In the current environment—with an uncertain recovery from COVID’s impacts, workforce shortages, heightened geopolitical tensions, inflationary pressures, and rising interest rates—health system leaders must consider how risk management efforts can be advanced to promote better decisions to address their greatest challenges. Recognizing that not all risk management practices have produced the results intended, the key question is, “How do we leverage our risk awareness to prompt action?”
While risk management is an important functional idea, many efforts fail to be organizationally impactful; we think this reflects the idea that effectiveness is not in the risk management function itself, but in how risk management is used to shape the more important job of resource management. In this article, we define key characteristics of a high-functioning, actionable risk management process and describe how it can connect to a broader resource strategy for your organization.
Today’s challenges need sophisticated risk management
Consider how your risk management processes may help prepare your organization for these and similar challenges:
- A long-term partner in a key service line abruptly exits an agreement that had few restrictions on termination of the partnership to side with a competitor
- A new business venture with anticipated accretive value fails to live up to expectations
- Inflation upsets operating expense and capital spending decisions, requiring a greater degree of strategic prioritization
Ideally, a sophisticated risk management program would identify and quantify these problems before they materialize and either prepare for the issue or mitigate it altogether. In practice, risk management systems should not try to anticipate every risk but rather prepare a process for communication, monitoring, and reaction to the unanticipated.
Building on established enterprise risk management practices
There are two risk management processes that are used to varying degrees across healthcare:
- Enterprise Risk Management (ERM) is an in-house approach that focuses on simply identifying the broad spectrum of risks an organization might face. ERM has a purpose serving audit and compliance needs, along with building a culture of risk awareness.
- Organizational Asset-Liability Management (ALM), which is typically an outsourced initiative, is financially centric and is the favorite of investment consultants and investment bankers. Some ALM models claim the ERM label by introducing operating-related risks, but always at a high level and always from an investment-forward point of view.
There is a common desire to increase the relevance of risk management for critical business decisions, even beyond operating risks. Current efforts, such as a risk heat map evaluation that uses a 1-to-5 scale of likelihood and magnitude of risk impact, are directionally influential, but risk management should be challenged to enhance these efforts for greater relevance.
For health systems that have allowed their ERM programs to lapse or have yet to install one, risk management may be driven in an ad hoc manner by leadership via specific functional practices (e.g., financial planning scenarios). While offering the impression of actionability, this approach lacks the disciplined process and connectivity across the organization promised by a formal risk management program.
Key stakeholders require an advanced risk management framework
Healthcare organizations are complex and require a risk management framework that enables key stakeholders to look across the risks embedded in operations, strategy, capital, and balance sheet positioning. The goal is to create not another dormant report, but a continual system of analytics and communication that feeds into the very dynamic task of managing the allocation of operating and balance sheet resources. An effective risk management framework enables stakeholders to meet key responsibilities, including:
| Governance | - Fulfill fiduciary duties |
| Strategy Leaders | - Determine how decisions impact the balance of risk - Prioritize risks that must be responded to, mitigated, or monitored |
| ERM and Compliance Specialists | - Identify blind spots - Determine mitigation opportunities - Foster dialogue |
| Financial Resource Managers | - Understand threats to the plan - Aid resource positioning |
Characteristics of high-functioning risk management processes
Many organizations have a sound foundation in risk management. Key differences separating good from better efforts center around the ability to prepare for, monitor, and act on risk, as well as the ability to drive planning efforts. Risk management must not be a check-the-box exercise; it must account for human aspects of leadership and how teams communicate amid uncertainty. Figure 1 offers our view of how organizations can move from foundational to high-functioning risk management practices that promote, among other things, a broader understanding of appetite for risk and stronger communication channels.
Figure 1: Advancing Risk Management Efforts
As technology drives data-driven analytics and superior processes elicit insights from strategic financial plans, the sources of information that feed into the risk management framework will continue to grow. Shaping this intelligence into actionable insights that inform strategic decisions is the challenge of a high-functioning risk management process.
Connecting to a broader resource strategy
Addressing risk often comes down to both management’s ability to anticipate or quickly identify and react to risks, and its ability to buffer the risk via its resources. Connecting the work of risk management to an organization’s overall financial resource strategy allows the organization to more fully recognize the possibilities of high-functioning risk management, as shown in Figure 2. This is the point where risk management makes the critical transition from the functional to the strategic.
Figure 2: Moving to a Risk/Resource Strategy
A comprehensive view of risk that spans both operational and non-operational concerns is foundational to a greater decision-support platform we also believe in, which we call Strategic Resource Allocation (SRA). SRA offers a decision-support platform to analyze and communicate key financial resource allocation and positioning decisions. It requires the full efforts of a high-functioning risk management process to complete the total view of resource strategy related to business strategy and balance sheet matters, as strong risk management is the first line of defense for preserving resources. SRA serves as a complement to an integrated strategic financial plan, helping management monitor and adapt its planning within an unstable and dynamic environment.
Conclusion: An enhanced response to risk
Health systems will be surrounded by threats and uncertainties for the foreseeable future. They need a high-functioning, strategic approach to risk management that keeps the most significant risks to the organization front and center, ensuring that leaders have both the foresight and the resources they need to help drive their organization’s continued success.
