Endeth the time, cometh the risk register

"A risk register is not a forecast or a prediction. It's where civil servants contemplate the most extreme consequences of any major government project. They think the unthinkable to ensure that the unthinkable never happens"
- Simon Burns, 22 February 2012

"We do not comment on leaks. We have always been open about risk..."
- Department of Health, 27 March 2012

Yesterday, the Health and Social Care Bill transitional risk register was leaked to both Dr Phil Hammond and Roy Lilley. Or at least a version of it was. The excel document is dated October 2010, with a version number of 1.1, an "as at" date of 28 September, and a headline of "draft for discussion".

First and foremost, I have read through the risk register and to my utmost surprise, I haven't gone blind and my brain hasn't turned to mush and leaked out of my ears. Who would have thought it? Viewing risk registers isn't so risky after all.

Secondly, I sincerely doubt that the fact the risk register has been leaked is going to change the way all risk registers are used forever more.

Now, on to the actual content.

45 risks are listed (numbered 1-46, but there is no number 8... too risky to even document?!?), with associated descriptions, actions and owners. Each risk is also given a priority (imminent or longer term), likelihood (from 1 = rare to 5 = almost certain), impact (from 1= very low to 5 = very high), and overall rating (its likelihood score multiplied by its impact score).

This is absolutely standard, text book, risk register stuff. Nothing scary, nothing extreme, nothing outlandish, and nothing unthinkable. Just an attempt to methodically detail, categorise and prioritise the relevant risks.

Leaving aside the fact that the colour coding of the overall risk ratings seems to have gone a bit awry, 7 of the 45 risks have a red overall risk rating (designated by a likelihood of 4/5 and an impact of 4/5) with a priority of imminent. Snippets from these risks are below:

"risk that Bill proceeds on basis of incomplete/flawed design"


"As the Bill proceeds through Parliamentary stages, amendments are made which have unforeseen consequences for the system, with possible impact on costs or performance of the system"


"Bill proceeds, without assurance that the whole system is affordable... system could be more costly if GP consortia make use of private sector"


"Aspects of implementation begin before adequate planning has been done"


"As transition progresses, management lose focus on BAU performance"


"Financial control is lost"


"Planning, preparation and governance is hindered and... policy design is limited leading to mistakes in design and legislative drafting"

A further 7 risk risks are red rated with a priority of longer term. Snippets from these risks are below:

"more failures, including financial, eg GP consortia go bust or have to cut services"


"lack of clarity during the transition in terms of acountability... leads to delays and increased costs and poor BAU performance"


"NHS commissioning board is not sufficiently developed to assess capability of consortia. GP leaders are not sufficiently developed to run Consortia"


"Staff morale"


"Public reputation"

Interestingly, 6 of the 45 risks have not been scored or rated. And one of these has not been marked as being covered by, or overlapping with, other risks. Snippets from that risk are below:

"Inability to reduce running costs because of consortia numbers"


"Loss of clinical time by GPs due to consortia management responsibilities"


"Failure to manage referral demand"

Now, reading through the above, do they sound like the unthinkable, the bizarre, the outlandish, the extreme? And how many of them do you think are no longer risks? And how many of them do you think have now actually become issues, rather than risks?

And although I agree that a risk register is not strictly an actual forecast, when you look at the highest risks (defined as high partly because they are likely) in this particular risk register, you are left thinking that it is pretty close to the mark and a pretty accurate prediction.

There's already some talk that the risk register has been deliberately leaked at this point, as it is too late to influence the passage of the Health and Social Care Bill, and it is a good distraction from 'Cam Dine With Me'. Whether deliberate or otherwise, having reviewed the risk register, I think it blows apart any and all arguments put forward for its suppression. It would have provided an excellent basis upon which to have an informed, intelligent debate about the proposed Health and Social Care Bill.

Just a shame that our elected and unelected representatives did not agree... or maybe they just didn't care?

Chris

Who's afraid of the big, bad risk register?

I'm getting towards the age now where I can start saying that things have changed since my day. Well, let me tell you, risk registers have most definitely changed since my day. In fact, they've changed since last week as far as I can see. And their transformation has been rapid, profound, and unexpected.

