Background: Effective hospital governance depends on proactive board leadership to minimize risk.

Study Aim: To survey hospital board chairs about governance practices, particularly with respect to approval processes for oversight of management preparedness for unforeseen emergencies.

Methods: A 2004 survey of hospital managers initially suggested greater board leadership in risk management as a desired strategic priority for Ontario's acute care hospitals. Our literature review and panel process defined 34 best practices in board governance, including two practices explicitly addressing the board's role in preparing for risk.

Results: Our findings revealed that some boards may not be actively engaged in ensuring that adequate processes are in place to protect against risk. More than one-quarter (n=28, 26.9%) of board chairs reported that they had not approved a management plan to address emergencies. Thirty respondents (28.8%) said they had not approved a process to identify, manage and minimize risks to the hospital's sustainability. Forty-seven respondents (45.2%) said they had not approved both of these two processes. A significant association emerged between boards that had approved both risk preparation strategies and boards that had implemented six key governance practices relating to accountability for leadership and stakeholder communication.

[To view the French abstract, please scroll down.]

Risk management means being prepared for harm - including financial loss and damage to reputation - that might arise from high-threat events such as disease outbreaks. In Ontario, hospital board responsibility for risk identification and oversight - i.e., for identifying unusual risks to the organization and for ensuring that plans are in place to prevent and manage such risks - is enshrined in Regulation 965 (section 2) of the Public Hospitals Act(PHA), which states, in subsection 2(3)(e)(i): "The board shall … ensure that the administrator, medical staff, chief nursing executive, staff nurses and nurses who are managers develop plans to deal with emergency situations that could place a greater than normal demand on the services provided by the hospital or disrupt the normal hospital routine" (Public Hospitals Act 1990).

Two successive outbreaks of Severe Acute Respiratory Syndrome ("SARS 1" and "SARS 2") in Toronto during the spring and summer of 2003 provide examples of such unforeseen system shocks. How well did Ontario hospitals respond? Judge Campbell's (2006) commission of inquiry into the SARS crisis reported that Ontario's health protection system was "broken, neglected, inadequate and dysfunctional." Forty-four people died of SARS, and an estimated 331 others (45% of whom were health workers) suffered serious lung disease. The final Campbell report underscored inadequate leadership and coordination at the hospital and system levels.

Infectious epidemics are not the only source of emergencies. System shocks include fires, floods, earthquakes, electrical blackouts or, every citizen's nightmare, potential bio-terrorist attacks - all natural and unnatural occurrences that present significant risks to a hospital. Since boards bear fiduciary responsibility for the hospitals they serve (Corbett and Mackay 2005; Corporations Act 1990) and, thus, have an ethical and legal mandate to oversee management risk plans, we decided to survey board chairs at Ontario's acute care hospitals to determine whether they had, in fact, approved such plans. We hoped that lessons learned in Ontario would be useful to hospital boards across Canada.

Literature Review

In the aftermath of SARS, the Naylor (2003), Walker (2004) and Campbell (2006) reports were unanimous in pointing to inadequacies in institutional outbreak management protocols, infection control and infectious disease surveillance, but the specific risk mitigation duties of hospital boards were not prescribed. In the Pointer and Orlikoff (1999) model of board governance, boards are responsible for policy formulation, decision-making and oversight across five discrete domains that minimize risk: responsibility for organizational ends, responsibility for executive management performance, responsibility for quality, responsibility for finances and responsibility for the board itself.

A comprehensive online search of reported case law in two compendia, LawSource and the Canadian Legal Information Institute, indicates that the legislated obligations of boards with respect to risk management under the PHA have not yet been judicially interpreted in Ontario (Canadian Legal Information Institute 2007). However, under common-law principles of institutional liability, a hospital might be found negligent if a patient plaintiff who suffers damages (e.g., loss of employment after falling ill) could successfully prove, on the balance of probabilities, that the board had never properly turned its attention to the issue of emergency planning, either through undertaking a formal approval process or via a regular review of management implementation procedures (i.e., de facto approval).

