NHS Risk Register Implementation Template

Standard Operating Procedure: NHS Risk Register Implementation & Lifecycle Management

Document ID: SOP-TR-NHS-042
Effective Date: October 24, 2023
Version: 3.2.0
Review Cadence: Annual / Post-Incident
Classification: Institutional-Grade Operations
Author: Julian Vance, Chief Architect, Template Registry

---

1. Executive Summary & Purpose

This Standard Operating Procedure (SOP) defines the institutional-grade framework for establishing, maintaining, and reviewing risk registers within National Health Service (NHS) trusts, integrated care systems (ICS), and associated healthcare delivery units. Utilizing the standard $5 \times 5$ risk matrix methodology aligned with the Orange Book: Management of Risk - Principles and Concepts, this document ensures systematic identification, quantification, mitigation, and escalation of clinical, operational, financial, and strategic risks. Compliance with this SOP is mandatory for all clinical governance leads, operational managers, and departmental risk owners.

---

2. Scope & Prerequisites

2.1 Scope

This procedure applies to all operational departments, clinical directorates, and capital project teams operating under the Template Registry governance framework. It covers risks ranging from patient safety incidents and data security breaches (GDPR/Caldicott) to supply chain disruptions and workforce shortages.

2.2 Prerequisites & Tools

• Software Stack: Datix Cloud IQ, Microsoft Excel 365 (Enterprise Template v4.2), or authorized equivalent enterprise risk management (ERM) software.
• Reference Frameworks:
  • NHS Patient Safety Incident Response Framework (PSIRF).
  • CQC Single Assessment Framework (Safe, Effective, Caring, Responsive, Well-led).
  • ISO 31000:2018 (Risk Management Guidelines).
• Access Control: Role-Based Access Control (RBAC) configured for read/write access based on departmental ownership.

---

3. Roles & Responsibilities (RACI Matrix)

---

4. Step-by-Step Procedure

Phase 1: Risk Identification & Logging

• 1.1 Convene monthly governance or safety huddles to identify emerging threats via incident reporting (Datix), audit findings, or external regulatory feedback (CQC/HSE).
• 1.2 Access the master NHS Risk Register template and generate a unique alphanumeric identifier (Format: [DEPT]-[YYYY]-[SEQ], e.g., ED-2023-014).
• 1.3 Document the Risk Title and formulate the risk statement using the standardized cause-event-impact model: "Because of [cause], there is a risk that [event], leading to [impact]."

Phase 2: Qualitative Risk Assessment ($5 \times 5$ Matrix)

• 2.1 Evaluate the Likelihood (L) of the risk materializing on a scale from 1 (Rare) to 5 (Almost Certain).
• 2.2 Evaluate the Consequence (C) of the risk should it materialize on a scale from 1 (Negligible) to 5 (Catastrophic), considering patient safety, financial loss, regulatory breach, and reputational damage.
• 2.3 Calculate the Initial Risk Score (IRS) by multiplying Likelihood by Consequence ($L \times C$).
• 2.4 Classify the risk band:
  • Low (1–3): Monitor locally.
  • Moderate (4–6): Managed at department level.
  • High (8–12): Escalated to Directorate Risk Register; requires active mitigation plan.
  • Extreme (15–25): Immediate escalation to Executive Board and inclusion on the Board Assurance Framework (BAF).

Phase 3: Mitigation & Action Planning

• 3.1 Determine the risk treatment strategy: Terminate, Treat, Transfer, or Tolerate.
• 3.2 Formulate SMART mitigation actions (Specific, Measurable, Achievable, Relevant, Time-bound).
• 3.3 Assign a single named individual as the Action Owner and set realistic completion dates.
• 3.4 Re-evaluate and input the Target Risk Score (TRS) post-implementation of mitigating controls.

Phase 4: Review, Monitoring, & Closure

• 4.1 Conduct mandatory reviews of High and Extreme risks every 30 days; Moderate and Low risks every 90 days.
• 4.2 Update progress notes in the audit trail field for every review cycle.
• 4.3 Formally request risk closure only when the current risk score matches the target risk score, and mitigation controls are embedded into business-as-usual (BAU) processes.

---

5. Quality Assurance & Pro-Tips

5.1 Best Practices

• Dynamic Updating: A risk register is a living document; update scores dynamically when controls fail or external conditions shift (e.g., winter pressures).
• Avoid Vague Statements: Refrain from entering generic risks like "staff shortage." Instead specify: "Shortage of specialized Paediatric ICU nurses leading to delayed elective surgeries and potential breach of 18-week RTT targets."

5.2 Common Pitfalls to Avoid

• Static Scoring: Failing to reduce the risk score despite implementing expensive mitigations, or conversely, maintaining an artificially low score to avoid scrutiny.
• Orphaned Risks: Assigning a risk to a department without securing explicit sign-off from the named Risk Owner.

5.3 Metric Thresholds

• Overdue Actions: 0 tolerance for actions past their target completion date without a documented extension request.
• Review Compliance: $\ge 95%$ of registered risks must undergo review within their designated cycle window.

---

6. Frequently Asked Questions (FAQ)

Q1: What is the exact formula for determining the NHS risk score, and how do we handle conflicting scoring opinions?
A: The score is calculated as $\text{Likelihood (1-5)} \times \text{Consequence (1-5)}$. In cases of conflicting opinions during assessment panels, the higher conservative score must be applied temporarily, followed by a formal review with the Clinical Director to reach consensus based on historical incident data.

Q2: When must a departmental risk be escalated to the Trust-wide Corporate Risk Register?
A: Any risk that reaches a score of 15 or higher (Extreme), or any risk where mitigation requires capital expenditure exceeding local delegation limits or cross-departmental coordination, must be escalated to the Trust Risk Manager within 48 hours for inclusion on the Corporate Register.

Q3: How are closed risks archived for audit purposes?
A: Risks marked as "Closed" must not be deleted. They must be moved to the archive tab/module of the ERM system, retaining the complete audit trail, final mitigation summary, and sign-off timestamp for a minimum retention period of 8 years in compliance with the NHS Records Management Code of Practice.