Risk Management in Blood Transfusion Medicine

J. Mills Barbeau

• Publisher: Elsevier
• Year: 2019
• ISBN:
  9780323548380
• Topic: Medicine
• Subtopic: Hematology

Get a quick, expert overview of risk management in transfusion medicine from Dr. James Mills Barbeau. This practical resource presents a summary of today's state-of-the-art techniques for reducing harm during all phases of transfusion practice, including blood collection, testing, processing, clinical assessment, and transfusion. It's an easy-to-read, one-stop resource for managing and mitigating the various levels of risk in a variety of transfusion settings and scenarios.

• Presents a well-rounded perspective on quality assurance, blood supply testing, clinical risk, ethical and legal considerations, and transfusion-transmitted infectious diseases.
• Demonstrates how transfusion risk-management programs add value to health care institutions by enhancing a culture of safety, improving the institution's reputation, and improving the bottom line.
• Consolidates today's available information on risk management in blood transfusion medicine into one convenient resource.

Chapter 1

Enterprise Risk Management—What It Is and Why It Matters

J. Mills Barbeau, MD, JD

Abstract

At the institutional level, risk can be defined as any factor that can jeopardize an organization’s ability to achieve its business objectives. This chapter presents enterprise risk management (ERM), a crucial business method for identifying risks throughout an organization and harmonizing risk- management efforts enterprise-wide. Healthcare organizations with effective risk management strategies have a competitive advantage over those that fail to manage their risk portfolio adequately. The present chapter reviews the history leading to ERM’s ascent to the standard of care for all major enterprises, including healthcare organizations, and describes how to implement ERM at one’s institution.

Keywords

Enterprise risk management; Internal controls; Risk; Risk audit; Risk domains; Sarbanes-Oxley

Introduction

“Risk” can mean many things. Risk connotes an absence of safety, and the possibility of suffering a loss. In healthcare, patient safety efforts concentrate on risks such as the risk of falling or the performance of “risky” procedures. We use timeouts to minimize the risk of wrong-side surgery. Risk is associated with potential financial loss, legal liability, or both. Yet, we also talk about risk being related to opportunity, as when we decide that something is “worth the risk.” In decision making, we frequently “weigh the risks,” including the risk of doing nothing, before choosing a course of action. The corporate world defines risk as any factor that can jeopardize the organization’s ability to achieve its business objectives.¹ Could this definition of risk apply to healthcare organizations?

What, then, is risk management? In practice, risk management typically involves identifying risks and minimizing them—by eliminating the risks, implementing procedures to reduce the risks, educating personnel on how to avoid the risks, or buying insurance to outsource the financial impact of the risks. Risk management is typically performed within a given service’s span of responsibility, at the level of a department, unit, or division. A threshold issue is whether such a balkanized approach to risk management is maximally effective, or whether it might be preferable to address risks at the organizational level, taking advantage of economies of scale. One may counter that a local approach to risk management effectively brings risks to the attention of those with the most expertise and experience regarding risks in their spheres of activity. In addition, human nature being what it is, managing risk across departmental domains may give rise to feelings that one group is criticizing another or otherwise overstepping its bounds.

The term “enterprise risk management” (ERM) may not be familiar to most healthcare professionals. This is largely because enterprise risk management did not originate in healthcare, but rather in the corporate world. Although ERM may not have become part of healthcare culture or consciousness at the provider level, the impact of ERM is nevertheless felt at all levels of any large healthcare organization. To appreciate why enterprise risk management is important, it is helpful to understand some interesting historic background.

