1.5 Corrective Action Plans and Improvement Follow-Up

Corrective Action Plans and Improvement Follow-Up

Domain 1 task H asks the risk manager to participate in the development of corrective action plans and supervise follow-up of recommended improvements arising from risk assessments, audits, and investigations of reported incidents. Two words carry the exam weight. Participate — the risk manager facilitates, drafts, challenges, and tracks; the operational owner implements and clinical leaders approve clinical change. Supervise follow-up — the risk manager's accountability does not end when the plan is written or even when the change is made. It ends when the improvement is demonstrably working and is being sustained.

A corrective action plan (CAP) is the written, owned, dated, and measured set of system changes an organization commits to after it identifies a vulnerability. The causes come from somewhere else — a root cause analysis, a failure mode and effects analysis, an environment-of-care round, an internal audit, a regulatory survey, or a cluster of event reports. Those analytic methods are covered elsewhere in this guide. This section begins the moment the contributing factors are on the table and the only remaining questions are: what will we change, who owns it, and how will we know it worked?

Where Corrective Action Plans Come From

Wrong answers in this task area tend to sound decisive: suspend the practitioner's privileges, the risk manager rewrites the clinical protocol, issue a memorandum instructing staff to be more careful. The risk manager does not practice clinically, does not discipline unilaterally, and does not own the operational fix. The risk manager convenes the right owners, insists the action is strong enough to work, secures the measure, documents the commitment, and escalates when it stalls.

The Hierarchy of Intervention Effectiveness

This is the most heavily tested concept in the CAP task area. The organizing principle is simple: an action is strong in inverse proportion to how much it depends on a human being remembering to do the right thing under pressure.

The three-tier stronger/intermediate/weaker grouping used inside the RCA2 method is covered with root cause analysis mechanics. For designing an action you work at a finer grain, using the six-level hierarchy of effectiveness popularized by the Institute for Safe Medication Practices (ISMP) and applied throughout medication, device, and process safety.

Design Rules the Exam Expects

• Every significant contributing factor should receive at least one action at levels 1 through 3. A plan built entirely from levels 4 through 6 is a plan that will fail its own effectiveness re-measurement.
• Education is necessary but never sufficient. It is a supporting action for a stronger change, or a temporary bridge while the stronger control is procured. If the only action after a serious event is "re-educate the staff," expect the event to recur — and expect that plan to look indefensible in hindsight.
• When the strongest control is not achievable now, say so in writing and stage it. Document a two-stage plan: an interim intermediate control with its own date, plus the stronger control with a funding path and a later date. Silently settling for the weak action is the failure mode.
• Check whether the action adds risk. One more alert in an alert-saturated record, or a double check that consumes staffing the unit does not have, can degrade safety while appearing responsive.
• Discipline is not a corrective action for a system failure. It changes nothing about the conditions facing the next clinician and it suppresses the reporting the program depends on.

Writing an Action That Can Be Defended

Each action line in a CAP needs six elements. Risk managers use SMART — Specific, Measurable, Achievable, Relevant, Time-bound — as the shorthand test, but the operational checklist is more concrete:

1. A specific system change, stated as something observable. "Install enteral-specific connectors on all feeding sets on 4West and 5West" — not "improve enteral feeding safety."
2. One named accountable owner, a person by name and title. "Nursing," "the committee," "IT," or "all staff" is not an owner. A diffuse owner is an unowned action.
3. A calendar due date. Never "ongoing" and never "TBD." Ongoing is how actions quietly die.
4. A measure of success with its data source and numeric target, defined before implementation. "One hundred percent of enteral administrations use compliant connectors, verified by 30 randomized bedside observations per month."
5. A reporting venue — which committee will see the result, and how often.
6. A resource and approval path — capital request, medical staff committee approval, information technology work order, policy committee. An action with no funding or approval route will stall no matter how good it is.

Baseline data matter as much as the target. Without a pre-implementation baseline you cannot demonstrate improvement to a board, a surveyor, or a jury.

Completion Is Not Effectiveness

This distinction is the single most tested idea in the follow-up half of the task statement.

• Action completion means the change was made by the due date. It is binary and easy to document. "Connectors installed May 1."
• Action effectiveness means the change produced the intended result and is still producing it months later. It requires re-measurement against the pre-defined metric at defined intervals — commonly at 30, 60, and 90 days, then quarterly through an agreed sustainment period.