Best practices in managing risk are still evolving, but the emerging practice principle is that boards need to be aggressively proactive in their preparation. In the North American private sector, there are no precise survey data about the prevalence of board policies to mitigate risk, but the Sarbanes-Oxley Act (2002), intended to reduce the frequency of inaccurate and fraudulent financial reporting in US private firms, has had a salutary impact on board awareness of the power of risk management policies to obviate sudden financial shocks. The increased attention to risk management by investors and the media has led many private firms to upgrade their risk management and monitoring systems against fraud and unethical business practices (Kambil and Mahidhar 2006). In light of empirical findings showing that some of the greatest value losses for US publicly traded companies stem from "low-frequency, high-impact events" such as the September 11, 2001, terrorist attacks, one Web-based report has recommended that firms continually employ "stress testing" to ensure that internal controls and business continuity plans can withstand the shock of a high-impact rare event (Kambil and Mahidhar 2006). Ongoing stress testing of this nature is a board-led activity that would, in the Ontario hospital context, ensure compliance with the emergency preparedness (EP) provisions of the PHA.

There have been few previous surveys of hospital risk management strategies. A national survey of 1,300 respondents in the non-profit sector found that only 28% of respondents in the hospital subsector (13% of the total sample) had a formal crisis plan in place, while 71% had a formal risk management strategy (Bugg et al. 2006). In the Canadian non-profit sector as a whole, the survey found a formal risk management policy in 60% of organizations and a formal crisis management plan in 65% (Bugg et al. 2006).

Survey Methodology

Following a literature review, and drawing on the results of a 2004 strategic priorities survey (Brown et al. 2005) of the same acute care hospitals, we identified 80 separate board policies and practices that theoretically contribute to good corporate governance.

Nine corporate governance experts familiar with the Ontario hospital context - including lawyers, hospital CEOs, directors and (current and former) board chairs - individually ranked these 80 measures (on a five-point scale) against the following criteria:

• Actionability:The practice/policy under consideration is under the control of Ontario hospital boards.
•  
• Quality: This practice/policy is a useful measure of the quality of hospital corporate governance in Ontario.
•  
• Utility: Hospital boards would find reports comparing the rate of use for this practice useful for benchmarking.

A consensus among the experts resulted in 34 best practices that could be framed as yes/no questions. Two of the 34 questions related directly to board approval of management's risk preparation plans and thus reflected risk management requirements in the PHA. We were interested in the responses to these two questions: First, had the board "approved a management plan that addresses the handling of potential emergency situations (e.g., a SARS outbreak, power shutdown or bio-terrorist attack) which could place a greater than normal stress or demand on hospital services"? Second, had the board "approved a risk management plan that includes a process to identify, manage and minimize risks to the hospital's sustainability"? Beyond discovering rates of response to these two questions, we were interested in the association between an affirmative response to these questions and endorsement of other best practices assessed in the survey.

Researchers at the Canadian Institute for Health Information (CIHI) and the Hospital Report Research Collaborative (HRRC) based at the University of Toronto sent the survey and accompanying instructions via e-mail to hospital board chairs at 122 Ontario general acute care hospital corporations in November 2005. Hospital CEOs were notified by a separate letter, also sent electronically, describing the nature of the survey. Board chairs were given four weeks to complete the survey online, and were advised that a "snapshot" of overall provincial, local health integration network (LHIN) and peer group breakdowns (based on the 2005 Joint Policy and Planning Committee formula) of some of the data (but not individual hospital data) would be published in Hospital Report 2006: Acute Care (HRRC 2006). Responses to questions related to EP are reported in this paper for the first time.

Results

The overall response rate was 86.8% (106/122). Hospitals with multiple boards were given the opportunity to respond as one entity or as distinct boards; in the rare instances where there were variations in subboard responses (i.e., variation in policy as reported by board chairs at different sites), scores on individual question elements were averaged among the sites to reflect an aggregate score for the hospital (e.g., 2/3 "yes" responses = "yes").

Survey respondents included 110 board chairs or their designates, representing 106 separate acute care hospital corporations in Ontario. (Three multi-site hospitals chose to respond individually, which explains the discrepancy in the numerator.) For the two questions addressing board risk management approval and oversight, there were two missing values, representing a response rate of 85.2% (104/122) for these response items.

More than one-quarter (26.9%) of responding board chairs (n=28) reported that their hospital board or a committee of the board had not, as of November 2005, "approved a management plan that addresses the handling of potential emergency situations (e.g., a SARS outbreak, power shutdown or bio-terrorist attack) which could place a greater than normal stress or demand on hospital services." A slightly higher proportion of board chairs (28.8% or 30/104) reported that their board had not "approved a risk management plan that includes a process to identify, manage and minimize risks to the hospital's sustainability." Altogether, 47 of 104 boards (45.2%) had failed to approve both risk management plans.

