Ask most care providers what their risk register is for and the answer will be some version of the same thing – staying compliant, preparing for inspection and avoiding regulatory action. Yes, those are all valid reasons to have one. However, if that is all your risk register is doing, you are leaving significant value on the table.
Good risk management is not a defensive exercise. When it is done properly, it is one of the most powerful tools a care business has for sustainable growth and defensibility. The providers who understand this are not just better protected, they are better positioned to win contracts, scale their services, attract and retain staff and build organisations that can withstand threats that impact less-prepared providers.
Opportunity risk: The category many providers ignore
Operational risk gets most of the attention – safe recruitment, staff training, policies, medication management, care delivery, safeguarding, environmental checks etc. These are of course critical areas and they absolutely belong in your register but they all ought to be mitigated effectively by ‘business as usual’ controls.
Do not neglect the other category that rarely gets the same rigour – ‘opportunity risk’. What could your organisation achieve if it were better prepared? What business are you losing right now because of gaps you have not yet identified and what future opportunities are likely to pass you by unless you evolve or innovate your operating model and team?
If you are not utilising technology as part of your business operating model, do you at least have a ‘technology strategy’, whereby you are evaluating how it could be part of your future model of care? If I was a homecare provider today, I would have a strategy, then a plan, and would be engaging with both commissioners and private individuals about how I could
deliver assurances.
In addition, I would develop an operational model that means people receive care and visits (or contact remotely) when they need and want it, rather than solely what is on a scheduled roster. Enabling family relationships to be protected by having remote technology deployed means people retain their independence in their own home. It also means that when a carer visits, they have actionable insights to ask the right questions and offer support in the optimal way.
Consider how many providers miss a tender because their evidence is not in order or because they submitted a poor response under time pressure. Consider the enquiries that are not converted, the clients or residents who choose a competitor and the revenue that disappears without anyone fully understanding why.
Consider the care worker with specialist skills you cannot recruit because your attraction and onboarding processes are not fit for purpose, or the team member who could grow within your business, but you have no defined career pathway for them to see a five-year trajectory. Each of these is a risk and each one has a measurable impact on your business. Your risk register should capture all of this. If it does not, you are managing only part of the picture.
Growing without breaking: The key person problem
One of the most common patterns I see in care organisations is a business that has grown quickly but has not grown its infrastructure at the same pace. You move from one service to two to three, and suddenly you are spread thinly. The processes that worked when everything ran through one person no longer hold up.
Ask yourself an honest question – if you disappeared from the business for two weeks, what would happen? If the answer involves significant disruption, missed deadlines or decisions that cannot be made without you, that is a risk worth documenting and addressing now, before it becomes a crisis.
The same logic applies to finance. If one person manages all your billing and you double in size over the next 18 months, you either need more resources or a more efficient process. Planning for that growth means identifying it as a risk today and putting controls in place before the pressure arrives. It also means having the ‘opportunity mindset’ to look at the optimal or most cost-effective solution, rather than doubling the cost of what you are doing today.
As a care organisation, you need to document the key person dependency as a named risk in your register. Assign it an owner who is not the key person themselves, set a realistic timeline for the control (a deputy trained and operational within six months, for example) and build in a quarterly review. This turns a vague organisational vulnerability into a managed, evidenced risk with a clear accountability trail. That is exactly what a regulator or commissioner wants to see when they ask how you manage business continuity.
The limits of paper-based processes
Many providers manage their risk registers in spreadsheets or on paper and, for a single service with a small team, this can work well enough. The discipline of identifying risks, scoring them, mapping controls and reviewing regularly is what matters, not the format.
But as organisations grow, paper-based processes create real problems. Tracking the progress of actions across multiple services, evidencing that controls are effective and current, maintaining oversight when different registered managers own different risks, reviewing the register quarterly with confidence that the picture is accurate – all of this becomes genuinely difficult without a structured approach.
When risk management exists only in a spreadsheet, it tends to become static. It is updated before a quarterly meeting and then left alone and led by trends and actions, rather than more dynamically. Controls that were accurate three or six months ago are presented as current assurances but may be outdated. Actions that were never completed sit on the register without anyone being held to account. This is not risk management; it is risk documentation and the distinction matters enormously when you are striving for growth but struggling to stand still, or when a regulator looks at your evidence.
Digital tools designed specifically for care governance allow providers to track risks, controls and actions in one place, map them against regulatory frameworks and evidence progress in real time. The value is not the technology itself; it is the discipline and visibility it creates. Once these risks are recorded, evaluated and relevant actions mapped, the critical next activity is to prioritise your opportunity risks.
What your insurer and your commissioners want to see
There is a further commercial argument for investing in risk management that is rarely discussed – it can directly affect your costs and your competitiveness. Insurers respond well to providers who can demonstrate a structured, evidenced risk management framework. A well-maintained register that is reviewed regularly and backed by clear action trails, is tangible evidence that you are managing your business responsibly. That reduces your risk profile and, in my experience as a care provider, it can reduce your premiums too.
Commissioners are increasingly sophisticated in how they evaluate tender responses. They want evidence of quality, consistency and governance. A provider who can point to a structured approach to risk management, with documented controls and clear accountability, stands out against those who offer only general assurances.
In practice, this means being able to show a register that names specific risks, identifies the person accountable for each control and records what action has been taken and when. General statements about your commitment to quality carry little weight against a provider who can open their governance system during a contract review and show a live, up-to-date picture of how risks are being managed across every service.
The right mindset: Glass half empty
Honest risk management requires a particular mindset. You need to approach your register as if you are looking for problems, not confirming that everything is fine. Score your risks realistically. If a control is not fully established, do not claim assurance you do not have. If an action is incomplete, do not treat it as a mitigation.
The providers who get the most value from their risk registers are the ones who use them as a genuine growth tool, reviewing them regularly, challenging their own assumptions and asking uncomfortable questions about where the gaps are. That discipline does not just protect you from regulatory risk but it builds the kind of organisation that wins tenders, retains and attracts staff, scales without breaking and delivers consistently good care year after year. Risk management, done properly, is not an add-on. It is how well-run, high-quality care businesses grow and thrive.
How do you approach risk management in your organisation? Comment on this feature or join the conversation to share your thoughts.
Martin Lowthian is a Risk, Quality and Regulatory Specialist at Access Health, Support and Care. Email: [email protected] Linkedin: @Martin-Lowthian
Related Content
Shifting the dial further: What has happened to the Assisted Dying Bill?
Keep your care business safe: An investigative guide into scams