This site is intended for health professionals only

Risky business? Results of the MiP Risk Management Survey

28 August 2008

Share this article

Stuart Gidden
Supervising Editor
Management in Practice

In the current climate of general practice, it is no surprise to discover that practice managers feel that time is a currency in short supply. As we report in this issue, Lord Darzi’s final Next Stage Review report sets out an array of developments that will preoccupy managers in the coming months – and years.

The bombardment of reforms, proposed reforms and mandatory requirements can give managers the feeling the day job is “one thing after another” – a series of projects imposed from above.

And yet managers also need to contend with another vital facet of their role, one which is far removed from policy announcements or project-based tick-box exercises – the need to plan for the unannounced catastrophe, to protect against potential accidents, and generally to expect the unexpected.

This is something with which practice manager Ruth Wood will be all too familiar with. A few years ago, Ruth’s surgery in Leeds was subject to an arson attack and burnt to the ground. She wrote about the ordeal in a previous issue of this publication, in which she described how she arrived at her surgery to discover “70 firefighters and 13 fire engines, and the building extensively on fire … the only thing we could do was look in disbelief at the total devastation we saw before us.”(1)

Her experience highlights the need for astute preparedness and risk management in general practice, as the unexpected may just be around the corner. But just how prepared is general practice? Our online survey on risk management, conducted in July, sought to gauge the level of variation in practice managers’ levels of involvement in this area, and to see if there was a uniform approach to managing risk.

The answer to the latter question was a resounding no. The survey results reflect significant variety in practice managers’ attitudes to, involvement with and approach to risk management.

Nearly a third of respondents do not have a risk management policy in place. More than half (54%) do not have a risk register. A quarter (24.5%) had not received any training in risk management. One in 10 do not have a business continuity
plan in place.

In response to these results, training director Jane Bonehill, a member of the Institution of Occupational Safety and Health, Europe’s leading body for health and safety professionals, said: “There is clearly a cause for concern as the findings show the potential to have a direct affect on the level of care provided to patients. However, the results come as no surprise, since risk management is a subject that is misunderstood by many and often ineffectively communicated to those responsible for applying the principles.

“Robust risk management policies need to be in place to facilitate the implementation of care standards and demonstrate that practices are meeting the requirements of clinical governance.”

Approach to risk management
Separate surgeries are, of course, separate businesses with their own procedures. So it was not surprising to discover a variation in responses. However, the results suggest a minority of managers may be unaware of their responsibilities, or that power-sharing with partners has perhaps diluted their authority in this area.

Just over 30% said their practice does not have a risk management policy in place. Only 46% of respondents said they kept a risk register. Twelve managers said they were “not particularly involved” in risk management, and eight even said this was “not that important”. Some had never carried out a general risk assessment (see Figure 1).

[[RM Fig 1]]

While 83% said the practice manager was responsible for obtaining professional protection for the practice and its staff, this clearly indicates that a significant number of managers are not getting involved here.

“If over 30% don’t have a risk management policy in place, then risks relating to the entire practice operation cannot be suitably and sufficiently addressed, assessed and controlled,” said Jane Bonehill. “Again, this could have a direct effect on the level of patient care.”

Wendy Garcarz, a primary care trainer and health and safety specialist, said she found these results “extremely worrying”. She added: “Questions I would like managers to consider include:

  • Whose responsibility is it to protect the business from a legal challenge?
  • Where would the cost of their defence come from if they were prosecuted for contributing to a death through managerial incompetence?

“Risk assessment is a basic business management tool in the development of services and improvement in quality,”
she added.

Nonetheless, it is clear that the overall majority do have robust procedures in place and managers are leading the way here. Of those practices that did have a risk register, more than 80% said it was the practice manager’s responsibility to keep this up-to-date. And the largest group (48%) said they were “very involved” in risk management (see Figure 2), with 53% saying they considered it “very important” to discuss risk issues with staff.

[[RM Fig 2a]]

“Everyone needs to be aware of risks and what to do about them,” said a practice manager from Kent.

“Things change on a daily basis so we have to keep our eye on the ball,” commented a manager from Scotland.

A Derbyshire practice manager highlighted the pressure of patient complaints: “GP practice in general is becoming more open to litigation, so it’s best to run a tight ship”, she said.

