We already keep a risk register in a spreadsheet. Do we start over?

No. Your existing register is the starting point. The first weeks are spent confirming scores, named owners and review dates with the people responsible, so the register becomes current rather than rebuilt.

How is this different from a GRC tool?

Most ERM tools are general-purpose GRC systems that don't understand healthcare risk or the connection between operational safety events and enterprise risk. ImprovementFlow connects the register, mitigation initiatives, safety events, audits and improvement projects in one operational system.

What happens when a KRI crosses its threshold?

The right people are notified at the right time, so the data starts the conversation instead of waiting for someone to notice it in a dashboard. The sponsor then decides the response.

What will the board report show?

Residual risk over time for the risks above appetite, the health of the mitigation portfolio and KRI threshold breaches — generated on demand from live data.

Are we too small for a structured ERM program?

Possibly. Our primer is candid that a single-site organization with fewer than roughly 75–100 staff may get more from a simple register with quarterly leadership review. We'll tell you if that's the better fit.

HIPAA compliance, a BAA and SSO are included in every package.

ImprovementFlow · Risk & Compliance

Show your board the risks are actually coming down

Keep a living risk register with scores, named owners and review dates. Put your biggest risks into mitigation initiatives with a sponsor, a target and a Key Risk Indicator that raises the alarm when a threshold is crossed — all connected to the safety events and audit findings that tell you a risk is turning real.

Request a Demo See how a risk gets managed

A risk manager points to a high-risk square on a color-coded likelihood-and-impact grid on a conference room screen, next to a list of mitigation owners with check marks, while a nurse leader and two executives look on

Sound familiar?

What we hear from risk leaders using standard approaches

Common frustrations with the usual tools and workarounds — the gaps ImprovementFlow is built to close.

Our risk register gets dusted off once a year for the board.

Scores carry forward unchanged, owners are whole departments, and the minutes say "no significant changes" again.

The board asks if we're safer than last year. All I can show them is the same heat map.

Reports describe activity — assessments done, initiatives "on track" — instead of whether exposure went down.

When it finally happened, everyone said, "We knew about that risk."

It was on the list. Nobody had a measure that would have warned them it was getting worse.

How it works

From a name on the register to a risk that's measurably lower

The same steps the ERM frameworks describe, run as an ongoing program instead of an annual spreadsheet refresh.

1
Keep the register alive
Every risk carries an inherent score, a residual score, a named owner, a review date and its mitigation history. The highest-scored risks come up for review more often.
2
Agree how much risk you'll carry
Your risk appetite sits alongside the register, so risks above it surface as candidates for active mitigation instead of getting lost in the list.
3
Launch a mitigation initiative
Each Risk Mitigation Initiative gets a sponsor who owns the outcome, a lead who runs the work, a residual-risk target and at least one KRI with a defined threshold.
4
Let the data raise the flag
When a KRI crosses its threshold, the right people are notified. When a safety event or audit finding points to a risk materializing, the link shows up in the register.
5
Report the trend, not the activity
Residual risk over time, initiative health and threshold breaches come straight from live data for the Risk Committee and the board — not assembled by hand the week before.

1
Keep the register alive
Every risk carries an inherent score, a residual score, a named owner, a review date and its mitigation history. The highest-scored risks come up for review more often.
2
Agree how much risk you'll carry
Your risk appetite sits alongside the register, so risks above it surface as candidates for active mitigation instead of getting lost in the list.
3
Launch a mitigation initiative
Each Risk Mitigation Initiative gets a sponsor who owns the outcome, a lead who runs the work, a residual-risk target and at least one KRI with a defined threshold.
4
Let the data raise the flag
When a KRI crosses its threshold, the right people are notified. When a safety event or audit finding points to a risk materializing, the link shows up in the register.
5
Report the trend, not the activity
Residual risk over time, initiative health and threshold breaches come straight from live data for the Risk Committee and the board — not assembled by hand the week before.

