Risk management
The fourth term group covers risk management. The draft's definitions are not public.
What the public record carries
Not stated in the public record beyond the group title. The public contents place risk management as the fourth term group and, in Clause 5, as a foundational element in its own right. The draft's definitions and any change to them are not public.
Basis. The public preview carries the group title and the introduction; the definitions are not public.
Why it matters in a health estate
Risk vocabulary is where safety and security teams most often talk past each other. One means harm to a patient, the other means loss of confidentiality, integrity or availability, and both call it risk. A shared term group does not settle the difference, but it gives the organisation a place to state it. The register should record which risk sense a row uses, because a mitigation that reduces patient harm and one that reduces breach exposure are not interchangeable.
What to do now
Add a risk-sense column to the register: patient harm, system harm, organisational harm or a combination. Record the likelihood and consequence basis for each row. Where a row carries more than one sense, split it rather than averaging the two.
The evidence a reviewer will ask for
| Evidence | What it is |
|---|---|
| Risk-sense column | Each row marked patient harm, system harm, organisational harm or a combination |
| Method note | The likelihood and consequence scales used, and why they suit health software |
| Risk owner | A named owner for each risk, with the authority to accept it |
| Review cadence | When each risk is re-read and by whom |
What a reviewer will ask
A reviewer will ask which harm a risk row is about and who accepted it. A row that mixes two harms has no single owner.
Common gaps
- Safety and security risks are merged into one row and averaged
- The likelihood scale is borrowed from a financial audit and does not fit clinical harm
- A risk is accepted by a committee that cannot bind the organisation
- A risk register is reviewed once a year while the system changes monthly
Before the draft publishes
Split the merged rows and name an owner for each. Count the rows that cannot be split because the harm is unclear.
If the draft changes this row
The draft is edition 2 and 62 pages, one page more than the first edition. Its text and any change summary are not public as at 21 October 2026. This row follows the published first edition's structure, which is what your procedure should name today. The change watch emails you when the record changes or the draft text lands, and the row is re-read then. No one can tell you what moved before that, and this page does not guess.
Related rows
Who this binds. The risk owner, the clinical safety officer and the security lead, because this group fixes the vocabulary of risk that every later clause uses.