ASHRM Certified Professional in Healthcare Risk Management (CPHRM) Exam — Questions and Answers

Question 1: What is the most important professional competency for CPHRM certification in risk analysis?

Deep knowledge combined with practical application skills (Correct answer)
Memorization of all reference materials
Speed of task completion
Ability to work alone exclusively

Correct answer: Deep knowledge combined with practical application skills

Professional competency requires both deep knowledge of the subject matter and the ability to apply that knowledge in practical situations.

Question 2: Which discovery tool requires a party to answer written questions under oath before trial?

Request for admissions
Request for production
Interrogatories (Correct answer)
Deposition

Correct answer: Interrogatories

Interrogatories are written questions submitted to an opposing party who must provide sworn written answers within a specified time frame.

Question 3: What is the key benefit of evidence-based decision making in CPHRM management?

It eliminates all risk
It reduces reliance on data
It improves accuracy and reduces bias in decisions (Correct answer)
It speeds up all processes

Correct answer: It improves accuracy and reduces bias in decisions

Evidence-based decision making uses data and research to improve the accuracy of decisions and reduce the influence of personal bias.

Question 4: A hospital's compliance program must include which element identified in the OIG's seven elements of an effective compliance program?

Mandatory external audits by an independent CPA firm
A dedicated compliance department with at least 10 staff members
Ongoing monitoring and auditing of compliance risks (Correct answer)
Board-level approval of all compliance policies

Correct answer: Ongoing monitoring and auditing of compliance risks

OIG's seven elements include: written standards, compliance officer/committee, training, communication channels, auditing/monitoring, disciplinary guidelines, and response to detected offenses — ongoing auditing and monitoring is one of the seven.

Question 5: A risk manager is reviewing a case where a patient alleges assault and battery by a healthcare provider. Battery in a medical context most commonly occurs when:

A procedure is performed without the patient's consent (Correct answer)
A provider speaks harshly to a patient
A provider fails to diagnose a condition
A patient falls due to inadequate supervision

Correct answer: A procedure is performed without the patient's consent

Medical battery occurs when a provider intentionally makes harmful or offensive contact with a patient without consent, most commonly by performing an unauthorized procedure.

Question 6: A risk retention group (RRG) under the Liability Risk Retention Act of 1986 must be:

Owned and operated by an insurance company
Owned by its policyholder members who share similar liability exposures (Correct answer)
Capitalized exclusively by state government funds
Regulated identically in all fifty states

Correct answer: Owned by its policyholder members who share similar liability exposures

RRGs are member-owned entities in which all policyholders share similar liability risks, and once licensed in one state they may operate in others with limited additional regulation.

Question 7: A risk manager reviewing a commercial general liability (CGL) policy notes an 'occurrence' trigger. How does this differ from a claims-made trigger for a hospital facing a long-tail liability like a medication error?

An occurrence policy requires tail coverage when switching insurers
Occurrence policies have lower limits than claims-made policies
Occurrence policies provide no coverage for long-tail claims
An occurrence policy covers the incident whenever it is reported, as long as it occurred during the policy period (Correct answer)

Correct answer: An occurrence policy covers the incident whenever it is reported, as long as it occurred during the policy period

Under an occurrence trigger, coverage applies based on when the incident happened, not when the claim is filed—so a medication error during the policy year is covered even if the lawsuit comes years later.

Question 8: Under a claims-made insurance policy, coverage applies when:

Both the incident and report occur during the policy period (Correct answer)
The claimant files within the statute of limitations
The incident occurs during the policy period
The claim is reported during the policy period regardless of when the incident occurred

Correct answer: Both the incident and report occur during the policy period

A claims-made policy provides coverage only when both the alleged incident and the claim are reported while the policy is active.

Question 9: Under OSHA's Bloodborne Pathogens Standard, employers must offer hepatitis B vaccination to at-risk employees at:

No cost to the employee within 10 days of hire (Correct answer)
The employee's expense after 90 days of hire
No cost after completing a 6-month probationary period
The employee's expense within 30 days of hire

Correct answer: No cost to the employee within 10 days of hire

OSHA's Bloodborne Pathogens Standard (29 CFR 1910.1030) requires employers to offer hepatitis B vaccination at no cost to employees within 10 working days of initial assignment to tasks with occupational exposure.

Question 10: Which of the following BEST describes the purpose of a 'heat map' in risk analysis?

To display the aggregated risk scores of identified risks on a color-coded matrix (Correct answer)
To map staff workload density across departments
To visualize geographic distribution of patient falls
To track temperature-related environmental hazards

Correct answer: To display the aggregated risk scores of identified risks on a color-coded matrix

A heat map plots risks on a likelihood-vs.-consequence matrix using color coding (green/yellow/red) to allow quick visual prioritization.

Question 11: Which committee is MOST likely to provide risk managers with information about clinical risks related to physician performance?

Medical executive committee (Correct answer)
Compliance committee
Facilities management committee
Finance committee

Correct answer: Medical executive committee

The medical executive committee oversees physician credentialing, peer review, and performance issues that directly relate to clinical risk.

Question 12: Which approach best demonstrates mastery of insurance and finance in CPHRM practice?

Applying principles to novel situations with sound judgment (Correct answer)
Relying entirely on technology
Following procedures without understanding
Avoiding complex scenarios

Correct answer: Applying principles to novel situations with sound judgment

True mastery involves understanding underlying principles well enough to apply them to new and unfamiliar situations with professional judgment.

