This systematic review explores how healthcare translates risk analysis and investigation to action plans, such as how risk controls were determined and implemented (e.g. Hierarchy of Control), and whether these were successful.
Of 231 identified studies, 60 met inclusion criteria.
Results
None of the studies in the review used any systematic method for generating risk control recommendations, although one used a force-field analysis for prioritising potential risk controls.
28 studies reported a total of 196 risk controls that were recommended in investigations. Over 80% of risk control recommendations were administrative. The majority of remaining controls were design-related.
Of the studies which highlighted the implementation rates of controls, elimination was implemented in 50% of cases, design controls 65% and administrative 78%.
Interestingly, in studies which reported the success of the risk controls, studies which described the use of elimination or design controls were “1.6 times more likely to have explicitly reported success than those that described the use of administrative controls alone” (p.7).
Some of the high-level results are shown below:

Where studies did identify the success of risk controls, only two used any form to demonstrate that the improvement was due to the risk controls. Also of interest, no study reported the rate of risk controls that had proven ineffective.
For the administrative controls of training and education, notably it was found that “risk controls based on training and education were negatively correlated with reports of improved outcomes … that is, they made things worse” (p.8, emphasis added).
Overall, findings suggest that “After conducting an RCA, healthcare workers are left to their own devices in generating risk control plans” (p.8), and assumptions that investigations will lead to good risk control plans may not be valid in healthcare.
In discussing the findings, they argue that “some of the most popular risk control strategies in healthcare (training and education) may do more harm than good” and “Perhaps as a result, there is limited evidence that RCA actually leads to patient safety improvement” (p9).
They cite research highlighting that “root cause analysis” methods or tools have been shown to increase the number and quality of causal and contributing factors identified during investigations. Therefore, introducing “an analogous method to assist with the generation and assessment of robust risk controls might prove similarly successful, thus ensuring that this improved risk analysis does not go to waste” (p9).
They note the possibility of strong publication bias in this sample (for example, none of the studies reported that any of the implemented controls were unsuccessful).
Authors: Alan J. Card MPH, CPH, CPHQ James Ward BEng, CEng, PhD, MIETP. John Clarkson, 2012, Journal of Healthcare Risk Management
Study link: https://doi.org/10.1002/jhrm.20090
Link to the LinkedIn post: https://www.linkedin.com/pulse/successful-risk-assessment-may-always-lead-control-after-hutchinson
One thought on “Successful risk assessment may not always lead to successful risk control: A systematic literature review of risk control after root cause analysis”