Risk Management Strategy 2024-2027

Foreword

At Lancashire Teaching Hospitals NHS Foundation Trust we believe in establishing an organisational culture that ensures risk management is an integral part of corporate objectives, business plans and management systems

As a large and complex organisation delivering a range of services, in a challenging operational and financial environment, we recognise that risks are an inherent part of the day-to-day life in the delivery of healthcare? However, the Board are fully committed to ensuring that risks are identified and managed, so that they are reduced to an acceptable level, or eliminated as far as reasonably practicable? 

As a Board, we place particular emphasis on having robust and effective controls in place to mitigate clinical and non-clinical risks? We have an effective framework in place that supports the identification and mitigation of risks as they may present themselves over time, but that also enables us to be agile when emerging risks present themselves through the course of the Trusts’ day-to-day activities? Assurance is provided to the Board through the Board Assurance Framework (BAF)? The BAF provides a structure and process to enable us to identify those strategic and operational risks that may compromise the achievement of our high level strategic objectives?
In developing this strategy our teams have reviewed the Trust’s Risk Management Policy alongside recommendations and learning from external reviews conducted by the Care Quality Commission (CQC),  NHS England/Improvement (NHSE/I), the Good Governance Improvement (GGI) and Mersey Internal Audit Agency (MIAA)? 

Through this strategy and implementation plan, in conjunction with the Trust’s Risk Management Policy, we will aim to ensure Risk Management processes are embedded at every level of the organisation? This is important to ensure there is a culture that supports active and consistent management of risks, where staff feel confident to speak up and raise concerns about issues that affect safety and quality outcomes, finance and performance, and staff and patient experience?

We believe that whilst compliance with legislative requirements is important, we see this as a minimum standard only? Through implementation of this strategy, we will strive for excellence and innovation in risk management to empower and enable our teams with the right education, framework and platform to resolve complex issues, and deliver ‘Excellent Care with Compassion’ for our patients

Defining our approach to Risk Management

In undertaking Risk Management activity there are two key approaches that the Trust takes: the top down and the bottom-up approach.

Top Down (Identifying Strategic Risks)

The Trust undertakes Strategic Risk Management through Executive Management and Committee structures that enables the identification, assessment and recording of strategic risks which threaten the achievement of the Trust’s Strategic Objectives.
The management of Strategic Risks also consider the implementation and monitoring of controls and mitigating actions? (Strategic Risks may also be identified through the monitoring and reporting of operational risks)?

Bottom Down (Identifying Strategic Risks)

The Trust undertakes Operational Risk Management activity through staff working in adherence to the Trust’s Risk Management Policy.
Operational Risks are those that sit on the divisional and corporate risk registers and may affect and relate to the day to day running of the organisation? 
Operational Risks may present themselves via incidents, complaints, claims, patient feedback, safety inspections, external review and ad hoc assessments etc?, which may impact on the Trust’s ability to meet its objectives and targets.

Risk Management Activity – Top down and Bottom up approach

Image Description

The image is a white a backround a large blue triangle split into layers with three blue arrows at the top pointing downwards.

The blue arrows are accompanied by the text 'Strategic Risk Assessments'

The blue triangle is split up into layers in a pyramid like structure. Each layer has text on it, bevelling and a different gradient colour blue. The bottom layer's text reads ' Service/Ward/Departmental Risk Registers'. The next layer's text is 'Corporate and Divisional Operational Risk Registers'. 'Strategic Risk Registers' is the text in the following layer and in the top most layer of the triangle the text is 'Board Control and Oversight'.

On the left side of the triangle is a blue arrow from bottom to top. Beside this is a text label in a rectangle which reads 'Bottom Up Approach'.  

On the right side of the triangle is a blue arrow from top to bottom. Beside this is a text label in a rectangle which reads 'Top Down Approach'.  

The Board Assurance Framework

The Board Assurance Framework (BAF) provides a structure and process to enable organisations to identify those strategic and operational risks that may compromise the achievement of the Trust’s high level strategic objectives and is made up of two parts the Strategic Risk Register and the Operational Risk Register

• Strategic Risks are those risks that threaten the delivery of the strategic objectives and are not likely to change over time
• Operational Risks are those that sit on the divisional and corporate risk registers and may affect and relate to the day to day running of the organisation? They mainly affect internal functioning and service delivery and are managed at the appropriate level within the organisation

Risk Scoring

Risks are scored utilising a matrix which was derived from the National Patient Safety Agency Risk Matrix and compares likelihood and consequence.

The overall score determines the level of risk and monitoring within the Trust

Risk Monitoring and Escalation

As a ‘Clinically Led Organisation’ we believe that operational risks are best managed by clinical staff and those that are closest to the risk and can affect it positively? However, we recognise that support and guidance can often be required, along with appropriate oversight from Departmental, Divisional and Corporate Management teams, and the Board of Directors.
The frequency at which a Risk should be reviewed is determined by the risk score with higher scoring risks requiring more frequent review. 