Sarbanes-Oxley Act of 2002

Some readers may recall the Enron and WorldCom corporate fraud scandals of 2001. Both Enron and WorldCom were successful, respected companies that had thrived throughout the 1990s. Enron was a large energy company, named “America’s Most Innovative Company” by Fortune Magazine for six consecutive years up to 2001.² In 1999, Enron started an electronic commodities-trading website, and soon thereafter, it invested heavily in high-speed broadband networks. Unfortunately for Enron’s employees and investors, the “dot com” bubble burst, and the arrival of economic recession in 2000 led to multibillion dollar losses for many web-based companies.³ In an attempt to hide its losses, Enron’s executives—with the support of its accounting firm, Arthur Anderson—engaged in fraudulent accounting practices.^4,5 By the time the fraud was discovered, shareholders and employee pensions had lost billions of dollars. Enron and Arthur Anderson collapsed and Enron’s CEO, Jeffrey Skilling, was convicted of fraud, insider trading, and conspiracy.

WorldCom was also a progressive telecommunications company that prospered during the 1990s. In 1997, WorldCom announced a merger with MCI Communications Corporation, which would be the largest corporate merger in the US history. Two years later, WorldCom announced a merger with Sprint. The proposed new company would be larger than AT&T. However, the Justice Department balked at the Sprint-WorldCom merger on anticompetitive grounds and the merger failed. By then, the telecommunications industry was in decline. When the merger failed, WorldCom share prices dropped precipitously. The company was no longer the darling of investors. Financial weakness in WorldCom’s organization began to become apparent. Similar to the CEO at Enron, WorldCom’s CEO, Bernard Ebbers, began to doctor the books with the assistance of the same accounting firm, Arthur Anderson.^6,7 Whistle blowers within the company sounded an alert,⁸ and WorldCom plunged into a downward spiral. The company filed for bankruptcy in 2002.⁹ Similar to Skilling, Ebbers’ career ended in federal prison.¹⁰

In the wake of the Enron/WorldCom scandals and Arthur Anderson’s collapse, Congress passed the Sarbanes-Oxley Act of 2002.¹¹ It had become clear that many corporations made a practice of hiring a single accounting firm to act as both external auditors and internal consultants, as was the case with Arthur Anderson. As external, “independent” auditors, the accountants would perform the corporation’s annual external audit on behalf of investors and shareholders. During the rest of the year the same accountants were paid handsomely by the corporation to act as consultants. Thus, the accountants were in essence working for the corporation, and the external audits were a sham. Sarbanes-Oxley mandates that external auditors of publically traded corporations shall not have such conflicts of interest. Furthermore, CEOs are personally responsible for the accuracy of the company’s financial reports. The CEO and senior executives must all personally verify the company’s internal controls. “Internal controls” is an auditing term for risk management.¹²

The mandate to implement comprehensive internal controls (i.e., risk management practices) requires company leadership and the external auditor to perform a “top-down risk assessment” of the entire organization.^13,14 Specifically, the company must identify all factors that could jeopardize the company’s ability to achieve its business objectives. Leadership must establish a “systems culture” in which control consciousness permeates the entire organization and systems are in place to identify and share information about risk. Comprehensive control activities, embodied in clear policies and procedures, must harmonize risk management across the enterprise, and the risk management process must be continuously monitored and improved.

The Sarbanes-Oxley Act has had a far-reaching impact, which extends into the realm of healthcare. Although compliance is mandatory only for publically traded corporations, the enterprise risk management paradigm has become the standard for all significant business enterprises. This makes good business sense. Not only do such practices protect against losses, but a comprehensive, fully integrated risk management program also favorably impacts a company’s credit rating. After all, a company that has effectively minimized its risks is a less “risky” investment for shareholders and lenders. Healthcare organizations, similar to other large companies, avail themselves of bonds, loans, and capital markets. A good credit rating improves access to capital, which in turn enables organizations to seize business opportunities when they arise. Effective risk management can be a competitive advantage in competitive markets, healthcare¹⁵ or otherwise.¹⁶

Enterprise risk management also allows the company to weather disruptive events. Market volatility and uncertainty, economic shocks, and new competition or technology can rapidly upset the competitive terrain (Fig. 1.1). An organization that has thoroughly ...