The risk management process

The first step for the practice is to appoint a reprocessing team to be responsible for risk management and hazard analysis. This team will include the practice’s IPC coordinator. Other members could include:

• practice management
• members of the practice team involved with reprocessing
• members of the broader clinical team
• external experts for reference and guidance.

A practice manager can contribute valuable risk analysis skills from a management perspective. Other members of the practice team may bring specific expertise that strengthen the reprocessing team’s effectiveness.

Even a small team of two people is better than relying on just one person, as having a single person responsible can be a risk in itself. The team should be a manageable size for the practice: large enough to bring in different skills but not so big that it becomes overwhelming.

The sequence of steps or actions involved in reprocessing a reusable medical device need to be outlined in a clear process. This begins when a reusable medical device leaves its point of use on a patient. An example is shown in Figure 10.1.

Figure 10.1 Example of a “process flow” for a reusable medical device

Source: Adapted from Standards Australia AS 5369 – Reprocessing of reusable medical devices and other devices in health and non-health related facilities

The basic requirement for a risk-based approach is the identification of threats or hazards that occur throughout the defined process.

Threats or hazards are identified in four categories:

1. Physical (P)
2. Chemical (C)
3. Biological (B)
4. Quality (Q) (environmental and personnel).

These categories help determine the types of risks associated with each step of the reprocessing cycle and inform the appropriate control measures required.

Examples of threats or hazards corresponding to the four categories are outlined in Table 10.6.

Table 10.6 Examples of categories of hazards

Consider the construction and use of the devices as well as the appropriate Spaulding Classification Scheme classification for the device – non-critical, semi-critical or critical.

Some examples of general practice devices are forceps, scissors, suture packs, scalpel handles, gauze swabs, and vaginal specula.

Table 10.7 Examples of threats or hazards in relation to example process flow in Figure 10.1

Source: Adapted from Standards Australia AS 5369 – Reprocessing of reusable medical devices and other devices in health and non-health related facilities

Risk evaluation

A risk matrix is used to conduct a risk evaluation on every identified threat or hazard.

This risk matrix determines the likelihood and consequence of an identified threat or hazard, assigning each a risk category (low, medium, high or extreme).

Table 10.8 Sample risk matrix

Source: Adapted from NHMRC (2019)

From the threats and hazards that are identified at the practice, each threat or hazard is inserted into the risk matrix and the rating is recorded. An example of this is shown in Table 10.9.

Table 10.9 Examples of cleaning step hazard analysis

When the likelihood and consequence have been established, the control measure can be determined. The control measures could include:

Standard operating procedures that are:

• detailed, including complete scope, materials and process
• training documents
• published and accessible for all staff
• based on published standards and recommended practices
• routinely updated (new equipment, devices, processes, etc)

Staff training and competency measures include:

• new training opportunities for the practice team
• new products and processes
• updates and continuing education.

Instructions for use for the device and equipment:

• are important considerations with new purchases
• contain information on whether devices or equipment may be reprocessed with resources already available in the practice
• need to be complete and accessible
• provide proof of current version.

Corrective actions and precautions can then be determined and records kept when the risk rating has been calculated (See Table 10.10)

Table 10.10 Risk estimation table: ranking example

Control measure documentation

After a risk rating has been assigned to the hazard or threat, document the control measure required to control hazard or threat.

The documentation for this process could include:

1. 1. What is being monitored?
   2. Who is monitoring?
   3. When is the critical limit being monitored?
   4. How is the critical limit being monitored?

    c. Corrective action, what is the consequence if the critical limit is not met?
    d. Records, where are the records being kept?

Table 10.11 provides an example of identification of hazard and assigning control measures.

Table 10.11 Risk and hazard evaluation and control measure documentation

Download template for use: Template – Reprocessing risk and hazard evaluation and control measures

Once control measures have been implemented for each identified hazard or threat, evaluate the residual risk – that is, the risk that remains after controls are applied.

Residual risk evaluation helps determine whether the remaining level of risk is acceptable, or if additional measures are required. This involves reviewing:

• whether the control measures sufficiently reduce the likelihood and/or consequence of the hazard
• whether any hazards remain that could result in harm, even if controls are in place
• whether the risk aligns with the practice’s risk acceptance criteria, for example only tolerating "low" or "medium" risks.

The reprocessing team should document any residual risks and clearly indicate:

• the decision on whether each residual risk is acceptable
• justification for accepting the risk
• any further actions needed, for example enhanced monitoring, additional staff training, or escalation to governance processes.

Practices could choose to maintain a residual risk register to track and revisit these decisions as part of ongoing risk management.

Regular review ensures that the identified hazards, their associated risks, and the control measures remain relevant, effective and aligned with current practice.

The reprocessing team should conduct a risk management review:

• at least annually
• whenever changes occur to the process flow, devices, equipment, staffing, or facility layout
• in response to incidents, audit findings, or feedback from staff or patients

During the review, the team should:

• confirm that all hazards are still accurately identified
• reassess the likelihood and consequence of hazards in the current environment
• evaluate the effectiveness of control measures and whether they are still being applied
• update standard operating procedures, training documents, and monitoring tools as needed.

A documented risk management review helps demonstrate active management of reprocessing risks.

Turning analysis into action means ensuring that risk controls are applied consistently in practice and embedded into day-to-day operations.

The implementation phase includes:

• Information collection and documentation
  • Compile the full risk assessment, including hazards, risk ratings, control measures, and residual risks
  • Ensure all documents are version-controlled and accessible to relevant staff
• Information review
  • Check that standard operating procedures reflect the risk analysis and incorporate control measures
  • Ensure staff have access to validated instructions for use and equipment manuals
  • Confirm that all required training has been completed and documented
• Action
  • Integrate risk controls into practice workflows and responsibilities
  • Assign responsibility for ongoing monitoring and compliance
  • Schedule future reviews and set reminders to revisit key documents

Implementing the risk analysis is critical to ensuring that the assessment translates into real improvements in quality and safety.