terms of partnerships? Talk to them about how things are going with the strategic plan. See if you can get a hold of the latest update to the board of directors on how the strategic plan is going. And then, just talk and find out what people are worried about. And then lastly, talk to your peers. What are they seeing? What are their boards worried about? Is there something that they may have picked up on that you guys haven't picked up on yet? But that still could be something you need to worry about.

And then in terms of prioritization, I would say really focusing on stuff that will impact your strategic plan would be at the top of the list. The other things that I always try to prioritize are things that we realized that we don't have a good plan for yet, right? So if there's something bubbling up there and we look and say, "Well, wow, we really don't have anything in place as to how we're going to handle this if and when it happens to us." Those are the kinds of things that I would escalate.

And then, you also want to really look at anything that's bubbling up that might threaten your regulatory status. Because obviously, if you get something like a big thing from CMS, or if joint commission is coming in, if you're getting an immediate jeopardy visit, then those are things that can really escalate quickly and impair the organization. So that's another way that I prioritize stuff. But, Denise, you see programs from all over. What kinds of things are you using in this area?

Denise Shope: Yeah. Hi, Becky. Thanks for including me today. And I appreciate that as well. I agree with everything you said. I think that as far as your prioritization, you need to really look both, like you mentioned, internally in your organization, what's happening with your strategic plan, what other initiatives are occurring; but then, also look external to your organization as well. What's happening in the industry? What's happening to your competitors? Are there risks or events or untoward occurrences that are happening that make you pause and go, "Hmm. Have we addressed that situation in our ERM plan? Is this something that could happen to us?" What other trends are happening even in the market in general? Whether it's with your competitors or, you know, on the insurance front. Don't be afraid to ask questions.

And I think also as far as prioritization, you really need to be nimble, right? You might have a great plan in place. You've got your sort of three, four or five risks that you've prioritized. But now, you're halfway through the year and something changes, something like a pandemic, for example. You need to be able to pivot and really readjust your ERM plan to address those emerging risks that you may not have seen six months ago or even a year ago.

Bill Klaproth (host): Excellent information. I took some quick notes. So, have a situational awareness, talk to the various departments, talk and find out what people are worried about, right? Talk to your peers as well. And then, also, make sure you think of things you don't have a plan for, which is a great idea, and anything that threatens your regulatory status. And then, look externally in the industry, look for trends, ask questions. Great, great advice. So thank you for that. And then Rebecca, what metrics should ERM professionals consider tracking in order to understand the performance of their ERM program?

Rebecca Cady: Thanks. So I like to look at this as a mix of what I would call hard metrics and soft metrics. And I'll give you a little bit of an example of what I mean by that. So a hard metric would be how many event reports are you getting a year on things that are enterprise risk events or concerns. We track patient safety, reporting all the time, but we should also be tracking the number of enterprise-related business events that get reported to us and what kind of events are getting reported to us. So that's kind of a hard metric.

But on the soft side, what are the things that people are sending to you, where they're saying, "Hey, you know, we're thinking about doing this and we thought we'd better pull risk in" or where you're at a meeting with a CEO who asks a question that's very enterprise risk-focused. So those are the softer signs that your program is performing well, when people are coming to you early with strategic things to get your input on the front end, when the CEO and other members of leadership are asking these kinds of questions or making those comments during meetings, that's kind of a softer sign that you're making progress in your work.

The next thing I would look for is how many nasty surprises have we had over the last year. And what do I mean by that? That's kind of my shorthand term for any unreported event that bubbles up that was knowable, but that nobody picked up and told the organization about, so that it kind of swooped in and made a nasty surprise for people to have to deal with.

And then the next thing I would look at is, are you doing RCAs or any kind of performance improvement work on your business events? If you're not, I highly recommend that you should be because really, if you're moving towards high reliability on the business side, you really need to get to those root causes and what are causing these things to happen so that you can put plans into place to fix them.

And then lastly, I would measure this against your ERM work plan. Are you getting the things done that you said you were going to do? Ideally, you have a work plan for the year, but you should also have a two, three, four-year plan that really has built in kind of the maturity of your program and how are you pulling your program along to be a more mature program. So plain and simple, like are you getting this stuff done? Are you getting it done on time? And is it working? Those are the kinds of things I would look at. Denise, how about you?

Denise Shope: Yeah, I agree. I especially agree with the work plan piece, Becky, that you are going to have your ERM work plan, right? And you're going to have very specific, maybe high-level objectives within that plan. But then, I think it's really important to make sure that you have goals and tactics of how you're going to actually move the needle as it relates to those risks that you've identified.