Additional policies/procedures
Of course, having formal, documented policies in place helps to run a tight ship – yet the survey revealed a significant divide here.

There is no legal requirement for a practice to have a safety management system (SMS) – a formal, documented approach to managing an organisation’s health and safety – in place. However, many managers find that such an approach helps to facilitate good health and safety management.

Just under half (43%) of respondents had an SMS in place, with 18% currently setting one up. Interestingly, the vast majority of the 39% who did not have an SMS said they had not heard of this, or were not sure what it meant. This could not be accounted for by inexperience, however, as the largest section of this group (48%) had worked in general practice for more than 10 years, and more than 60% had held their managerial position for at least four years.

A particular area of interest identified was that of risk procedures with regards to healthcare assistants (HCAs) carrying out invasive procedures on patients. While 35% did not have HCAs in their practices, 36% said they had not conducted a risk assessment in this area, compared with 28% who had. While 44% said they had risk procedures in place for HCAs, 22% said they did not (the remainder did not employ HCAs).

When asked why they did not have risk procedures in place here, more than half (51%) of this group said this was not something they had considered. One practice manager from Kent said: “I didn’t consider this but will certainly be looking at it now. The HCA role is fairly new in our practice but definitely needs to be included.”

A Lancashire manager said: “It’s not something we have ever felt necessary. Patients having invasive procedures are verbally consenting as present. We haven’t any risk procedures for any of the nurses either.”

[[RM Fig 3]]

Emergency planning
Looking at broader risk planning, a minority of managers may be leaving their practices vulnerable. Just under one in 10 (9.4%) of respondents said they did not have an emergency recovery or business continuity plan in place. Most (67%) did have such a plan in place, and 24% were currently in the process of putting one together.

“While the majority has business continuity plans in place and need to be congratulated for their foresight, the minority group gives rise for concern,” said Jane Bonehill. “The implications of not having major disaster plans in place could severely disrupt the operation of the business, the care provided, the employment of staff and the knock-on effects within the local community. It may at first appear that a less than 10% minority is insignificant but consideration must be given to how many people will be affected.”

Practice manager Ruth Wood sympathises with those who do not have stringent plans in place, but urges caution. “I think most managers in any business would think like we did: ‘It could never happen and if it did we are covered by insurance.’ However, as we found out to our horror, this isn’t the case and I would encourage managers to ensure every aspect of their business is covered.

“Putting together a business contingency plan in place means that, just by doing the exercise, you are preparing yourselves for every eventuality.”

Of course, practice managers are not the only ones who need to plan for emergencies. The government’s National Risk Register – part of the prime minister’s overhaul of homeland security strategy – stated that a flu pandemic could pose the greatest threat to national security, and could claim up to 750,000 lives.(2)

But how prepared is the frontline of healthcare for this threat? In the MiP survey, 62% of respondents said their practice had a specific contingency plan in place for a flu pandemic. Many of those who did not yet have such a plan in place said they were in the process of arranging this.

Yet many others said they were awaiting guidance from the primary care trust (PCT) – or were hopeful that the PCT would take action. “The PCT has a duty to aid practices should this happen,” said a London practice manager. “I’m not aware [of any preparations],” an Essex manager said, “but hope the PCT will help in case.” Others were more doubtful over assistance in this area. “The PCT were promising to be involved with this using some software they had. It’s never come to fruition,” said a manager from Lancashire.

Nonetheless, a Department of Health (DH) spokesperson was upbeat: “Patients need healthcare, whatever the circumstances, and it’s important that GPs are prepared for any emergency – including pandemic flu.

“I’m encouraged by these results, which show that most practices are already working on this, and I hope that every practice will soon have robust plans in place. Most PCTs are taking the matter very seriously indeed, and a number of areas have purchased web-based pandemic flu continuity planners to assist local practices.”

DH guidance appears to be in the offing. A spokesperson said: “The DH has put in place an NHS implementation team specifically to help health service colleagues prepare for a pandemic. We have recently produced a training package for clinical and nonclinical staff, and we are working with the Royal College of General Practitioners and the British Medical Association (BMA) to develop a guidance document for GP practices, drawing together existing advice and examples of excellent work from around the UK. This should be ready by the end of the year.”