Question 13: What is the most important professional competency for CPHRM certification in quality improvement?

Memorization of all reference materials
Speed of task completion
Deep knowledge combined with practical application skills (Correct answer)
Ability to work alone exclusively

Correct answer: Deep knowledge combined with practical application skills

Professional competency requires both deep knowledge of the subject matter and the ability to apply that knowledge in practical situations.

Question 14: Which role is typically responsible for day-to-day ERM program coordination in a large US health system?

Chief Executive Officer
Director of Patient Access
Chief of Medical Staff
Chief Risk Officer or VP of Risk Management (Correct answer)

Correct answer: Chief Risk Officer or VP of Risk Management

The Chief Risk Officer or VP of Risk Management typically coordinates the ERM program, reporting key risks to the board and executive leadership.

Question 15: In healthcare risk analysis, 'inherent risk' is BEST defined as:

Risk accepted as part of normal clinical practice
Risk that is embedded in the organization's culture
Risk that cannot be eliminated regardless of controls
The level of risk that exists before any controls are applied (Correct answer)

Correct answer: The level of risk that exists before any controls are applied

Inherent risk is the raw or baseline risk of an activity or process before any mitigation or control measures are considered.

Question 16: Under the Joint Commission standards, which action is FIRST required after a sentinel event is identified?

Notify state licensing board
Conduct a root cause analysis (Correct answer)
Suspend involved staff
File an insurance claim

Correct answer: Conduct a root cause analysis

The Joint Commission requires organizations to perform a root cause analysis to identify contributing system factors after a sentinel event.

Question 17: A hospital's performance improvement committee reviews data showing longer-than-expected surgical procedure times for laparoscopic cholecystectomies. The MOST useful tool to map and analyze the current surgical workflow would be:

Pareto chart ranking surgeons by average procedure time
Flowchart or process map of the surgical workflow steps (Correct answer)
Histogram showing procedure time distribution
Control chart tracking procedure times over 12 months

Correct answer: Flowchart or process map of the surgical workflow steps

A flowchart visually maps each step in the surgical process, making it easier to identify inefficiencies, redundancies, and potential bottlenecks causing delays.

Question 18: A healthcare risk manager reviewing surgical complications notices a surgeon's outlier complication rate. The FIRST step should be to:

Report the surgeon to the state medical board
Terminate the surgeon's contract
Immediately suspend the surgeon's privileges
Conduct a focused professional practice evaluation (FPPE) (Correct answer)

Correct answer: Conduct a focused professional practice evaluation (FPPE)

FPPE is the appropriate initial structured review process to evaluate a practitioner's competency when a concern is identified.

Question 19: A risk manager notices a pattern of falls in one unit after reviewing incident reports. What is the BEST next step?

Conduct a focused process improvement initiative for that unit (Correct answer)
Dismiss the pattern as statistical noise
Transfer patients to other units
Immediately report to the board

Correct answer: Conduct a focused process improvement initiative for that unit

Aggregated incident data indicating a unit-specific pattern should trigger a focused process improvement to address contributing factors.

Question 20: Which approach best demonstrates mastery of loss prevention in CPHRM practice?

Applying principles to novel situations with sound judgment (Correct answer)
Following procedures without understanding
Relying entirely on technology
Avoiding complex scenarios

Correct answer: Applying principles to novel situations with sound judgment

True mastery involves understanding underlying principles well enough to apply them to new and unfamiliar situations with professional judgment.

Question 21: The principle of 'insurable interest' requires that for an insurance contract to be valid:

The insured must suffer a financial loss if the insured event occurs (Correct answer)
The insurer must be domiciled in the same state as the insured
The policy must cover at least three separate risk categories
The insured must be a licensed healthcare provider

Correct answer: The insured must suffer a financial loss if the insured event occurs

Insurable interest means the policyholder must stand to suffer a genuine financial loss from the event insured against, preventing insurance from becoming a wagering instrument.

Question 22: A hospital CFO asks the risk manager why the actuarial loss reserve uses a 'discount rate.' The BEST explanation is:

Future claim payments are worth less in today's dollars, so reserves are adjusted to present value (Correct answer)
The discount rate reduces reserves to match competitor benchmarks
Discounting inflates the reserve to account for inflation
The discount rate is applied only to defense costs, not indemnity payments

Correct answer: Future claim payments are worth less in today's dollars, so reserves are adjusted to present value

Discounting reflects the time value of money—since claims will be paid in the future, the reserve needed today (present value) is less than the nominal sum of future payments.

Question 23: Which type of risk identification relies on structured interviews with department leaders about their areas' vulnerabilities?

Concurrent utilization review
Quantitative risk assessment
Actuarial risk modeling
Qualitative risk assessment (Correct answer)

Correct answer: Qualitative risk assessment

Qualitative risk assessment uses subjective methods like interviews and expert opinions to identify and prioritize risks.

Question 24: Under which legal doctrine can a hospital be held liable for inadequate physician credentialing?

Corporate negligence (Correct answer)
Contributory negligence
Respondeat superior
Assumption of risk

Correct answer: Corporate negligence

Corporate negligence holds the hospital directly liable for failing to meet its duty to credential, supervise, and retain only competent medical staff.

Question 25: When facing an ethical dilemma in CPHRM practice, what is the recommended first step?

