Asking managers and senior leaders what keeps them up at night is a good way to kick off a risk assessment, experts say. The answers may help compliance professionals uncover potential vulnerability that isn’t showing up in other methods they use to identify risks.

“Our risk assessments start with a singular question: What keeps you up at night? All kinds of things come out of their mouths when you ask that question,” said Jeff Driver, professor of innovation science, risk management and privacy at Arizona State University. “You will learn things that make you fall off your chair.” Compliance professionals can readily familiarize themselves with the risks from external sources, such as the HHS Office of Inspector General (OIG) Work Plan or Department of Justice enforcement actions, but they should be hunting for the hidden risks, Driver said at the Health Care Compliance Association’s Compliance Institute April 21.^[1]

“We always start the risk assessment with that very question, and we get a lot of information,” added Betsy Wade, chief compliance and ethics officer for Signature HealthCARE in Louisville, Kentucky. The HHS OIG is on the same page. “Leadership should consider asking mid-level managers what risks they see, which is another way to ask what keeps you up at night,” said Susan Gillin, chief of the OIG’s Administrative and Civil Remedies Branch.