Fluent Essays

Read the case study on Implicit Enterprise Risk Management: An IT Healthcare Adoption Case Study. Attached as PDF.Write your review on this case in your own words and include insight from your textbook on Chapter 5: ERM in practice at the University of California health system. Expectation: Written in APA style, write in your own words, in-text citation from Chapter 5, and 2-references in the Reference page (Chapter 5 and this PDF article) implicit_enterprise_risk_management_an_it_healthca.pdf implementing_enterprise_risk_management.pdf Unformatted Attachment Preview See discussions, stats, and author profiles for this publication at: https://www.researchgate.net/publication/288694949 Implicit Enterprise Risk Management: An IT Healthcare Adoption Case Study Article · January 2008 CITATIONS READS 2 141 2 authors: Say Yen Teoh Christopher Cheong RMIT University RMIT University 19 PUBLICATIONS 138 CITATIONS 34 PUBLICATIONS 560 CITATIONS SEE PROFILE SEE PROFILE Some of the authors of this publication are also working on these related projects: Risk management framework for aquacuture in Vietnam: the case of Vietnamese catfish farming. View project All content following this page was uploaded by Say Yen Teoh on 05 November 2015. The user has requested enhancement of the downloaded file. 19th Australasian Conference on Information Systems 3-5 Dec 2008, Christchurch Implicit ERM: an IT Healthcare Adoption Case Study Teoh & Cheong Implicit Enterprise Risk Management: An IT Healthcare Adoption Case Study Say Yen Teoh Christopher Cheong School of Business Information Technology RMIT University, Melbourne, Australia Email: sayyen.teoh@rmit.edu.au; christopher.cheong@rmit.edu.au Abstract The unusually slow adoption of information technologies in healthcare is mainly attributed to the overwhelming risks involved in the implementation process embedded in that particular industry. The issue of timing and approach in employing risk management to mitigate risks in healthcare still remains a challenge. In this paper, we report our work in which the objective was to explore the employment of risk management practices from a Singapore-based hospital which is re-designing its medical informatics and premises to provide patient-centric quality healthcare. A total of 19 face-to-face interviews were conducted. The findings highlight that although this organization did not explicitly set out to use an Enterprise Risk Management approach, it has inadvertently done so. The questions of when and where to employ ERM can be difficult to determine, especially in the healthcare industry, hence, we conclude that practitioners should review their existing risk management practices and identify the embedded ERM activities so as to leverage on them in facilitating the managerial guidelines to accomplish the task. Keywords Enterprise Risk Management (ERM), Medical Informatics, Case Study. INTRODUCTION Unlike other industries, the migration and use of information technologies in healthcare is as much as 10 to 15 years behind time in general (Economist 2003). Since the late 1960s, the US government has invested billions of dollars in various efforts to automate medical informatics but to no avail until 2004 (Thompson 2004). Similarly, the process of healthcare IT migration from traditional to medical informatics in Asia has been fairly slow. Such an unusually slow medical informatics take-off in the healthcare industry is mainly due to the uncertainty and risks involved. Mainly, hospitals have a duty of care to service their customers (patients, visitors and staff) and stakeholders (Okoroh et al. 2002). Such a duty of care involves improving and delivering service quality care with reliable and valid data (Ghali et. al. 2001) as well as the avoidance of clinical failures (Okoroh et al. 2002) that would render core public services subject to great risk and uncertainty. Thus, the challenge is how to best promote the adoption of medical informatics with minimal possible risks (Goldschmidt 2005). With the need of change in the healthcare industry (Burke et al. 2002) along with a host of promising new platform technologies confronting forward-looking hospitals, it can be difficult to decide which technologies to adopt, when to adopt them and how to manage the implementation process (Fichman 2004). In fact, very little is known about hospitals’ adoption of IT (Burke et al. 2002). Considering the much of uncertainties in the healthcare technology adoption, it is vital to explore the existence of risk management practices associated with the system adoption. Hence, the objective of this work is to explore the existence of risk management practices associated with the healthcare industry. Risk management is a systematic process of identifying or making a realistic evaluation of business risk levels and then developing strategies to manage these risks. Specifically, this is achieved through the process of risk identification, risk policy, risk definition, risk sharing, risk allocation, risk analysis, risk evaluation, and, finally, risk response, risk planning and risk minimization (Kangari 1988). In view of the diverse varieties in risk management studies, in this paper we explore risk management practices in a healthcare organization. The remainder of the paper is as follows. We firstly discuss the existing ERM literature, lessons learned from other researchers in the area. Next, we describe our research approach followed by a description of the case study used to analyze the challenges and risks involved in the process of adopting the medical informatics in the hospital. We then conclude by highlighting the implications of our findings for both research and practice purposes. 