Improving risk controls following root cause analysis of serious incidents in healthcare

Background Root cause analysis (RCA) is widely used following healthcare serious incidents, but does not necessarily lead to robust risk controls. This research aimed to examine current practices and to inform an understanding of what good looks like in formulating and implementing risk controls to improve patient safety.Methods First, I undertook a content analysis of 126 RCA reports over a three-year period from an acute NHS trust, with the goals of characterising (i)the contributory factors identified in investigations and (ii)the risk controls proposed in the action plans. Second, I conducted a narrative review of the academic literature on improving risk control practices in safety-critical industries, including but not limited to healthcare. Finally, I undertook a qualitative study involving 52 semi-structured interviews with expert stakeholders in post-incident management, analysed using the framework method.Results Content analysis of serious incident investigation reports identified the preoccupation of RCAs with identifying proximate errors at the sharp end of care, neglecting wider contexts and structures. Most (74%) risk controls proposed could be characterised as weak and were poorly aligned with identified contributory factors. Together, the narrative review and the findings of the interview study suggested eleven features essential to addressing these problems: systems-based investigations; a participatory approach, skilled and independent investigators; clear and shared language; including patients’ views; allocating time and space to risk control formulation; adding structure to risk control formulation; sustainable risk controls mapped to identified problems; purposeful implementation and better tracking of risk controls; a collaborative approach to quality assurance and improved organisational learning.Discussion and conclusion: RCAs as currently conducted, and the action plans that arise from them, are often flawed. The eleven features identified will be important in improving risk control formulation and implementation. To operationalise these features, there is a need for: professional and independent investigations, risk controls based on a sound theory of change, and improved cultures and structures for organisational learning.