Many healthcare organizations are moving to a consolidated risk assessment, which includes compliance, internal audit, and enterprise risk management. A consolidated approach to the risk assessment process has many benefits, takes significant planning, and may be a multiyear effort.
Benefits of consolidated risk assessment
A consolidated effort between compliance, internal audit, and enterprise risk management can result in the alignment of risk functions, a unified understanding of risk, optimized executive time, and informed budgeting and forecasting. Joining forces creates alignment in understanding and reduces the number of executive touchpoints, while also eliminating the confusion that may exist around the roles of compliance, internal audit, and enterprise risk.
Starting point
The best place to start is getting leadership support and buy-in for the consolidated process and ensuring this support is cascaded to the teams participating in the risk assessment process. The three functions also need to establish agreement on key components such as a common risk language, risk ranking, and scoring methodologies. Once established, education and socialization of the consolidated risk assessment approach and central components should be the next step in the process; they should include clear communication of the differences between compliance, internal audit, and enterprise risk.
Process and next steps
There are many ways to conduct risk assessment. Interviews, surveys, and small focus groups—or a combination of all three—may be most effective depending on the scope of the assessment. Interviews and small focus groups can be used to gather initial information. Once that data is collated, a follow-up survey could be used to rank the identified risk. It is always best to conclude with a follow-up meeting with executives and main stakeholders to confirm an understanding of enterprise risks and review the proposed audit and compliance plans. Whereas internal audit may rely more heavily on interviews and stakeholder input, compliance will also need to consider the regulatory environment and assess the applicability of items on the U.S. Department of Health and Human Services Office of Inspector General Work Plan, for example, to the organization’s operations. While definite synergies can be accomplished with a consolidated process, each function needs to meet its specific needs. The completed risk assessment can be used to inform resource needs for the coming year.
