Risk Assessment Matrix

Learning Objectives

1Explain why risk assessment is performed in regulatory enforcement
2Define likelihood, consequence, and risk domains
3Classify facilities into Low, Moderate, High, or Critical risk categories
4Understand how risk assessment supports consistent regulatory decisions

Overview

The Risk Assessment Matrix is the analytical core of AREF. It provides a structured method for evaluating the risk level of a health facility based on the likelihood of harm and the potential consequences of non-compliance across multiple risk domains.

Why Risk Assessment is Performed

Risk assessment transforms subjective inspector judgments into objective, data-driven classifications. Without it, two inspectors visiting the same facility might reach different conclusions about the severity of non-compliance.

By systematically evaluating likelihood and consequence, AREF ensures that every facility receives a risk classification that is consistent, defensible, and proportionate to actual patient safety risk.

The risk classification then drives the enforcement response — ensuring that the regulatory action matches the actual risk level of the facility.

Key Concepts

Likelihood

The probability that a non-compliance issue will result in patient harm. Rated from Rare to Almost Certain based on evidence gathered during inspection.

Consequence

The potential severity of harm if the non-compliance issue leads to an adverse event. Ranges from Negligible to Catastrophic.

Risk Domains

The specific areas of facility operation assessed during inspection: Patient Safety, Infection Control, Staffing & Competency, Facility Infrastructure, and Documentation & Records.

Risk Classification Matrix

Likelihood ↓ / Consequence →	Negligible	Minor	Moderate	Major	Catastrophic
Almost Certain	Moderate	High	Critical	Critical	Critical
Likely	Low	Moderate	High	Critical	Critical
Possible	Low	Moderate	High	High	Critical
Unlikely	Low	Low	Moderate	High	High
Rare	Low	Low	Low	Moderate	Moderate

Risk Classifications

LOW RISK: Minor non-compliance with negligible patient safety impact. Response: Education, guidance, and self-correction.

MODERATE RISK: Non-compliance with potential for patient harm if unaddressed. Response: Correction notice and corrective action plan.

HIGH RISK: Significant non-compliance with likely patient safety impact. Response: Formal enforcement action and close monitoring.

CRITICAL RISK: Severe non-compliance posing immediate danger to patients. Response: Immediate escalation — suspension, revocation, or legal action.

Why This Matters

The Risk Assessment Matrix is what makes AREF objective and defensible. When a regulator issues a suspension or fine, they can point to a documented risk classification that justifies the action. This protects both the regulator and the facility, and ensures that enforcement is consistent across all inspectors and all regions.

Key Takeaways

Risk assessment combines likelihood and consequence to produce a risk classification.
The four risk levels are: Low, Moderate, High, and Critical.
Risk domains cover patient safety, infection control, staffing, infrastructure, and documentation.
The risk classification directly determines the appropriate enforcement response.
Consistent risk assessment makes regulatory decisions defensible and fair.