• Risks rated as ‘High’ (15-25) must be reviewed monthly
• Risks rated as ‘Significant’ (risk score 8-12) or ‘Moderate’ (score of 4-6) must be reviewed on at least a quarterly basis
• Risks rated as ‘Low’(risk score 1-3) must be reviewed at least annually.

Route of escalation for high risks

Image Description

Four blue rectangles sit centrally aligned of a white background. 
The bottom rectangle has the word 'Division' in white text written inside.  A black arrow points from the top centre to the rectangle above. This rectangle contains the white text ' Risk Management Group (RMG)'. Another arrow leads to the rectangle above. This contains the text ' Committees of Board' again in white text. A black arrow points upwards to the final rectangle which contains the white text 'Trust Board'. 

Leading from the left of the top 3 rectangles to the left side of one below is a black  arrow with the accompanying text  'Rejection of high scoring risk with check/challeng on content and/or scoring'.

In between the four rectangles, on the right hand side of each, is written the black text 'Escalation of high risk (scoring 15+)'

The rectangle containing the text ' Risk Ranagement Group (RMG)' has a red asterisk by it's side. In the footer of the graphic in a light blue bar the text explained for this astersisk reads ' In the absence of the Risk Management Group meeting, urgent decisions can me made via the Senior Leadership Team (SLT) meeting to Committees of the Board'.

The rectangle containing the text 'Division' has 2 red asterisks by it's side. In the footer the text explanation for this reads ' This could include escalaton from Divisional Board, Divisional Safety and Quality Committee, Divisional Finance and Performance Committee or Divisional Workforce Committee'.

Risk Appetite & Risk Tolerance

The UK Corporate Governance Code states that ‘the Board is responsible for determining the nature and extent of the significant risks it is willing to take in achieving its strategic objectives’. This means that at least once a year, we should consider the types of risk we may wish to exploit and/or can tolerate in the pursuit of objectives.

Risk Appetite is the decision about the level of risk that the Trust is prepared to accept, after balancing the potential opportunities and threats a situation presents. It represents a balance between the potential benefits of innovation and the threats that change inevitably brings.

Risk Tolerance is the boundaries within which the Board is willing to allow the true day-to-day risk profile of the Trust to fluctuate while executing strategic objectives in accordance with the Trust’s Strategy and Risk Appetite. The infographic below provides a high-level overview of the journey of a risk from its current risk position to its optimal risk position, recognising some risks may be tolerated in line with the level of risk the Trust is willing to operate within.

Image Description

A rounded edged rectangle runs centrally on its short edge from top to bottom. It is filled with a gradient fill of colour starting from yellow at the bottom leading to through orange in the middle to red at the top.  In the bottom fifth of the rectangle is an arrow with a head at each end filled in white. Above this is another double ended arrow which takes up another two fifths. Near to the top of the  rectangle there is a white bordered blue square.  Pointing at this blue square is a text box with a red arrow. The text box contains the title ' Current risk position:' in red. The rest of the text is in black and reads ' The risk level at which the organsation is currently operating. This level is tolerated by default, as cessation of activity is not an option. Risks are subject to management to drive activity into intolerance.' the words 'currently' and 'operating' are in bold.  

In the bottom left corner is green outlined text box with a green arrow pointing to the bottom fifth of the rectangle and the white arrow range. The title in green text inside the box reads ' Optimal Risk Position:' the rest of the text in black is ' The risk level at which the Trust aims to operate. This is informed by the Trust's strategic objectives. ' The word 'aims' is written in bold.

In the top right hand corner of the image is a graphic of a pair of blue scales. On the left hand scale pan is written 'Benefit' in white text and on the right hand pan is 'Risk'. The left hand pan is lower than the right hand pan.

Risk Appetite Scale

As part of considering our appetite to risk, we have used the following Scale to support the development of our Risk Appetite Statement which outlines our appetite and tolerance to risk when pursuing our Strategic Aims and Ambitions. The Trust seeks to manage risks in accordance with our Risk Appetite Statement.

Risk Appetite Statement

In 2022/23, we reviewed and updated our Risk Appetite Statement in conjunction with the Good Governance Improvement (GGI) and this was endorsed by the Board? This was reviewed again for 2023/24 as part of the annual cycle, and approved with no changes at the Board of Directors Meeting in June 2023.

We will use this Risk Appetite Statement to support our strategic decisions and to monitor progress with the Strategic Risks to the delivery of our Aims and Ambitions/

We also want our operational teams to feel confident in using the Board-approved Risk Appetite and Tolerance to give confidence when making decisions about how much risk to take (appetite) and how much risk we can operate with (tolerance).