And so go back to that ERM work plan, look at those goals, look at those objectives and then look at the tactics that you put into place. So even some metrics as it relates to did you create the infrastructure, particularly if you're early on in your ERM program. Did you create the infrastructure and the communication plan that you designed? And were you able to launch that and implement that?

So these are sort of outcome performance metrics, if you will. But basically going back and saying, "Did we do what we said we were going to do? Did we meet as frequently as we wanted to do? Did we create meaningful reports internally so that we were able to take action when it was appropriate?" So again, just sort of measuring the components of your ERM work plan are really important as well, especially early on. And as you mentioned, as you go forward and your plan develops, your maturity will develop as well and your metrics will follow through with that.

Bill Klaproth (host): Thank you for the really good advice and great tips from you, Rebecca and Denise. So thank you for that. And then Rebecca, how often should an organization be assessing its ERM program maturity?

Rebecca Cady: So I wouldn't do a formal assessment any more often than every other year. Importantly, you're going to have some idea based again on how much progress are you making on your work plan and your multi-year plan. If you're getting those things done, then you should actually have a fairly good real-time feel for the maturity of your program. It may be important every couple of years to sort of formally have that assessed. Some programs actually get an assessment from an outside source where you've got someone coming in from the outside to look at your program and validate that, "Yes, you're at X or Y or Z maturity level." I don't really think that's necessary. If you've got the money and have found somebody who can do it for you, that's fine. But I think you can measure that based on the own work that you're doing and what progress you're making there.

Denise Shope: Yeah. I agree, Becky. I think that, as you said, doing what I call large-scale enterprise-wide risk assessment, we usually recommend at least every three years, certainly no more frequently than every two years. And then in the interim, if in fact the organization is seeing different changes or they've met certain goals as far as their current ERM plan, they may want to go back and do what I would call sort of a micro-assessment and kind of maybe do some interviews with some key leaders and say, "You know, what else is happening? Is there something we've missed on our ERM work plan? "And on our risk registry, do we need to adjust this somehow because of either internal or external forces that are really making us kind of relook at the work that we're doing?

And again, that doesn't have to be the full-scale, deep-dive risk assessment, but rather just sort of a touchpoint halfway through that process, through that cyclical process of really evaluating whether or not you've got the right risks on your register.

And I agree, as time goes on, you'll be able to then again go back and evaluate on an ongoing basis the efficacy of that larger ERM plan, are you meeting those goals? Are you meeting those objectives and really being able to drive ERM as part of the ongoing culture and structure within the organization.

Bill Klaproth (host): Well, thank you both for your time today. Before we wrap up, if I could just get final thoughts from each of you. Rebecca, let me start with you. When it comes to change or die, how to make sure your ERM program keeps up in a world of constant change, any final thoughts on that?

Rebecca Cady: I would say, just keep making incremental progress. Don't ever get to what we used to call the okay corral, where you're just kind of floating along. And if you're not agitating to do something new or something more sophisticated, then you may be in danger of your program dying.

Bill Klaproth (host): Don't fall into the okay corral. I love that. And Denise, any final thoughts from you?

Denise Shope: I agree. And we have a colleague that always says don't let perfect get in the way of good, meaning don't be afraid to launch your program. Don't be afraid to move forward. You can tweak it as you go. You'll get better as time goes on. But if you're just always in the planning phase and never able to launch or execute, then you'll never get off the ground. And I think that's the most important thing. Don't be afraid to challenge yourself and don't be afraid to make some mistakes as well. It's not a perfect process and like risk management programs, even traditional programs, you've seen one, you've seen one. ERM in healthcare is somewhat similar to that, you've seen one program, you've seen one. So, make it work in your organization, embed the work in the work that you're already doing, but keep enterprise risk management on the agenda, especially with your senior executives.

Bill Klaproth (host): If you've seen one, you've seen one. I love that. That's so good. So good. Well, Rebecca and Denise, thank you so much for your time. This has really been informative. We appreciate it. Thanks again.

Rebecca Cady: Thank you. It's been fun.

Denise Shope: Sure. Have a good day. Thank you.

Bill Klaproth (host): And once again, that's Denise Shope and Rebecca Cady, and the next offerings for ASHRM's ERM, certificate program will be July 13th and 14th at the ASHRM Express in September 9th and 10th at the pre-conference program. For more information, visit ASHRM.org/education/ermcertificate. And if you found this podcast helpful, please share it on your social channels and check out the full podcast library for topics of interest to you. I'm Bill Klaproth. Thanks for listening.