1011 19th Australasian Conference on Information Systems 3-5 Dec 2008, Christchurch Implicit ERM: an IT Healthcare Adoption Case Study Teoh & Cheong LITERATURE REVIEW Risk management is an important part of operating an enterprise as all enterprises face risks. This is particularly important in the healthcare industry as mismanagement of risks may result dire consequences (e.g. fatalities). To put things into perspective, in 1999, the Institute of Medicines To Err Is Human report (Kohn et al. 1999) stated that medical errors result in as many as 98,000 deaths per year. Physicians face astounding odds against medical errors as they are required to be knowledgeable about approximately 10,000 diseases and syndromes, 3,000 medications, and need to be constantly up-to-date about newly published medical literature (Davenport 2002). Thus, risk management has become a policy priority in many health systems around the world (McDonald et al. 2005). In traditional risk management, the only expected financial outcome from risk is the probability of loss (Ching 1997). The approach to traditional risk management is through mitigating the risks by using various strategies, including aggressive control of loss, safety, clinical risk management, and training (Ching 1997). In instances where the losses cannot be controlled, the risks are transferred through the use of insurance (Ching 1997). In traditional enterprises, departments are disintegrated and managed independently (Brannan and Taylor 2006; Liebenberg and Hoyt 2003). Traditional risk management assumes that successful risk management results from independent departments managing risk successfully (Brannan and Taylor 2006). However, such an approach may result in inefficient or inaccurate risk management as each department may have different definitions and treatments of risk. For example, a particular department may identify and manage IT related issues differently by unknowingly transferring the risks to others or, perhaps, it may be more effective to manage a group of relevant IT issues and risks rather than handling them separately. Having different perceptions and treatments of risk during the process of adopting IT can be further problematic, especially in industries such as healthcare, in which research has shown that poor management of such issues can lead to undesirable outcomes (Lorenzi et al. 1997). All in all, traditional risk management does not provide a holistic view of risks for the entire enterprise, is unable to deal with emergent or combinatorial risk (Shaw 2005), and cannot measure the financial or operational effectiveness of the risk management (Ching 1997). Enterprise Risk Management (ERM) builds upon traditional risk management (Ching 1997) with a different approach (Steinberg et al. 2004) as it does not assume that risks exist in isolated departments of an enterprise (Hoyt and Hall 2003). In general, ERM proposes a holistic approach of how an enterprise risk portfolio is created and managed. Understanding this can enable organizations to better plan and manage IT adoption. It is also preemptive in that risks are proactively handled: rather than reacting to problems, risks are anticipated and managed before the problems occur (O’Donnell 2005). ERM, is defined by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) as (Steinberg et al. 2004): a process, effected by an entitys board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives Based on the ERM framework, risk can be defined as an observable event(s) or action(s) that can have material impact on the organization’s financial or operational performance. Risks do not exist in isolation; in fact, they may exist across different domains, such as operational risk, financial risk, human capital, strategic, legal and regulatory, and technology (Ching 1997). With such a framework, it offers a fundamentally proactive approach for organizations to identify, manage, and exploit risks (Ching 1997) and leads to better operational and strategic decision-making in IT adoption which results in sustainable competitive advantage (Ching 1997; Hoyt and Hall 2003). In light of its strengths, many organizations have started adopting ERM at various stages of IT implementation (Beasley et al. 2005; Liebenberg and Hoyt 2003), including those in the healthcare industry (Brannan and Taylor 