A risk register used to be a run of the mill project management tool. You'd identify the risks to your project, describe them, and then assign attributes to the risk - for instance, how likely is it to occur? What would be the impact if it did occur? Who's going to take ownership of the risk? What mitigating actions is the risk owner (and others) going to take to (ideally) eliminate the risk, or reduce its likelihood and/or impact?

Sensible type stuff, right? Nothing too scary. Of course in practice the quality of a risk register can vary significantly. Some of that variance is down to what sort of project it is and what sort of project manager is in charge of it. Some of it is just down to human nature - countless projects will kick off with the best intentions, initiate the full range of approved project management tools, review the risk register once and then rarely, if ever, look at it or update it again (they'll also often be poorly formatted without the requisite level of Microsoft Excel love and pastel shading, but that might say more about me than about risk registers...).

Now that's what I understand a risk register to be. Imagine my escalating surprise over the last few days as it has morphed into a necromantical nightmare, which cannot be released for fear of melting the feeble brains of us poor plebs.

Bit of background and context - on Monday 30 January 2012 early day motion 2659 was tabled in Parliament. The motion stated:

That this House expects the Government to respect the ruling by the Information Commissioner and to publish the risk register associated with the Health and Social Care Bill reforms in advance of Report Stage in the House of Lords in order to ensure that it informs that debate.

In November 2011, the Information Commissioner had ruled that "the public interest in maintaining the exemption (the exemption being 'formulation of government policy') does not outweigh the public interest in disclosure". The Commissioner therefore required that the Department of Health release the risk register that related to the Health and Social Care Bill.

The original request made for the release of the risk register was in November 2010 - the wheels, they do turn slowly!

The subsequent debate following the early day motion happened yesterday, Wednesday 22 February 2012. In my humble opinion, and with all due respect to the honourable members, none of the major parties covered themselves in glory during this debate.

We have this gem from Julian Smith MP - "Why is the right hon. Gentleman (Andy Burnham MP) such a scaremongering buffoon?"

The Deputy Speaker even felt compelled to interject - "this is easily and by some margin the worst-tempered debate that I have chaired".

The transcript of the debate is very long, but do pick out your own highlights if you get the chance. For me, it basically boiled down to quite a lot of going off the topic of the debate, so that opposing sides could make their points about why the Health and Social Care Bill is a good or a bad thing. And also quite a lot of Labour accusing the Government of hiding something that should be released, and the Government accusing Labour of hypocrisy.

Here's Andrew Lansley MP - "Frankly this is a broken bat debate...because the shadow Secretary of State (Andy Burnham MP) is trying to suggest that this Government should do something that he as a Minister and then as Secretary of State steadfastly refused to do".

Frankly Andrew, I don't care. It's totally irrelevant what previous governments have or haven't done. The fact is that the request for a specific risk register has been made now, and the request has been upheld and endorsed by the Information Commissioner. And besides, why not take this opportunity to be better than previous governments? You remember, the whole most open and transparent government in history thing.

Chris Skidmore MP threatened to inject some much needed sanity into proceedings - "Members have talked today about the risk register in apocalyptic terms, as though it were a document that should remain within the confines of MI5 or MI6". Sadly he then went on to say - "The risk register that would be released is that from the time of the White Paper, before the changes were made and before the listening exercise... If the document was released, it would be out of date, inaccurate and would scaremonger among the population".

In a superb heads I win, tails you lose manoeuvre, Mr Skidmore concluded - "The Government do not have to publish the updated registers on the basis of the Information Commissioner's verdict, which was on the autumn 2010 register... The Opposition are asking for an out-of-date document. We might as well give up and go home".

Oh would you? Please. Politicians giving up and going home... what's the worse that could happen? Maybe I should start a risk register...

So Mr Skidmore, who seemed visibly delighted with his reasoning, is simultaneously saying that the risk register isn't scary but its release would scaremonger the population, and that the Government shouldn't release an out of date risk register, but won't release the most recent version. Got that? Good.