The DH comment is likely to be welcomed – the survey suggests a real need for training, but not only in this area. A quarter (24.5%) of respondents had not received any risk management training. Just 6% said they had received “extensive training” in this area. Most said they had received “moderate” (29%) or “a little” (41%) training. This came from a variety of different sources (including academic qualifications and previous employers), but mostly from PCTs or commercial training providers.

The vast majority (94%) said they would benefit from risk management training. As a Kent-based practice manager said: “I have had some fire risk assessment training, but nothing else. I feel this would help me feel more confident in what I do.” Even those who had received training recognised the need to refresh their knowledge. “Although I have had training, I would still attend further training as it is important to keep skills updated,” said a practice business manager from Lincolnshire.

The threat of violence from patients is another area of risk – and, again, there is a demand for training here. While 63% said that their practice had received violence management training (whether inhouse training organised by the PCT or provided by an external training organisation), 72% of those who had not believed they would benefit from this.

“Being a small practice, the risks have always been low but on a couple of occasions the staff have been put in unacceptable situations for which they have not been trained,” said a manager from East Yorkshire.

Others highlighted the difficulty of arranging training. One manager said: “I feel strongly that our PCT does not support us with training. It is difficult to get everyone trained, and the senior partner will not pay for training.”

Managers are clearly caught in the middle here – in response to these results, the NHS Security Management Service said: “We promote conflict resolution training (CRT) for all frontline NHS staff to help equip them with potentially violent situations. We provide guidance on who should receive CRT but it is the responsibility of managers to assess the needs of their staff and send the relevant people for training”.

Whether or not managers can be held accountable for arranging staff training, they are certainly responsible for assessing risk in their practice and ensuring the highest standards of safety and preparation. The survey suggests that the majority of managers are doing just that – but that a minority may wrongly assume this responsibility lies elsewhere.

Cathryn Bateman, Consultant Editor of Management in Practice, remains positive and pragmatic. “I think many practice managers have very limited time and the time they have is spent addressing the ‘must dos’. While many do manage risk and manage it well, they perhaps don’t formalise it and cover every nook and cranny.”

Dr Beth McCarron-Nash, a negotiator on the BMA’s GP Committee, agrees that results should be viewed in the context of practices’ pressing workloads: “Patient safety is obviously paramount and all staff should receive the training and support necessary to do their job,” she said.

“However, there is a balance to be struck between safeguarding patient safety by having protocols in place, and this only resulting in an additional workload and a layer of bureaucracy for practices, which may also not improve patient care. For that reason, it is something that practices need to consider individually, and where appropriate it should be encouraged.”

Wendy Garcarz is more apprehensive: “It seems that many practice managers see their role as managing a series of projects and initiatives whose priorities are set by bodies outside the practice. For me, a business manager is someone who runs an effective business, able to respond to projects and initiatives by weaving them into existing systems and processes that keep the business operational.

“Without the bigger picture, practices will continue to respond to situations as they arise and will manage with a few missed deadlines. The implications of waiting until a regulatory visit from a PCT assessment team monitoring safety standards or a revalidation team for their senior partner – all real possibilities from next year – has massive implications for the continuation for the business.”

Indeed, while primary care has been subject to all manner of changes, which may have distracted some managers from a fuller engagement in risk management, that changing climate could actually make the issue all the more important.

Says Wendy: “In a closed NHS market, the threat of closing a practice for safety reasons was always treated as a hollow threat. In a competitive market, where world-class commissioning requires commissioners to decommission services with poor standards or achievements, and with alternative providers waiting in the wings to pick up extra business, the threat has real resonance.

“It seems a pragmatic solution would be to learn about risk assessment and integrate it into business processes as soon as possible.”

Though this may seem yet another requirement for practice managers, it should be stressed that, rather than juggling the imposed demands of others – ie, the DH, the PCT or the practice partners – risk management is one area where the manager has independent authority and responsibility: to provide the best protection for their staff, patients and their business.

1. Wood R. Gutted: what happened when a fire destroyed our surgery. Management in Practice 2007;6:46-9.
2. Cabinet Office. National Risk Register. London: Cabinet Office; 2008. Available from: