Key Risks and Mitigation Strategies in Enterprise Risk Management for Private Hospitals: A Mixed-Method Study

Jul 9, 2026

Upload by Logic

Enterprise risk management (ERM) is essential for strengthening sustainability and operational resilience in Thailand’s private hospitals. The study systematically identifies and prioritizes enterprise risks and develops mitigation strategies using a 4-phase mixed-methods design: a 36-item risk inventory, a Likert-scale survey of senior risk/quality professionals, expert interviews, and a bibliometric review of Scopus-indexed literature. Results prioritize five top risks—patient safety, sentinel events, staffing shortages, cybersecurity threats, and litigation exposure—and propose governance, workforce, cybersecurity, legal, and total quality management actions to improve healthcare resilience.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages13

Reading Time33 min

Abstract

Introduction

ERM frameworks and healthcare risk models

Context of Thailand’s private healthcare sector

Original Research Key Risks and Mitigation Strategies in Enterprise Risk Management for Private Hospitals: A Mixed-Method Study INQUIRY: The Journal of Health Care Organization, Provision, and Financing Volume 62: 1–13 © The Author(s) 2025 Article reuse guidelines: [sagepub.com/journals-permissions](sagepub.com/journals-permissions)[ ](sagepub.com/journals-permissions)[DOI: 10.1177/00469580251347132](DOI: 10.1177/00469580251347132)[ ](DOI: 10.1177/00469580251347132)[journals.sagepub.com/home/inq](journals.sagepub.com/home/inq) Anuchit Sermhattakit, M. Pharm, MBA 1 and Patipan Sae-Lim, PhD 1 Abstract Enterprise risk management (ERM) is essential for enhancing sustainability and operational resilience in Thailand’s private hospitals. This study aims to systematically identify and prioritize key enterprise risks, proposing mitigation strategies to enhance the resilience of the healthcare sector. A 4-phase mixed-methods approach was employed: (1) A 36-item risk inventory was developed based on global ERM frameworks and annual reports from 22 publicly listed Thai hospital companies. (2) A quantitative survey using a 5-point Likert scale was conducted with 48 senior risk and quality management professionals from HA-or A-HA-accredited private hospitals. Content validity was assessed using the Index of Item-Objective Congruence (IOC). (3) In-depth interviews were conducted with 5 ERM healthcare experts to analyze root causes and propose mitigation strategies. (4) A bibliometric analysis of 958 Scopus-indexed articles was conducted to validate global relevance, identify research gaps, and refine the study’s conceptual framework. The transition from the 36 initial risks to the 5 highest-ranked risks—clinical and patient safety, sentinel events, medical personnel shortages, cybersecurity threats, and litigation exposure—was based on quantitative ratings. Key contributing factors included ineffective clinical systems, communication breakdowns, staff turnover, low compensation, and limited cybersecurity literacy. Recommended strategies included proactive risk assessment, workforce planning, fostering a safety culture, ISO/IEC 27001 compliance, and improved provider-patient communication. The bibliometric analysis revealed a growing research focus on ERM in hospitals, with key themes encompassing patient safety, emergency response, organizational resilience, and cybersecurity—aligning with the findings of this study. This study proposes a structured ERM framework that identifies 5 key risks: patient safety, sentinel events, staff shortages, cybersecurity threats, and litigation. Recommendations include enhancing clinical governance, workforce policies, cybersecurity, legal risk management, and total quality management to improve healthcare resilience and sustainability. Keywords risk management, risk assessment, safety management, patient safety, delivery of health care This mixed-method study explores enterprise risk management in private hospitals. Five key risks were identified: patient safety incidents, sentinel events, workforce shortages, cybersecurity threats, and litigation. Root causes were examined through qualitative interviews, and strategic mitigation approaches were proposed. The findings aim to strengthen structured risk management frameworks in the private healthcare sector. Introduction ERM has become critical in managing risk in complex and high-risk industries such as healthcare. By systematically identifying and mitigating risks, ERM enhances the organization’s performance by directing resources toward uncertainties, linking strategic goals to the organization’s mission, and identifying critical functions through assessment and planning.1 A basic block of the ERM is the COSO ERM framework, which aligns risk management with strategic and operational processes. It comprises 8 components: internal environment, objective setting, event identification, risk assessment, risk response, control activi

FAQs

What is the main objective of the study on ERM in private hospitals?

The study aims to systematically identify and prioritize key enterprise risks in Thailand’s private hospitals and propose mitigation strategies to enhance sector resilience.

How were key risks identified and prioritized in the research?

A 4-phase mixed-methods approach was used, including a 36-item risk inventory, a quantitative Likert-scale survey, in-depth expert interviews, and bibliometric analysis. The top five risks were selected based on quantitative ratings.

What five risks were ranked as the highest priorities, and what strategies are recommended?

The highest-ranked risks are patient safety/sentinel events, medical personnel shortages, cybersecurity threats, and litigation exposure. Recommended actions include proactive risk assessment, workforce planning, safety culture, ISO/IEC 27001 cybersecurity compliance, and improved provider–patient communication.

Jul 9, 2026

Upload by Logic