Ask colleagues to decide
Identify the relevant ethical principles and stakeholders (Correct answer)
Avoid making any decision
Follow personal preferences

Correct answer: Identify the relevant ethical principles and stakeholders

Identifying the relevant ethical principles and all affected stakeholders provides a framework for systematic ethical analysis.

Question 26: Which risk analysis method is specifically designed to evaluate the causes and effects of individual component failures in a system and rate them by Risk Priority Number (RPN)?

Root Cause Analysis (RCA)
Bow-tie analysis
Hazard and Operability Study (HAZOP)
Failure Mode and Effects Analysis (FMEA) (Correct answer)

Correct answer: Failure Mode and Effects Analysis (FMEA)

FMEA proactively identifies potential failure modes, their effects, and calculates an RPN (Severity × Occurrence × Detection) to prioritize corrective actions.

Question 27: In claims management, 'excess exposure' refers to a situation where:

The claimant has filed in multiple jurisdictions
The statute of limitations has been exceeded
A claim involves multiple defendants
Potential damages exceed available policy limits (Correct answer)

Correct answer: Potential damages exceed available policy limits

Excess exposure occurs when a claim's potential verdict or settlement value surpasses the organization's insurance policy limits, creating personal financial risk.

Question 28: When a risk manager conducts a 'mock trial' or focus group before a case goes to trial, the PRIMARY goal is to:

Assess how jurors might perceive the case and evaluate settlement value (Correct answer)
Identify expert witnesses for the defense
Train new risk management staff on courtroom procedures
Practice witness examination techniques

Correct answer: Assess how jurors might perceive the case and evaluate settlement value

Mock trials and focus groups help predict juror reactions to the evidence and arguments, informing settlement decisions and trial strategy.

Question 29: Which approach best demonstrates mastery of risk analysis in CPHRM practice?

Following procedures without understanding
Relying entirely on technology
Applying principles to novel situations with sound judgment (Correct answer)
Avoiding complex scenarios

Correct answer: Applying principles to novel situations with sound judgment

True mastery involves understanding underlying principles well enough to apply them to new and unfamiliar situations with professional judgment.

Question 30: A patient safety officer proposes adopting a 'just culture' model. This model primarily distinguishes between:

Human error, at-risk behavior, and reckless behavior when determining accountability (Correct answer)
Intentional harm and accidental harm for criminal prosecution
Clinical and administrative staff in incident reporting
Licensed and unlicensed personnel for disciplinary purposes

Correct answer: Human error, at-risk behavior, and reckless behavior when determining accountability

Just culture differentiates three behavioral categories—human error, at-risk behavior, and reckless behavior—to apply appropriate accountability and system responses.

Question 31: In CPHRM practice, what is the primary purpose of strategic planning?

To satisfy external auditors
To align resources with goals and anticipate challenges (Correct answer)
To create paperwork
To reduce workforce

Correct answer: To align resources with goals and anticipate challenges

Strategic planning aligns organizational resources with goals and helps anticipate challenges before they become critical issues.

Question 32: When a risk manager receives a litigation hold notice, the correct response is to:

Continue normal document retention and destruction schedules
Immediately preserve all potentially relevant records and suspend routine destruction (Correct answer)
Shred documents older than the retention policy requires
Forward all records to the hospital's insurer only

Correct answer: Immediately preserve all potentially relevant records and suspend routine destruction

A litigation hold requires immediate preservation of all potentially relevant documents and suspension of any routine destruction that might affect those materials.

Question 33: Under the Americans with Disabilities Act (ADA), a hospital's obligation to provide reasonable accommodations applies to:

Employees only, not patients
Both employees and patients with disabilities (Correct answer)
Visitors to the facility but not employees
Patients only, not employees

Correct answer: Both employees and patients with disabilities

The ADA applies to hospitals as both employers (Title I) and places of public accommodation (Title III), requiring reasonable accommodations for both employees and patients with disabilities.

Question 34: Which accreditation body requires healthcare organizations to conduct a thorough and credible root cause analysis following a sentinel event?

Centers for Medicare and Medicaid Services (CMS)
The Joint Commission (TJC) (Correct answer)
Agency for Healthcare Research and Quality (AHRQ)
National Committee for Quality Assurance (NCQA)

Correct answer: The Joint Commission (TJC)

The Joint Commission requires organizations to perform a root cause analysis and develop an action plan after a sentinel event occurs.

Question 35: A hospital uses 'Plan-Do-Study-Act' cycles iteratively. After the 'Study' phase reveals the change did not improve outcomes, the team should:

Implement the change broadly anyway to achieve economies of scale
Report the failure to hospital administration for disciplinary review
Use the findings to inform a revised plan in the next PDSA cycle (Correct answer)
Abandon quality improvement efforts for this issue

Correct answer: Use the findings to inform a revised plan in the next PDSA cycle

The PDSA model is iterative; failed tests provide learning that informs the next cycle's Plan phase, refining the intervention until improvement is achieved.

Question 36: Which professional attribute is most valued in risk identification within the CPHRM field?

Avoiding challenging situations
Accountability and commitment to standards (Correct answer)
Prioritizing personal convenience
Working in isolation

Correct answer: Accountability and commitment to standards

Accountability and commitment to professional standards build trust and ensure consistent, high-quality practice.

Question 37: Which of the following is the MOST reliable indicator that a hospital's incident reporting system is effectively capturing risks?

Reports focused exclusively on serious adverse events
Reports submitted only by nursing staff
High number of near-miss and no-harm reports (Correct answer)
Low number of reports submitted

Correct answer: High number of near-miss and no-harm reports

A high proportion of near-miss and no-harm reports indicates staff are comfortable reporting minor events, which reflects a strong safety culture and effective capture of early risk signals.

Question 38: The medicine system at a hospital is extensive, and different parts of it are under the jurisdiction of several departments. What is one crucial step that may be taken to lessen system errors?

Simplify it
Have each department use the same self-assessment tools
Make each department responsible for the system as a whole
Give a single person responsibility for overseeing the entire system (Correct answer)

Correct answer: Give a single person responsibility for overseeing the entire system

In complex systems involving multiple departments, a lack of centralized oversight can lead to fragmented processes, communication breakdowns, and increased errors. Appointing a single person with overall responsibility for the entire system ensures a holistic view, promotes coordination across departments, and facilitates consistent policy implementation and error prevention. This centralized accountability helps identify and address systemic vulnerabilities that might otherwise be missed when responsibilities are siloed.

Question 39: In the context of CPHRM, 'risk identification' in the emergency department most commonly involves which unique challenge?

Reviewing outpatient coding accuracy
Managing elective procedure scheduling
Identifying risks in a high-volume, high-acuity, time-pressured environment (Correct answer)
Monitoring chronic disease management protocols

Correct answer: Identifying risks in a high-volume, high-acuity, time-pressured environment

The ED's high volume, acuity, time pressure, and frequent handoffs create a uniquely complex risk environment requiring targeted identification strategies.

Question 40: Which type of hazard analysis is used to evaluate the safety of a new clinical process before it is implemented?

Proactive hazard analysis (e.g., FMEA) (Correct answer)
Retrospective claims review
Root cause analysis
Incident trend analysis

Correct answer: Proactive hazard analysis (e.g., FMEA)

Proactive hazard analysis such as FMEA is applied to new or redesigned processes to identify failure modes before the process goes live.

Question 41: A risk manager reviewing medication error trends notices most errors occur during the transcription step. This represents which type of error source?

Latent failure (Correct answer)
Adverse drug reaction
Active failure
Sentinel event

Correct answer: Latent failure

Latent failures are organizational or system-level weaknesses—such as poor transcription processes—that lie dormant until triggered by human action.

Question 42: A 'never event' in the context of risk management and CMS policy refers to:

A serious, preventable adverse event for which CMS does not provide additional payment (Correct answer)
An adverse event that occurs rarely but unpredictably
An event that must be immediately disclosed to The Joint Commission
A sentinel event requiring mandatory state reporting

Correct answer: A serious, preventable adverse event for which CMS does not provide additional payment

CMS designates certain serious preventable adverse events as 'never events' (Hospital-Acquired Conditions) for which it will not provide additional reimbursement, incentivizing prevention.

Question 43: The primary purpose of a Healthcare Failure Mode and Effects Analysis (HFMEA) is to:

Proactively identify and prevent potential process failures (Correct answer)
Assign blame for past adverse events
Retrospectively analyze sentinel events
Document incidents for insurance purposes

Correct answer: Proactively identify and prevent potential process failures

HFMEA is a prospective tool used to identify and mitigate potential failure points in healthcare processes before harm occurs.

Question 44: A hospital self-insures workers' compensation and purchases aggregate stop-loss at 125% of expected losses. Expected losses for the year are $4 million. At what point does the stop-loss coverage activate?

$4,000,000
$3,200,000
$5,000,000 (Correct answer)
$6,000,000

Correct answer: $5,000,000

The aggregate stop-loss attachment point is 125% of $4 million = $5 million; losses exceeding this total trigger the stop-loss coverage.

Question 45: A risk manager identifies a risk with high severity but very low probability. According to standard risk matrix principles, this risk would MOST likely be categorized as:

Acceptable risk needing no further action
Moderate to high priority requiring monitoring and contingency planning (Correct answer)
Transferred risk suitable for insurance only
Low priority — probability outweighs severity

Correct answer: Moderate to high priority requiring monitoring and contingency planning

High-severity, low-probability risks typically fall into a moderate-to-high zone requiring contingency plans because consequences would be catastrophic if realized.

Question 46: Which ERM risk response strategy involves shifting the financial consequence of a risk to a third party?

Risk avoidance
Risk transfer (Correct answer)
Risk acceptance
Risk reduction

Correct answer: Risk transfer

Risk transfer shifts the financial burden of a risk to another party, most commonly through insurance or contractual agreements.

Question 47: Which of the following is an example of a structure measure in healthcare quality?

Patient mortality rate
Nurse-to-patient staffing ratio (Correct answer)
Average length of hospital stay
Percentage of patients receiving discharge education

Correct answer: Nurse-to-patient staffing ratio

Structure measures assess organizational attributes like staffing ratios, equipment, and facilities rather than processes or outcomes.

Question 48: A risk manager wants to identify safety risks in the sterile processing department. Which tool would be MOST appropriate?

Structured process observation and FMEA (Correct answer)
Patient satisfaction surveys
Analysis of malpractice claims from last year
Staff credentialing file review

Correct answer: Structured process observation and FMEA

Structured process observation combined with FMEA allows systematic prospective identification of contamination or sterilization failure risks.

Question 49: Which federal law prohibits healthcare providers from offering, paying, soliciting, or receiving anything of value to induce or reward referrals of federal healthcare program business?

Anti-Kickback Statute (Correct answer)
False Claims Act
Civil Monetary Penalties Law
Stark Law

Correct answer: Anti-Kickback Statute

The Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)) prohibits knowingly and willfully offering, paying, soliciting, or receiving remuneration to induce or reward referrals of items or services covered by federal healthcare programs.

Question 50: Failure Mode and Effects Analysis (FMEA) is best described as a:

Accreditation requirement for sentinel event reporting
Proactive tool used to identify potential failure points before they occur (Correct answer)
Reactive tool used after an adverse event occurs
Statistical method for analyzing outcome data trends

Correct answer: Proactive tool used to identify potential failure points before they occur

FMEA is a proactive risk assessment technique that identifies potential failure modes and their effects before harm occurs.

Question 51: When a hospital employee is injured on the job, which coverage is triggered first?

Directors and officers insurance
Workers' compensation insurance (Correct answer)
Professional liability insurance
General liability insurance

Correct answer: Workers' compensation insurance

Workers' compensation is a no-fault system that provides mandatory coverage for employee work-related injuries and illnesses.

Question 52: What role does documentation play in CPHRM compliance?

It provides evidence of adherence to standards (Correct answer)
It is optional
It replaces practical competency
It is only needed for audits

Correct answer: It provides evidence of adherence to standards

Documentation provides verifiable evidence that standards and regulations are being followed, serving as proof of compliance.

Question 53: Which risk financing strategy requires the healthcare organization to retain all financial risk for claims below a set dollar threshold?

Captive insurance
Self-insured retention (SIR) (Correct answer)
Occurrence-based insurance
Umbrella coverage

Correct answer: Self-insured retention (SIR)

A self-insured retention (SIR) requires the insured organization to pay all costs — including defense and indemnity — for claims up to the retention amount before insurance responds.

Question 54: Which actuarial method relies on historical loss ratios to project future losses by multiplying expected losses by a development factor?

Frequency-severity method
Monte Carlo simulation
Bornhuetter-Ferguson method (Correct answer)
Paid loss development method

Correct answer: Bornhuetter-Ferguson method

The Bornhuetter-Ferguson method blends a priori expected losses with actual development experience, weighting them to project ultimate losses—commonly used when data is immature.

Question 55: Which financial metric best measures the adequacy of a self-insured healthcare organization's loss reserves relative to its exposure?

Loss development factor (LDF) (Correct answer)
Current ratio
Reserve-to-payroll ratio
Debt-service coverage ratio

Correct answer: Loss development factor (LDF)

The loss development factor (LDF) quantifies how much reported losses are expected to grow to their ultimate value, directly measuring reserve adequacy relative to future payments.

Question 56: Which tool is MOST effective for identifying risks associated with a specific clinical procedure?

Root cause analysis
Failure Mode and Effects Analysis (FMEA) (Correct answer)
Patient satisfaction surveys
Incident reporting system

Correct answer: Failure Mode and Effects Analysis (FMEA)

FMEA proactively identifies potential failure points in a clinical procedure before harm occurs.

Question 57: A hospital notices catheter-associated urinary tract infections (CAUTIs) increasing. The FIRST step in a quality improvement initiative should be:

Implement a new protocol immediately
Benchmark against national CAUTI rates
Collect baseline data to understand current performance (Correct answer)
Discipline nursing staff involved in care

Correct answer: Collect baseline data to understand current performance

Collecting baseline data is the essential first step to understand the scope of the problem before implementing changes.

Question 58: Which element is MOST critical to a valid informed consent process?

Administrative department approval
Patient comprehension of material risks and alternatives (Correct answer)
A witness signature on the form
Physician completion of the consent form

Correct answer: Patient comprehension of material risks and alternatives

Informed consent is valid only when the patient demonstrates understanding of the material risks, benefits, and alternatives to the proposed treatment.

Question 59: In risk analysis, 'residual risk' refers to:

Risk remaining after controls are applied (Correct answer)
Risk deemed too minor to address
Risk identified after a sentinel event
Risk transferred to a third party

Correct answer: Risk remaining after controls are applied

Residual risk is the level of risk that remains after all implemented risk controls have been applied and accepted.

Question 60: During a risk analysis, a team determines that a control measure reduces the likelihood of a hazard but does not eliminate it. This remaining risk is BEST addressed by:

Reclassifying the hazard as a non-risk
Accepting the residual risk without further action if it falls below the risk tolerance threshold (Correct answer)
Removing the control and escalating to senior leadership
Transferring full liability to the treating physician

Correct answer: Accepting the residual risk without further action if it falls below the risk tolerance threshold

When residual risk falls within the organization's defined risk tolerance, it is appropriate to formally accept it and document the decision.

Question 61: Which of the following represents a LATENT risk in a healthcare organization?

A mislabeled medication vial
A patient allergy not communicated to a physician
A nurse administering the wrong dose
Understaffing due to poor scheduling policies (Correct answer)

Correct answer: Understaffing due to poor scheduling policies

Latent risks are systemic or organizational factors (like poor policies) that predispose the system to active errors.

Question 62: In the context of informed consent, 'therapeutic privilege' allows a provider to withhold information when:

The procedure is considered routine
Disclosure would cause serious psychological harm or prevent rational decision-making (Correct answer)
The patient requests less information
Family members request non-disclosure

Correct answer: Disclosure would cause serious psychological harm or prevent rational decision-making

Therapeutic privilege is a narrow exception permitting non-disclosure only when revealing information would seriously harm the patient or impair their ability to make a rational decision.