The Risk Appetite Statement* set by the Board is as follows:

Providing safe and effective care for patients is paramount and so we have a low tolerance of risks which would adversely affect the quality and safety of clinical care? However, to Consistently Provide Excellent Care, we recognise that, in pursuit of this overriding objective, we may need to take other types of risk which impact on different organisational aims? Overall, our risk appetite in relation to consistently providing excellent care is cautious – we prefer safe delivery options with a low degree of residual risk, and we work to regulatory standards.

We have an open appetite for those risks which we need to take in pursuit of our commitment to create a Great Place to Work. By being open to risk, we mean that we are willing to consider all potential delivery options which provide an acceptable level of reward to our organisation, its staff and those who it serves. We tolerate some risk in relation to this aim when making changes intended to benefit patients and services. However, in recognising the need for a strong and committed workforce this tolerance does not extend to risks which compromise the safety of staff members or undermine our trust values.

We also have an open appetite for risk in relation to our strategic ambition to Deliver Value for Money and our strategic aim to offer a range of high-quality specialist services to patients in Lancashire and South Cumbria, maintaining and strengthening our position as the leading tertiary care provider in the local system, where we can demonstrate quality improvements and economic benefits. However, we will not compromise patient safety whilst innovating in service delivery. We are also committed to work within our statutory financial duties, regulatory undertakings, and our own financial procedures which exist to ensure probity and economy in the trust’s use of public funds. We seek to be Fit for the Future through our commitment to working with partner organisations in the local health and social care system to make current services sustainable and develop new ones. We also seek to  lead in driving health innovation through world class Education, Training & Research by employing innovative approaches in the way we provide services. In pursuit of these aims, we will, where necessary, seek risk - meaning that we are eager to be innovative and will seek options offering higher rewards and benefits, recognising the inherent business risks.

*This may be subject to change in the three year cycle of this strategy

Strategic Risks

In developing the Risk Appetite Statement, we have reviewed each of our Strategic Risks to determine the level of risk that we aim to operate with (appetite) and the level that we are prepared to operate with (tolerance)? The risk appetite and tolerances shown below were approved by the Board of Directors in June 2023.

Strategic Risks - Tolerance*

* These may be subject to change in the three year cycle of this strategy

Risk Maturity

As part of our Risk Management Policy, we use a bespoke risk maturity matrix, building on a respected Institute of Internal Audit model? This tool is recognised by our Internal Auditors Mersey Internal Audit Agency (MIAA) and considers the following factors as part of the review to provide an assessment of the embeddedness and effectiveness of the risk management processes being applied.

• Leadership, management & culture
• Roles & Responsibilities
• Processes
• Monitoring & feedback

Level 5 - Risk enabled

Driven by the Board, staff at all levels actively consider issues of risk in all areas of activity and develop control and assurance processes to manage those risks / risk management and internal controls fully embedded into the operations.

Level 4 - Risk managed

Staff throughout the organisation are aware of the importance and the organisations response to risk Enterprise approach to risk management developed and communicated.

Level 3 - Risk defined

The organisation has considered risk management and put in place strategies led from a risk management team / strategy and policies in place and communicated. Risk appetite defined.

Level 2 - Risk aware

The organisation is aware of risk management responsibilties, and needs to embed systems / scattered silo based approach to risk management.

Level 1 - Risk naive

The organisation has little or no awareness of the importance of risk management / no formal approach developed for risk managment.

The Strategy

The strategy has been divided into three sections:

(i) Insight: Improve our understanding of Risk Management at the Trust by drawing intelligence from multiple sources, internally and externally

(ii) Involvement: Supporting, training, and involving key staff groups will enhance their understanding and maturity in Risk Management and we will use this as a vehicle to improve how we manage risk within the organisation

(iii) Improvement: The Trust will support continuous and sustainable improvement, with everyone learning to improve Risk Management within the organisation, to reduce risk to patients, staff and stakeholers

Through this strategy we recognise the opportunity to shape a forward-thinking culture that supports the Trust to enhance its key controls and mitigate strategic and operational risks for our patients, staff and other stakeholders.
Our ambition is to become an organisation that achieves the highest level of Risk Maturity (Level 5 – Risk Enabled).
This is important to ensure there is a culture that supports active and consistent management of risks, where staff feel confident to speak up and raise concerns about issues that affect safety and quality outcomes, finance and performance, and staff and patient experience.
Key enablers and stakeholders are identified within the strategy, specifically creating the infrastructure for improving Risk Management, which will enhance the arrangements to assure the Board through the Board Assurance Framework (BAF).
The successful delivery of this strategy is underpinned by culture, leadership, engagement and education programmes of work.