2006; Ching 1997; Ching 2001; Hoyt and Hall 2003). However, a common problem throughout various industries, especially in healthcare, is to understand and determine when to implement ERM (Ching 1997). In fact, not much is known about stages of ERM deployment or factors that affect the uptake of ERM in an enterprise (Beasley et al. 2005) and it can even be difficult to determine which enterprises are using ERM (Liebenberg and Hoyt 2003) in the process of adopting IT. However, some recent research has identified a few determinants which signal the use of ERM (Liebenberg and Hoyt 2003) and factors with affect ERM implementation and deployment (Beasley et al. 2005). These factors include enterprise characteristics such as size, auditor type, industry, and country of domicile (Beasley et al. 2005). Of critical importance is the leadership of the board and senior management (Beasley et al. 2005). Furthermore, the existences of a chief risk officer, board independence, and support from the CEO and CFO would also have a positive effect on ERM implementation (Beasley et al. 2005), which could influence the process of IT adoption. 1012 19th Australasian Conference on Information Systems 3-5 Dec 2008, Christchurch Implicit ERM: an IT Healthcare Adoption Case Study Teoh & Cheong Brannan and Taylor (2006) advise that there are three broad steps in implementing an ERM program in an enterprise. These are: analyze risk from a broader prospective, define roles and responsibilities, and create a strategy matrix to deal with specific ERM elements. As Brannan and Taylor’s (2006) steps are relatively general, we further explore the lack of study in the Asian healthcare industry, by relating to Shaw’s (2005) seven steps of implementing an effective ERM program, which are more specific: (1) assemble and educate a cross-functional team representing each significant functional area of the enterprise, (2) identify risks and opportunities the enterprise faces, (3) determine the enterprise’s risk appetite, (4) identify correlations between the risks and opportunities the enterprise faces, (5) prioritize risks and opportunities, (6) determine appropriate actions for mitigation of risks and exploitation of opportunities, and (7) implement an enterprise risk management system to continually monitor and respond to events and trends. Building on these recent studies, we explore our case study in light of these findings. METHODOLOGY The methodology adopted in conducting this research is an exploratory, in-depth case study. This is a method that specializes in exploring contemporary phenomena with empirical inquiry research on “how” and “why” questions (Yin 2003). This method is especially suitable to explore phenomena with a scarcity of existing research (Benbasat et al. 1987). The advantage of this method is it allows researchers to enter the research field with an open concept, without any pre-structured research questions. By doing so, it allows researchers to gather more unswerving and insightful information from informants, with rich depictions of the social context of the studied phenomena (Yin 1994). In line with our research area, we invited the Alexandra Hospital (AH) - one of the most dynamic Singaporean hospitals, to participate in this study. The case study was conducted over a period of six months from May to November 2006 with a total of 19 face-to-face interviews being carried out from nine distinct interviewees. Each interview session lasted between 1.5 to 3 hours, with informants ranging from nurses, IT specialists, doctors and top management with an average work experience of 3 years. We adopted a practical way of understanding textual data that is suggested by Myer (1997) via personal visits, email and phone contacts to bridge the relationships among researchers and key informants. By doing so, it enabled us to understand the meaning expressed by informants (Hirschheim et al. 1991) and discover the core case information that is necessary for comprehending the case study (Klein and Myers 1999). The structure of the case study is written based on Klein and Myers’s (1999) principle of contextualization to reflect on the AH social and historical background so that readers can understand the need for the system redesign. The case study write-up is structured in accordance with the chronological order of the system re-design process; headings are used to better illustrate the context. To ensure the quality of data collected, we triangulated data with other resources including empirical observations, follow-up email clarifications, and other secondary data. Data was analyzed mainly based on Klein and Myers’s (1999) principle of abstraction and generalization by relating the collected data through the application of ERM theory to make sense and describe the nature of human understanding and social action taken place throughout the system redesigning process to underpinning our result. CASE STUDY The methodology adopted in conducting this research is an exploratory, in-depth case study. This is a