Question 63: An advance directive executed in one state by a patient who is now hospitalized in a different state is:

Automatically invalid and must be re-executed in the current state
Invalid unless approved by the hospital ethics committee
Generally honored under most states' reciprocity provisions, though state law varies (Correct answer)
Only valid if notarized in the patient's home state

Correct answer: Generally honored under most states' reciprocity provisions, though state law varies

Most states have provisions to honor out-of-state advance directives to the extent they comply with the originating state's law, though risk managers should know their specific state's rules.

Question 64: A healthcare organization benchmarks its claim frequency against national data. This activity is part of which risk management function?

Risk control
Risk transfer
Risk financing
Risk identification and analysis (Correct answer)

Correct answer: Risk identification and analysis

Comparing internal claims data to external benchmarks is a risk identification and analysis activity that reveals relative performance and areas for improvement.

Question 65: A hospital is sued for negligent credentialing of a physician. This claim is based on the doctrine of:

Corporate negligence (Correct answer)
Res ipsa loquitur
Respondeat superior
Comparative fault

Correct answer: Corporate negligence

Corporate negligence holds the hospital directly liable for failing to fulfill its duty to properly credential and supervise medical staff.

Question 66: A hospital implements a new ERM software platform. Which outcome would best indicate the platform is delivering value?

The risk manager spends less time in meetings
Insurance premiums drop immediately after implementation
The number of incident reports decreases significantly
Leadership has real-time visibility into the organization's top risks and mitigation status (Correct answer)

Correct answer: Leadership has real-time visibility into the organization's top risks and mitigation status

An ERM platform delivers value by giving leadership timely, consolidated insight into risk exposures and the status of mitigation efforts across the organization.

Question 67: Which approach best describes risk-based compliance management in the CPHRM field?

Treating all risks equally
Focusing only on past incidents
Eliminating all possible risks
Prioritizing resources based on risk severity and likelihood (Correct answer)

Correct answer: Prioritizing resources based on risk severity and likelihood

Risk-based compliance management involves assessing and prioritizing risks by their severity and likelihood to allocate resources effectively.

Question 68: The 'likelihood' component in a traditional 5×5 risk matrix is BEST defined as:

The estimated probability or frequency of the risk occurring (Correct answer)
The number of patients potentially affected
The financial cost if the risk materializes
The time required to mitigate the risk

Correct answer: The estimated probability or frequency of the risk occurring

Likelihood (or probability) represents how often or how probable it is that a given risk event will occur within a defined timeframe.

Question 69: A risk manager learns that several nurses have independently bypassed a medication safety alert in the EHR. This is BEST classified as:

A sentinel event
An intentional medication error
A technology malfunction
Alert fatigue-related risk (Correct answer)

Correct answer: Alert fatigue-related risk

Alert fatigue occurs when excessive alerts cause clinicians to routinely override them, creating risk that safety warnings will be ignored.

Question 70: Which of the following is an example of a 'key risk indicator' (KRI) in a hospital ERM program?

Monthly staff turnover rate exceeding a defined threshold (Correct answer)
The hospital's mission statement
The number of licensed beds in the facility
The total annual operating budget

Correct answer: Monthly staff turnover rate exceeding a defined threshold

A KRI is a measurable metric that signals an increasing risk exposure; a rising staff turnover rate can indicate workforce and patient safety risks.

Question 71: The primary risk management concern with a hospital's non-compete agreements for employed physicians is:

Antitrust implications and interference with patient access to care (Correct answer)
Non-compliance with medical staff bylaws
Violation of the Stark Law's compensation exception requirements
Potential HIPAA violations if patient lists are shared

Correct answer: Antitrust implications and interference with patient access to care

Overly broad non-compete agreements for physicians raise antitrust concerns and can impair patient access to care, drawing FTC and state attorney general scrutiny.

Question 72: A risk manager reviewing a workers' compensation program notices a high frequency of low-severity musculoskeletal injuries among nursing staff. The BEST first response is to:

Conduct an ergonomic assessment and implement a safe patient handling program (Correct answer)
Increase workers' compensation insurance coverage limits
Terminate employees with repeated injury claims
Transfer all nursing staff to sedentary administrative roles

Correct answer: Conduct an ergonomic assessment and implement a safe patient handling program

Ergonomic assessment and safe patient handling programs directly address the root cause of musculoskeletal injuries common among nursing staff.

Question 73: A 'never event' in healthcare quality improvement refers to:

A near-miss event with no patient harm
An event that is never reported to regulatory authorities
A serious, largely preventable adverse event that should never occur (Correct answer)
Any event that rarely occurs in clinical practice

Correct answer: A serious, largely preventable adverse event that should never occur

Never events are serious, preventable patient safety events that should not occur if evidence-based preventive measures are in place.

Question 74: In healthcare quality improvement, 'benchmarking' refers to:

Setting internal performance goals based on last year's data
Comparing performance metrics against best practices or top performers (Correct answer)
Measuring patient satisfaction scores on a standardized survey
Reviewing individual clinician performance annually

Correct answer: Comparing performance metrics against best practices or top performers

Benchmarking compares an organization's processes and outcomes against recognized leaders or industry standards to identify performance gaps.

Question 75: Which professional attribute is most valued in insurance and finance within the CPHRM field?

Prioritizing personal convenience
Working in isolation
Accountability and commitment to standards (Correct answer)
Avoiding challenging situations

Correct answer: Accountability and commitment to standards

Accountability and commitment to professional standards build trust and ensure consistent, high-quality practice.