Mr Skidmore, on fire by this point, had more to offer - "We are debating whether we should release a register that is no longer relevant and that was written in autumn 2010, at the time of the request on 29 November. The topic is completely irrelevant, as the debate has moved on. We have wasted six hours of parliamentary time today discussing an out-of-date risk register".

Chris (good name, by the way) - I've got a really good idea. Why not just release the risk register and not waste any more time? Oh, and just to point out, it's taken this long from the original request because the Department of Health and the Government have fought its release every step of the way.

Ok, that's more than enough from the debate itself. As I say, the transcript goes on and on and on, so feel free to read it for yourselves.

The final quotes in this post must go to Simon Burns MP (or #SimonBurns4SOS to give him his full title - follow Andy Cowper on Twitter, @HPIAndyCowper, for more). Here's a blog by Mr Burns posted just before yesterday's debate began.

Mr Burns says that risk registers are where civil servants "contemplate the most extreme circumstances of any major government project. They think the unthinkable to ensure that the unthinkable never happens... The consequence of this is a paper trail which details some of the most outlandish and extreme possibilities that civil servants have contemplated".

I'm sorry, what? No seriously, what? That's not a description of a risk register, that's a description of a think the unthinkable register - which incidentally doesn't exist as a thing, and is a trite contradiction anyway. Or it could be a description of an outlandish and extreme register - which again doesn't exist as a thing, and would be somewhat pointless to introduce as a new project management tool.

This is pure fantasy. It's trying to persuade us that senior civil servants sat down and detailed the most extreme and unlikely things possible to do with the Health and Social Care Bill. Right, so guys, risk number one... anyone? Here's one, aliens come down and snatch Andrew Lansley's body... ok, good, now we're cooking with gas... but hang on, is that a risk or an opportunity? Hmmm, good point. Ok, well there's that Mayan prophecy about the year 2012. Oh yeah! And there's that film that backs it up. Stick it down!

Civil servants haven't thought the unthinkable on the risk register (just to note once again, that is a truly rubbish, oxymoronic phrase). Nor have they detailed the most outlandish and extreme things possible. All they've done is document what they see as the risks associated with the Health and Social Bill. Nothing more, nothing less.

Now, to end, here's a quick Q&A:

Q: Will releasing the autumn 2010 risk register associated with the Health and Social Care Bill scare the general population?

A: No, although it would be good if the media didn't try to sensationalise anything that was within it. Risk registers are what they say on the tin - they register risks that might occur, and it is a positive and responsible thing to try to document those risks.

Q. Would releasing the autumn 2010 risk register associated with the Health and Social Care Bill now be pointless?

A. No. Things may have moved on, but it should provide an accurate picture of what were the perceived risks at that time. Again, we might need the media to be responsible and recognise that.

Q. Should the Government release the autumn 2010 risk register associated with the Health and Social Care Bill?

A. Yes. They have been instructed to do so by the Information Commissioner. If they wish to also release an up-to-date register to show how things have changed and moved on, no-one is going to stop them.

Q. Should politicians pack up and all go home?

A. ...

You see, it's quite a bit about trust and faith for me. My trust and faith on things to do with the Health and Social Care Bill has long since been used up (mmmm, brains). So the Government might think that they're being smart fighting tooth and nail not to release the risk register, but actually, all it makes me think is wow, its contents must be really, really bad or it must be a really, really shoddy piece of work (or both) for them to kick up such a fuss.

Now you tell me, does that help nurture an informed and productive debate about the major changes to the NHS that are on the horizon?

Chris



P.S. I've stayed pretty focused throughout this post for a change, so here's the wandering off that you've been waiting for... and it is worth waiting for.

Here's Gareth Johnson MP during yesterday's debate - "The BMA (British Medical Association) opposed the very creation of the national health service, so we should take no lessons from such organisations".

Nice one, Gazza. Do you happen to remember who else opposed the creation of the NHS? Yes, that's right. The Conservative Party. We should take no lessons from such an organisation.

P.P.S. I can't believe I forgot to say what the outcome of yesterday's vote was! 246 MPs voted in favour of releasing the risk register, but 299 voted against. So by a majority of 53, the risk register stays safely under lock and key, and every day life can continue. You can rest easy... for now at least.