In practice

Where your top risks sit — and who is bringing them down

The heat map summarizes the register. The list beside it is what the Risk Committee actually holds people to: an action, a measure and a name.

Likelihood →

Impact →

R1 Assaults on staff in the emergency department
R2 Ransomware outage of clinical systems
R3 Heavy reliance on agency nurses
R4 Abnormal test results not followed up
R5 Extended power loss during severe weather
R6 Lapsed provider credentialing

Active mitigation initiatives

R1 · ED workplace violence
De-escalation training and entry screening. KRI: reported assaults per month, with an escalation threshold.
Owner: VP Nursing (sponsor), ED Director (lead)
R2 · Clinical system outage
Tested downtime procedures for every critical system. KRI: share of critical systems with a current recovery test.
Owner: Chief Information Officer
R4 · Missed result follow-up
Closed-loop result notification. KRI: critical results acknowledged within the agreed window.
Owner: Chief Medical Officer

Illustrative risks, scores, owners and KRIs, not a product screenshot. Your organization sets its own register, scoring and appetite.

Who it's for

Something useful for everyone involved

Chief Risk Officer / VP Risk: One current view of the register, the mitigation portfolio and every threshold breach, ready for the board.
Risk Committee: Meetings that approve mitigation plans and hold sponsors to a residual-risk target, instead of hearing status updates.
Mitigation sponsors: A clear target they own and KRI data that shows whether their initiative is working.
Mitigation leads: A defined plan, a KRI to report against and a notification the moment a threshold is crossed.
Board members: Residual risk trend lines for the risks above appetite — where each started, where it is now and whether it's on track.

What changes

From working around the problem to working on it

Today

A spreadsheet register refreshed once a year
Risks owned by "the department"
Mitigation described as "on track"
Safety events and audits never reach the register

With ImprovementFlow

A living register with scores, owners and review dates
A named sponsor and lead for every active initiative
KRIs with thresholds that trigger escalation
Events and audit findings linked to the risks they signal

Built for healthcare risk, not generic GRC

Connected to operations: Enterprise risks link to the safety events, audit findings and improvement projects already running in ImprovementFlow, so the register reflects what's happening on the floor.
Clear lines of accountability: Role separation follows the Three Lines Model — operational management, risk and compliance, and audit — so accountability is built in rather than informal.
Secure from day one: HIPAA compliance, a BAA and SSO are included in every package.

Getting started

Your first 90 days

Start from the register you already have. The first quarter is about making it current and putting one or two risks into active mitigation.

Days 1–30
Review the risks you already track with their executive owners. Confirm categories, retire duplicates and add what's missing.
Days 30–60
Score inherent risk consistently, name an owner for every entry and agree the appetite threshold with leadership.
Days 60–90
Run the first Risk Committee cycles on the live register and launch an initiative, with KRIs, for a top risk above appetite.

Guides

Guides from our ERM primer

Practical, vendor-neutral guides for building a risk program that changes decisions.

Frequently asked questions

We already keep a risk register in a spreadsheet. Do we start over?: No. Your existing register is the starting point. The first weeks are spent confirming scores, named owners and review dates with the people responsible, so the register becomes current rather than rebuilt.
How is this different from a GRC tool?: Most ERM tools are general-purpose GRC systems that don't understand healthcare risk or the connection between operational safety events and enterprise risk. ImprovementFlow connects the register, mitigation initiatives, safety events, audits and improvement projects in one operational system.
What happens when a KRI crosses its threshold?: The right people are notified at the right time, so the data starts the conversation instead of waiting for someone to notice it in a dashboard. The sponsor then decides the response.
What will the board report show?: Residual risk over time for the risks above appetite, the health of the mitigation portfolio and KRI threshold breaches — generated on demand from live data.
Are we too small for a structured ERM program?: Possibly. Our primer is candid that a single-site organization with fewer than roughly 75–100 staff may get more from a simple register with quarterly leadership review. We'll tell you if that's the better fit.
What about security?: HIPAA compliance, a BAA and SSO are included in every package.