[Table 1]

Affirmative answers to both of the two EP questions were associated with six of the remaining 32 best practices/processes in the survey (Table 1). These six measures are of interest because they help to ensure the continuity of the corporation's leadership through careful succession planning for board members (items 1-3) and ensure accessibility, review and transparency of its procedures (items 4-6). It makes sense that, in order to discharge the responsibility of risk assessment, board members pay close attention to leadership roles and that they require and share high-quality information on putative risk from a broad set of sources (Quigley and Scott 2004; Treasury Board Secretariat 2000).

The complete survey, with associated response frequencies and responses from acute care hospital board chairs, is included in an Appendix (see PDF).

Discussion

Almost two years after a 2004 survey (Brown et al. 2005) concluded that senior managers see disaster planning and emergency preparedness as important to their organization's strategic directions, the findings here indicate that not all hospital boards had shown a proportionate response at the time of our survey. The lack of reported adherence to two risk management approval practices may be explained by various factors. It is possible that board chairs, the respondents in this survey, were not fully aware of all board approval and oversight practices, the responsibility for which can, at times, be delegated to outside legal counsel, to a hospital committee or to a subcommittee of the board. This in itself would, however, suggest a gap in internal communication among board members and/or between outside legal counsel and the board, a gap that presents an obstacle to effective governance.

It is also possible that those boards that did not approve EP plans believe that risk planning activities are best left entirely to senior management, with the board available for advice when needed (i.e., with recommending authority only). Boards may have an approval process whereby a manager in charge of EP is required to report to a governance committee, a committee of the full board or both on a regular basis. Should EP plans be deemed inadequate, the board then has the power to intervene and demand improvement. Such a laissez-faire process may have elicited a "no" answer to the survey questions.

Since this is the first time these specific approval practices have been systematically surveyed for publication among a large sample of Ontario hospital boards, and since no jurisdiction has published norms, it is not possible to estimate the degree to which the findings reflect general characteristics of public hospital boards. However, the findings are consistent with recent data suggesting that there is potential for improvement in risk management practices at Canadian hospitals and in the non-profit sector generally (Bugg et al. 2006).

A limitation of our findings is the lack of nuance in the questions posed. In particular, it is possible that boards answering "no" to approving management plans were in the process of approving them (one board chair indicated as much to explain why this response was missing). Another board chair who left the EP question blank advised that the board is apprised of all management plans/operational issues either via regular monitoring/reporting or via the CEO's monthly reports to the board on salient issues. This response suggests the board might possibly ensure that management has contingencies in place for emergencies for "greater than normal stress or demand" without the board's formally approving an operational plan; i.e., adherence to the PHA and fiduciary requirements could theoretically be satisfied by regular updates on related issues from the CEO or other executives. Greater nuance in the survey questions could have allowed for response options that reflected gradations of implementation.

Further, no audits were conducted of the validity of board chair responses. An audit process could have helped to determine the degree to which the responses given matched processes or practices approved and in place at the hospitals. A follow-up analysis could identify a subsample of hospitals willing to provide such input for a subsequent survey and audit.

Despite the lack of nuance in the questions posed, the language of the PHA and fiduciary legal obligations do require explicit, ongoing board approval and oversight of management's EP protocols. This requirement provides our rationale for the survey language used. This interpretation is also consistent with standard rules of statutory interpretation, suggesting that the words "shall … ensure" in the PHA require active board approval of such policies (Interpretation Act 1990). The responses of those boards that had not approved management plans for EP appear to be at odds with the high strategic importance placed on risk planning by senior management at the same hospitals in the earlier January 2004 survey.

According to the report of the Ontario Hospital Association (Corbett and McKay 2005), the board needs to take additional steps to "ensure the board's behaviour and processes are in line with respect to risk," which, in the context of emergencies such as epidemics, require the board to react quickly and to direct management to respond. The report recommends other types of oversight a board should consider, including processes to ensure that management has implemented a proper risk identification and assessment mechanism; has maintained sufficient insurance programs given identified and assumed risks; and has established effective budget and capital planning processes. In short, it would be insufficient for the board to wholly delegate risk planning to a management committee; the board must approve and review the appropriateness of the management plan. This is consistent with the emerging consensus on the role distinction between the board and management, summarized in a 2001 Toronto Stock Exchange report whose conclusions are equally applicable to the non-profit sector: "the Board cannot be too accepting of management's views. It has the responsibility to test and question management assertions, to monitor progress, to evaluate management's performance and, where warranted, to take corrective action" (Saucier et al. 2001: 12).