Measurement

The improvement measures are identified within the insight section of the strategy and these will be monitored through the review of data and information at the new Risk Management Group. These include:

Improved Risk Management training
Introduction of Risk Management Workshops
Reduction in long-standing risks
Reduction in operational high risks
Reduction in confidential risks
Improvements in Risk Maturity ratings

Our Big Plan strategy

Our Big Plan

Mission 

To provide excellent care with compassion

Aims

To provide outstanding and sustainable healthcare to our locla communities

To offera range of high quality specialist services to patients in Lancashire and South Cumbria 

To drive innovation through world class education, training and research

Values

Recognising Indviduality

Building Team Spirit

Being Caring and Compassionate

Seeking to Involve

Taking Personal Responsbility

Our Values

Our aim is to always provide excellent care with compassion from all of our sites including:

• Chorley and South Ribble Hospital
• Royal Preston Hospital
• The Specialist Mobility and Rehabilitation Centre (SMRC)
• Finney House Community Healthcare Hub (CHH)
• Our community and satellite sites

Compassionate

A culture where we treat patients and colleagues with compassion, understanding and with kindness.

Respectful

A culture where all roles or backgrounds are valued and equal, ideas are welcomed, we feel respected and supported.

Empowered

A culture where we are empowered and enabled to act to the full remit of our roles, we understand what we can do and feel able to act without permission.

Collaborative

A culture where we recognise we are part of a bigger team, willing to work across boundaries to support others to achieve their aims.

Performance Focussed

A culture which is performance focussed, we strive to be the best? We are happy to be held and hold others to account in a positive, supportive manner, we are reflective and do not seek to blame.

Alignment to Trust Objectives

The objectives in this plan are derived from the Trust’s core objectives. Currently all risks on the active Risk Register at the Trust are aligned to a Trust Ambition or Aim to ensure there is a structure and process in place to identify those strategic and operational risks that may compromise the achievement of the Trust’s high level strategic objectives. This Strategy looks to support the refinement of the Trust’s approach to managing all risks aligned to the Trust’s Aims and Ambitions.

Trust aim:

To offer a range of high quality specialist services to patients in Lancashire and South Cumbria
Risk Appetite: Open
Risk Tolerance Score 6-9

Trust aim:

To drive health innovation through world class education, training and research
Risk Appetite: Seek
Risk Tolerance Score 9-12 

How Will We Work Differently

Through this strategy the role of leaders will be defined across our organisation? This section of the strategy contains an outline of how this will be achieved and how our teams will work together to build our Insight, Involve and learn from best practice, and Improve our risk profile and maturity. Through development of the new Risk Management Group, we intend to capture and share learning and become a centre of excellence for our risk and assurance processes.

Our clinical and corporate teams will work together to implement this strategy.

Insight:

Teams will work together to improve our understanding of Risk Management at Lancashire Teaching Hospitals by drawing intelligence from multiple sources internally and externally? Risk data and information will be scrutinised in different ways through the new Risk Management Group. This will ensure a shared understanding of our key strategic and operational risks, and provide a platform to resolve complex cross-divisional/cross-Trust/cross-boundary issues, to support organisational and system-based controls and solutions.

Involvement:

Our strategy has been designed to involve staff through workshops and provide them with the right education to improve their skills, understanding and confidence to tackle risks. The draft strategy was circulated widely amongst divisional and corporate teams to ensure the final product identifies what matters most. The strategy will remain responsive as each year progresses with the ability to add to and take away as priorities change.

Improvement:

The Board of Directors have committed to adopting a robust improvement methodology across our organisation. The strategy will be underpinned by underpinned by this and our teams will work together to deliver effective and sustainable change in our highest risk areas. Learning from improvements in our risks will be shared widely with staff.

Delivering the Plan

The new Risk Management Group, with representation from Executive Directors, Corporate and Divisional Leadership Teams and Multi-disciplinary Governance Professionals, will oversee the implementation of this Strategy, the group will focus on the three major areas of work: insight, involvement and improvement.

The new group will aim to create a flattened hierarchy to identify improvement priorities (‘insights’), further improving the involvement of our staff and stakeholders in designing the improvements required (‘involvement’) and overseeing the improvements in the organisational risk maturity (‘improvement’).

The deliverables outlined in this strategy will be delivered through the Risk Management Group, who will use the intelligence created to inform future priorities of ‘Our Big Plan’.

Progress will be monitored through the Risk Management Group and an annual report will be produced.

The strategy is applicable to all areas of the organisation and we will support teams to mature their risk arrangements.

The strategy will be considered as a fundamental part of the organisation and will evolve each year, considering broader learning elicited through other strategies across the organisation.

Our clinical and corporate teams will work together to implement this strategy.

The 3 Year Risk Management Implementation Plan