Operating rules:

• Define the effectiveness measure, the success threshold, and the re-open threshold before the action goes live. Retrofitting a measure to a completed action is how plans get closed on nothing.
• A CAP is not closed at implementation. It closes when sustained effectiveness is documented at the agreed threshold, and committee minutes should carry both the implementation date and the closure date.
• Audit for drift. Workarounds reappear when staffing tightens, at system go-lives, and after leadership turnover. Spot observation, EHR override reports, and chart audit are what catch it.
• If re-measurement shows no movement, return to the analysis and choose a stronger action. Repeating the education is not a remedy for education having failed.

Tracking to Closure, Governance, and Escalation

Maintain a single action register covering every source — event reviews, proactive assessments, audits, survey findings, insurer recommendations, claim lessons — rather than a separate spreadsheet per department. Fields: source, action, hierarchy level, owner, due date, status, measure, baseline, effectiveness date, closure date.

Useful status categories are: not started, in progress, implemented pending effectiveness, effective and closed, overdue, and re-opened for ineffectiveness. The "implemented pending effectiveness" status is what prevents premature closure.

• The patient safety or quality committee reviews the register as a standing agenda item and is the body that formally accepts closure. Individual owners should not close their own high-risk actions.
• Board-level visibility of overdue high-risk actions is the escalation lever that actually works. The board quality or patient safety committee should see, at minimum, the count and age of overdue actions arising from serious event reviews, any action past due by more than one reporting cycle, and any action re-opened because it proved ineffective. Governing bodies hold oversight responsibility for quality and safety; concealing an overdue high-severity action from the board is itself a risk management failure.
• The escalation ladder when a plan stalls: owner reminder, then department or service-line leader, then the responsible executive, then the patient safety or quality committee with a documented reason and a revised date, then the board committee. Escalating is the exam-correct behavior. A risk manager who quietly extends due dates forever — or who takes over the operational work personally — has simultaneously exceeded and abandoned the role.

Documentation and Discoverability (Brief)

CAP documents describe known vulnerabilities in plain language, which makes them sensitive. Write them factually and prospectively: what will change, who owns it, by when, and how it will be measured. Avoid conclusory statements about fault, speculation about causation, and naming individual practitioners. Where the work is performed inside a patient safety evaluation system or a peer review or quality committee, protections may attach, but they depend on how the work is structured and on state law, and they are addressed in depth in the claims and litigation material. Consult counsel about placement and labeling rather than assuming protection — and never let an anticipated privilege argument become an excuse for writing a vague, unmeasurable action.

Scenario: Nine months after a review of an unrecognized deteriorating patient, the risk manager audits the action register. Three of four actions are marked complete: the escalation policy was revised, staff were educated, and escalation criteria were added to the nursing flowsheet. The fourth — configuring an automated early-warning score alert routed to the rapid response team — is 140 days past due, owned by "IT," and has been extended three times. Two additional failure-to-rescue events have occurred in the interim. The defensible response is to recognize that the three completed items sit at levels 3 through 6 and none removed the failure; to reject "IT" as an owner and obtain a named individual with an executive sponsor and a funded date; to present the effectiveness data showing the plan has not worked; and to escalate the overdue high-risk action to the patient safety committee and the board quality committee. What the risk manager does not do is close the plan because three of four items are done, reprimand the nurses involved, or attempt to configure the alert personally.

Exam Traps

• "Re-educate the staff" or "revise the policy" as the primary action when a forcing function, automation, or standardization option is on the table. These are the weakest tiers and are the classic wrong answers.
• Marking a plan closed on the implementation date. Completion is not effectiveness.
• No baseline data, or a measure invented after the fact.
• An owner that is a department, a committee, a vendor, or "all staff."
• "Ongoing" as a due date.
• Disciplining an individual as the corrective action for a system failure.
• The risk manager performing the operational fix or ordering a clinical department to change practice. The role is to facilitate, measure, document, and escalate.
• Omitting overdue high-risk actions from board reporting to avoid an uncomfortable conversation.
• Speculative fault language in the plan, or assuming privilege attaches automatically wherever the plan is filed.