Question 76: A hospital's self-insurance program purchases specific stop-loss coverage at $500,000 per occurrence. A single malpractice claim is settled for $1.2 million. How much does the stop-loss carrier pay?

$700,000 (Correct answer)
$0, because stop-loss only covers aggregate losses
$500,000
$1,200,000

Correct answer: $700,000

Specific stop-loss covers losses above the per-occurrence retention; the hospital retains the first $500,000 and the stop-loss carrier pays the remaining $700,000.

Question 77: A risk manager notices that the hospital's general liability policy contains a 'subrogation waiver' clause for certain contractors. What does waiving subrogation mean?

The insurer waives the deductible on the contractor's behalf
The contractor's policy becomes primary over the hospital's policy
The insurer gives up its right to pursue a third party for reimbursement after paying a claim (Correct answer)
The hospital agrees to defend the contractor in all lawsuits

Correct answer: The insurer gives up its right to pursue a third party for reimbursement after paying a claim

Waiving subrogation means the insurer surrenders its legal right to recover from a responsible third party after indemnifying the insured, preventing it from suing the named contractor.

Question 78: What obligation does confidentiality impose on CPHRM professionals?

Protect sensitive information and share only as authorized (Correct answer)
Never communicate with anyone
Keep all information secret indefinitely
Share information freely with colleagues

Correct answer: Protect sensitive information and share only as authorized

Confidentiality requires protecting sensitive information and only sharing it through authorized channels and for legitimate purposes.

Question 79: What kind of questions are included in the pretest?

Application-level questions
Scored questions
Multiple-choice questions
Non-scored questions (Correct answer)

Correct answer: Non-scored questions

Pretest questions included in certification exams are experimental questions that are not scored and do not affect a candidate's final result. Their purpose is to gather data on their performance, such as difficulty and discrimination, for potential inclusion as scored questions in future exam forms. This allows the exam board to validate new questions without impacting current test-takers' scores.

Question 80: A risk manager reviewing the organization's claims history notices a cluster of retained surgical instrument cases. This is an example of risk identification through:

Clinical benchmarking
Prospective analysis
Retrospective claims analysis (Correct answer)
Environmental scanning

Correct answer: Retrospective claims analysis

Retrospective claims analysis reviews past malpractice claims to identify patterns that indicate systemic risk areas.

Question 81: Which concept in risk analysis refers to defenses, barriers, and safeguards that, when all have gaps simultaneously, allow an adverse event to occur?

Bow-tie model
Swiss cheese model (Correct answer)
Haddon matrix
Domino theory

Correct answer: Swiss cheese model

The Swiss cheese model (Reason's model) illustrates how latent and active failures in multiple system layers must align for an accident to happen.

Question 82: Which action BEST reduces the risk of patient elopement in a psychiatric facility?

Implementing a structured risk assessment at admission and ongoing monitoring (Correct answer)
Reducing nursing staff ratios
Locking all facility exits at all times
Restricting all patient visitation

Correct answer: Implementing a structured risk assessment at admission and ongoing monitoring

Structured elopement risk assessment at admission, with regular reassessment, guides targeted interventions to prevent unauthorized patient departure.

Question 83: What degree is required to qualify for the Certified Professional in Healthcare Risk Management exam?

High School Diploma
Master's Degree
Bachelor's Degree (Correct answer)
Associate's Degree

Correct answer: Bachelor's Degree

To qualify for the Certified Professional in Healthcare Risk Management (CPHRM) exam, candidates typically need a bachelor's degree along with a specific amount of experience in healthcare risk management. This educational requirement ensures that candidates possess a foundational academic background relevant to the complexities and responsibilities of the risk management field.

Question 84: Which document formally notifies a healthcare organization that a patient intends to pursue legal action?

Subpoena duces tecum
Notice of intent (Correct answer)
Incident report
Summons and complaint

Correct answer: Notice of intent

A notice of intent is a pre-suit document that formally alerts a healthcare provider of a patient's intent to file a malpractice claim.

Question 85: A hospital's quality improvement committee proceedings are most likely protected from discovery under:

State peer review privilege statutes (Correct answer)
The Joint Commission standards
Federal tort reform legislation
HIPAA Privacy Rule

Correct answer: State peer review privilege statutes

Most states have peer review privilege statutes that protect the confidential proceedings of quality improvement and peer review committees from being used as evidence in malpractice litigation.

Question 86: A hospital voluntarily discloses an adverse event to a patient and family. This practice is BEST supported by which principle?

Strict liability
Defensive medicine
Res ipsa loquitur
Disclosure and apology programs (Correct answer)

Correct answer: Disclosure and apology programs

Disclosure and apology programs support honest communication about adverse events and often reduce litigation by addressing patient concerns directly.

Question 87: In the context of healthcare claims, 'occurrence reporting' is BEST described as:

Notifying the insurer of events that may lead to a claim, even before one is filed (Correct answer)
Documenting outcomes in the patient's medical record
Reporting adverse events to state health departments
Filing a claim with the insurer after a verdict

Correct answer: Notifying the insurer of events that may lead to a claim, even before one is filed

Occurrence reporting to insurers involves notifying them of incidents or events with claim potential before a formal claim is made, preserving coverage and enabling early investigation.

