A Guide to Risk Based Auditing

What is Risk Based Auditing?

Risk based auditing lets you quantify how often to conduct audits on different processes within your business. It enables you to focus your attention on the processes that have greater risks or opportunities. This is clearly a better method than taking a scattergun approach to auditing, whereby you look at everything and learn very little.

By identifying and evidencing the processes that are working well consistently, which require less audit focus, you free up time to focus on either ‘higher risk’ processes; or ‘opportunity processes’.

For Example:

If I allocate 40 hours per month to auditing my care service, I need to decide where to focus.  The following illustrates how to decide this:

From the above you would focus more time on larger sample audits in Branch B, or in residential / nursing, your 1^st floor. 

Whilst there are no issues with Maintenance, you still have to maintain a detailed level of scrutiny, because the inherent risk is always high in the areas above. If there were issues,what would usually be a once every 4 week audit might become a weekly audit for a period of 4 weeks, until you are satisfied the risk has been reduced.  

In branch A, I may choose to review in detail 10% of care plans per month; whereas in branch B (where risk is higher as the table above shows), I may choose to review 20% to 25% of care plans  per month.  If there were recurring themes in my audits of care plans (i.e. “failure to review risk assessments after an incident”, I would review all care plans where the client had a fall in the past 28 days, to be assured there were no missing care risks and plans).

Auditing over time and prioritising

When an area you have been focusing your audits on improves over time, for example, if you undertake monthly infection control audits in the first 3 months of opening your Supported Living / Domiciliary Care or Care Home, then see this area is working well, you may choose on a ‘risk basis’ to move the full audit to be completed bi-monthly, but undertake some spot checks on the higher risk areas in the alternate month. 

This allows what might be a 3-hour long audit to become a 1-hour spot check in the alternate month.  If an incident occurs, or the spot check reveals issues, you will revise your risk level and resume monthly audits.

Another example would be tissue management, especially in Care Homes and Supported Living services.  If you have had no pressure ulcers, due to very good management of nutrition, partner working with the District Nurse, Tissue Viability Nurse, GP, etc. and good practice in cream application, use of pressure relieving aids (mattresses, cushions, etc.) then your risk level is relatively low, so your auditing will be to a moderate level to avoid complacency. 

However, if new pressure ulcers develop whilst the people are in your care, you should increase the auditing, perform a root cause analysis and scrutinise the area that was a key factor contributing to the prevalence of the skin breakdown (i.e. nutrition or cream application, etc.).

By staying alert to the level of assurance you are getting from your audits and KPIs (such as complaints, compliments, incomplete MAR charts, weight loss, falls, admissions to hospital, safeguarding issues, missed visits) you can adjust your audit scrutiny and create time to focus on improvements to outcomes.

Opportunity Risk:

If you wish to expand your service provision to another town (domiciliary care), or increase your proportion of ‘private fee-paying clients/residents’ you will need to focus on your external rating with the regulator and other metrics, as without this your opportunity to grow is at risk.

If you currently have 5 Good ratings, you may initially wish to achieve an ‘Outstanding rating in Caring’.

Build an audit to verify that you have all of the evidence you need in place to demonstrate your care provision is Outstanding, including feedback from clients / residents and families / visitors; care assessments, plans and daily notes all evidence that you go ‘above and beyond’ good care. Examples of providing innovative care, such as using software for electronic care plans or auditing, using pioneering approaches to dementia, or partnering with relevant community partners will also help towards an Outstanding rating.

If your audits are well designed, they will become your primary source of evidence. They are key to the achieving better ratings and becoming a more secure, sustainable and reputable provider of care. Over time you build the evidence and focus audit attention any residual gaps in evidence until it is all consistent and robust.

The above sets out how to utilise risk-based approach to ensure that your audits are:

• Proportionate to the associated risk (or opportunity), so you focus on the higher risks
• Efficient, so you have time to achieve improvements
• Responsive to reductions in assurance
• Focused on the areas clients/residents and commissioners/regulators need to be assured on
• Outcome orientated – they lead to tangible improvements
• Realistic – i.e. you can actually complete the schedule of audits within the time frames
• Measured to demonstrate that each audit adds value, providing positive assurance or a trigger to improve outcomes.

Audits should contain the right questions and focus on the fundamentals of operating a Safe, Caring, Effective, Responsive Service and by planning and conducting them well your service should be successful in all areas.