ISO 15189:2022 · Section 5 · Structural and governance requirements
Clause 5.6: Risk management (organisational)
Check the exact requirement in your licensed copy of the standard.
Last reviewed
What this clause is about
Organisational risk management asks how the laboratory's choices, dependencies and working arrangements could affect patient care. It connects leadership decisions with practical prevention across the service. Relevant issues include staffing gaps, loss of critical supplies, unavailable information systems, referral dependence, changing demand and failures at interfaces between departments.
Begin with a clear description of the activity and the possible harm, not just a label such as equipment risk. Explain the pathway from an event to its consequences for patients or service users. Consider existing safeguards, their limitations and whether additional action is needed. A scoring method can help prioritise work, but the score should not replace professional judgement about serious consequences or uncertain information.
Assign responsibility for action and specify what will demonstrate that a control works. Introducing a backup analyser, for example, only reduces interruption risk if staff can operate it, supplies are available and results can be reported appropriately. Review dependencies that may defeat several safeguards at once, such as shared power, network access or specialist personnel.
Keep risk assessment connected to change control, incidents, complaints, continuity planning and management review. Reassess after significant changes or new information, not solely at a fixed annual meeting. Record unresolved concerns and decisions to accept remaining risk with appropriate authority. The purpose is proportionate protection and better decisions, rather than eliminating every uncertainty. Leaders should be able to explain which patient related risks matter most, what is being done and how they know the selected actions remain effective.
What assessors typically ask to see
- How does each significant organisational risk describe a credible route to harm or disruption for patients?
- How are new services, staffing changes and external dependencies assessed before implementation decisions?
- Who owns each risk action, and what evidence will demonstrate that the control is effective?
- How are incidents and complaints used to challenge assumptions in existing risk assessments?
- How are unresolved high consequence risks escalated and remaining risk accepted by an appropriate decision maker?
Documents and records that usually provide evidence
- Organisational risk management SOP and assessment method
- Service risk register with owners and review dates
- Change related patient risk assessment forms
- Risk treatment action plans and effectiveness records
- Business continuity dependency review records
- Management risk review minutes and escalation records
Ready-made forms mapped to clause 5.6: Failure Mode & Effect Analysis (fmea) Worksheet, Risk & Opportunities Register.
Common findings to avoid
- The register contains broad labels and numerical scores but does not explain patient consequences or safeguards.
- Risk actions are marked complete after a document is issued without checking whether practice changed.
- Continuity arrangements depend on the same power supply, network or staff as the primary service.
- Significant changes are implemented before risk review, leaving no opportunity to prevent foreseeable disruption.
How LabToolkit Pro maps documents to this clause
Each SOP, form and record in LabToolkit Pro can carry clause tags. When a document tagged 5.6 becomes effective, it counts as direct evidence on the readiness dashboard for ISO 15189:2022; links from other standards through the crosswalk are shown separately as indicative coverage. Gaps appear clause by clause, so you can see which parts of 5.6 still need a controlled document or a current record. Readiness is a planning aid — only an accreditation body confirms conformity.
Frequently asked questions
Is a particular scoring system compulsory?
A single scoring system is not the purpose of this clause. Use an approach that suits the service and supports consistent decisions. Explain the criteria and their limitations, especially where information is uncertain. A serious plausible consequence may require action even when a numerical score appears modest.
How is this different from operational risk review?
Organisational review considers service wide choices and dependencies, while operational reviews may focus on particular steps or examinations. They should exchange information rather than become separate registers with conflicting priorities. An operational problem affecting several sections may need leadership action on staffing, purchasing or infrastructure.
When can a risk action be closed?
Close the action when implementation and the planned effectiveness check are documented. The underlying risk may still need ongoing monitoring, because controls can weaken or circumstances can change. Record remaining concerns, the responsible reviewer and triggers that would reopen assessment or require a different protective measure.
Check the exact requirement in your licensed copy of the standard.
Put it into practice
Draft, approve and e-sign your SOPs with version control, or get the complete template pack.