A board is required by law to make itself aware of the material and foreseeable risks of all aspects of the business in which the corporation is engaged. To this end, the hospital board must actively concern itself with risks potentially arising from high-threat events that will "disrupt the normal hospital routine." Other less obvious risks to which the board should be sensitive include anything that might be prejudicial to the sustainability of the hospital in the near or long term, including reputational risks arising, for example, from unfavourable media coverage. Sensitivity to these risks is consonant with the concept of enterprise risk management, where risk is seen from a broad perspective and includes both financial, quantifiable losses, as well as intangible reputational losses.

Conclusion

The findings reported here suggest that some boards may not be as engaged in risk management approval activities as they could be. The board of a hospital should be directly accountable to staff, to the patients and communities served and to the government funding authority (Hundert 2003). Our findings suggest that risk management plan approval on the part of the board may be predictive of the more general concept of public accountability. As suggested in our analysis, board engagement in risk planning is associated with increased attention to succession planning; a more proactive attempt to nominate a diverse set of directors; the documentation and public accessibility of board and committee processes; better information-gathering on the board; and more regular reports to the community and to stakeholders regarding organizational performance.

Future research should probe these associations to determine whether linkages exist between risk management engagement on the board and other areas of performance for the organization - e.g., indicators of financial performance or patient satisfaction - particularly following times of system stress. Case study interviews at different sites are needed to explore the diversity of risk management oversight practices among hospital boards, and to determine whether there are special directors' skills in risk management that may be needed to implement those practices effectively.

Before directors can adopt truly effective risk management oversight plans, they need more information about the diversity and feasibility of different models to determine which is most suitable for their board's unique governance structure and strategic directions. Finally, the emergence of LHINs in Ontario may provide an ideal opportunity to standardize region-wide governance policies in relation to emergency preparedness, which, in turn, could lead to improved system readiness in the event of a future system-level destabilizing event. Whatever the overarching governance authority, our study suggests that fiduciaries should be proactive to ensure that management has enacted proper organizational protection against unforeseen risk.

[To view the Appendix, please download the PDF.]

La planification des services d'urgence en Ontario : enquête auprès des présidents des conseils d'administration

Résumé

Contexte : La gouvernance hospitalière efficace dépend des mesures proactives que prennent les conseils d'administration pour atténuer les risques.

But de l'étude : Mener une enquête auprès des présidents des conseils d'administration des hôpitaux sur les pratiques de gouvernance, en particulier les processus d'approbation liés à la surveillance de l'état de préparation de la direction aux situations d'urgence imprévues.

Méthodes : Une enquête menée en 2004 auprès des gestionnaires d'hôpitaux a initialement suggéré qu'un rôle de leadership accru des conseils d'administration dans la gestion des risques constituait une priorité stratégique souhaitable pour les hôpitaux de soins actifs de l'Ontario. Notre examen de la documentation et les travaux d'un groupe d'étude spécial ont permis de définir 34 pratiques exemplaires liées à la gouvernance des conseils d'administration, dont deux qui ont trait au rôle explicite de ces derniers dans la préparation au risque.

Résultats : Nos constatations révèlent que certains conseils d'administration ne jouent peut-être pas un rôle actif dans la protection de leur établissement contre les risques. Plus d'un quart (n=28, 26,9 %) des présidents des conseils d'administration ont indiqué qu'ils n'avaient pas approuvé de plan de gestion en cas d'urgence. Trente répondants sur 104 (28,8 %) ont dit qu'ils n'avaient pas approuvé de processus visant à cerner, à gérer et à minimiser les risques pour la durabilité de l'hôpital. Quarante-sept (45,2 %) répondants ont dit n'avoir pas approuvé les deux processus. On a relevé un lien important entre les conseils d'administration qui avaient approuvé les deux stratégies de préparation aux risques et ceux qui avaient mis en œuvre six pratiques de gouvernance clés ayant trait à l'imputabilité en matière de leadership et des communications avec les intervenants.

Comments

Be the first to comment on this!