method that specializes in exploring contemporary phenomena with empirical inquiry research on “how” and “why” questions (Yin 2003). This method is especially suitable to explore phenomena with a scarcity of existing research (Benbasat et al. 1987). The advantage of this method is it allows researchers to enter the research field with an open concept, without any pre-structured research questions. By doing so, it allows researchers to gather more unswerving and insightful information from informants, with rich depictions of the social context of the studied phenomena (Yin 1994). Background A Singapore-based hospital has recently undergone a major restructuring exercise, preparing to move to its new premises in 2009. Taking advantage of being able to redesign its new premises and medical informatics, the AH top management launched a series of aggressive activities to study and manage its enterprise risk before IT adoption. Establishing Goals Since the establishment of the hospital, the AH’s patients and staff have experienced various forms of “hassles” owing to the inherent nature of procedures in traditional hospital settings. To address these issues, the CEO of the AH suggested the following goal: 1013 19th Australasian Conference on Information Systems 3-5 Dec 2008, Christchurch Implicit ERM: an IT Healthcare Adoption Case Study Teoh & Cheong “We want to improve health and reduce illness through patient-centric quality healthcare that information and resources are always accessible, comprehensive, appropriate, and most importantly cost-effective” Assessing the Need to Change With a clear goal in mind, an operation team comprising a group of doctors and IT consultants began to scrutinize their daily work processes to identify risk and bottlenecks, review the existing patient care processes as well as reassess ways to enhance patient services from the copious technologies. From the study, the operation team has targeted the priority of reducing patient waiting and administrative processing times. According to the Director of Operations: “It is an undeniable risk associated with the fact that patients might have to bear with long waiting time in hospital, be it for Emergency Ward, eye-nose-and-ear or others… the sooner we could diagnose, the lower the risk for our patients…the same happens for our administrative process. The sooner we could source out the relevant patients’ records for doctors the lesser the risk involved”. Weekly reviews are conducted with open invitations to all staff and patients to share their concerns, suggestions or even compliments to the changes made. Considering the People and Technology Challenges Healthcare is not only an information-driven business but it is also a labour-intensive business. The cost and value-added in healthcare may be more challenging as IT solutions do not adequately address this need to improve the clinical workflow. Therefore, the change in the AH has brought up two interesting challenges: a drive to break down tasks and re-engineer them more efficiently. According to the CEO, who draws from Brooks (2006): “IT solutions do not adequately address this need to improve the clinical workflow. Hardware and cost are the least of our problems. It is changing culture, habits and workflow in a large organization like a hospital that is tough” With that concern in mind, top management has been actively encouraging staff to contribute ideas that may help to improve the systems and workflows, as well as supporting the implementation of their ideas. According to the Assistant Director of Operations: “It is fairly easy to spot members of the top management walking the ground to get first insight of the problems” Doctors and nurses do contribute to improve and implement the clinical workflow by sharing their knowledge and providing ideas. A project specialist stated: “We worked together with doctors, and we gained a lot of ideas and support from the Head of department of emergency medicine. Because he is very IT-savvy, we didn’t have any difficulty in discussion… straight away we looked at the same thing” In addition, doctors and nurses displayed their willingness and ability to adapt to the new healthcare informatics and workflow. A senior doctor asserted: “These are new toys, toys to the boys and girls. We enjoy it and we want more” Discovering Potential Constraints To redesign and implement its healthcare informatics is not an easy task for the AH as it is well aware that it is bound by limited resources. Being small and yet aiming to move faster, the only possible way is to engage external experts to work together with the operations team. In addition, being the smallest hospital in terms of size, another challenge for the operations team is to maximize the available floor space and yet ensure that the floor design is still “synchronized” with the natural flow of patients. AH also faces a monetary constraint risk. Its challenge to not overspend on projects is meant only to improve the ex ... Purchase answer to see full attachment