Question 88: When performing a proactive risk assessment on a new infusion pump workflow, the FIRST step should be:

Implement controls for the highest-risk steps
Calculate the RPN for each failure mode
Map or diagram the entire process step by step (Correct answer)
Assign severity scores to known failure modes

Correct answer: Map or diagram the entire process step by step

Process mapping is the foundational first step, ensuring all steps and decision points are identified before failure modes and their effects are analyzed.

Question 89: A hospital settles a malpractice claim for $150,000. Under the National Practitioner Data Bank (NPDB) rules, this payment must be reported:

At the hospital's discretion if the physician was not named
Only when the physician is found liable by a court
Within 30 days of the payment (Correct answer)
Only if the payment exceeds $500,000

Correct answer: Within 30 days of the payment

NPDB regulations require that all medical malpractice payments made on behalf of a licensed healthcare practitioner be reported within 30 days.

Question 90: A hospital risk manager is asked to justify the return on investment (ROI) of the risk management program. Which metric would BEST demonstrate financial value?

The size of the risk management department's budget
Reduction in total cost of risk year-over-year relative to program expenditures (Correct answer)
Total number of claims filed annually
The number of safety training sessions conducted

Correct answer: Reduction in total cost of risk year-over-year relative to program expenditures

ROI is best demonstrated by showing that reductions in total cost of risk (losses, premiums, expenses) exceed the cost of the risk management program itself.

Question 91: Under EMTALA, a hospital's obligation to provide an appropriate medical screening examination applies to:

Only patients who are transported by ambulance
Any individual who comes to the emergency department requesting examination or treatment (Correct answer)
Patients who present with life-threatening conditions only
Only patients with Medicare or Medicaid insurance

Correct answer: Any individual who comes to the emergency department requesting examination or treatment

EMTALA applies to any individual who comes to a hospital emergency department and requests examination or treatment for a medical condition, regardless of ability to pay or insurance status.

Question 92: A nurse overhears a patient threaten to harm a specific person upon discharge. Under the Tarasoff duty, the provider's obligation is to:

Only document the threat in the medical record
Maintain strict patient confidentiality and take no action
Report solely to the hospital ethics committee
Warn the identifiable potential victim and notify authorities (Correct answer)

Correct answer: Warn the identifiable potential victim and notify authorities

The Tarasoff decision established that mental health professionals have a duty to protect identifiable third parties from credible threats, which may include warning the potential victim and/or notifying law enforcement.

Question 93: In the context of healthcare litigation, 'discovery' refers to:

The pre-trial process of obtaining evidence from the opposing party (Correct answer)
The risk manager's root cause analysis
A hospital's internal incident investigation
A physician's duty to disclose diagnoses to patients

Correct answer: The pre-trial process of obtaining evidence from the opposing party

Discovery is the pre-trial legal process through which parties exchange information and evidence, including depositions, interrogatories, and document requests.

Question 94: Which professional attribute is most valued in loss prevention within the CPHRM field?

Prioritizing personal convenience
Working in isolation
Avoiding challenging situations
Accountability and commitment to standards (Correct answer)

Correct answer: Accountability and commitment to standards

Accountability and commitment to professional standards build trust and ensure consistent, high-quality practice.

Question 95: When a risk manager discovers that a physician's expired DEA license was not caught during re-credentialing, this represents a failure in:

Credentialing and privileging oversight (Correct answer)
Utilization management
Discharge planning
Claims management

Correct answer: Credentialing and privileging oversight

Credentialing and privileging processes must verify that practitioners maintain current licensure and certifications to practice safely.

Question 96: A healthcare risk manager wants to reduce slip-and-fall incidents among inpatients. Which intervention has the strongest evidence base?

Requiring patients to sign liability waivers upon admission
Replacing all flooring with non-slip carpet
Reducing visitor hours to decrease floor traffic
Implementing a standardized fall risk assessment and prevention protocol (Correct answer)

Correct answer: Implementing a standardized fall risk assessment and prevention protocol

Standardized fall risk assessments combined with individualized prevention protocols are the most evidence-based approach to reducing inpatient falls.

Question 97: A hospital's risk manager is evaluating vendor contracts for operational risk. Which clause is most critical to include?

A Business Associate Agreement (BAA) for HIPAA compliance (Correct answer)
A marketing collaboration clause
A clause specifying the vendor's social media policy
A clause requiring the vendor to attend board meetings

Correct answer: A Business Associate Agreement (BAA) for HIPAA compliance

A BAA is legally required under HIPAA when a vendor will access, use, or disclose protected health information on behalf of a covered entity.

Question 98: What role does collaboration play in risk identification for CPHRM professionals?

It slows down work unnecessarily
It enhances outcomes through diverse perspectives and shared expertise (Correct answer)
It reduces individual accountability
It is only needed in emergencies

Correct answer: It enhances outcomes through diverse perspectives and shared expertise

Collaboration leverages diverse perspectives and combined expertise to achieve better outcomes than any individual could alone.

Question 99: When managing a potentially compensable event (PCE), the risk manager's early intervention with the patient and family is primarily aimed at:

Documenting the patient's statements for use in litigation
Building trust, gathering facts, and reducing the likelihood of litigation through transparent communication (Correct answer)
Transferring the patient to reduce further liability exposure
Obtaining a release of liability immediately

Correct answer: Building trust, gathering facts, and reducing the likelihood of litigation through transparent communication

Early intervention in PCEs focuses on open communication, expressing empathy, conducting early fact-finding, and addressing patient/family needs, which research shows reduces the frequency and severity of malpractice claims.

Question 100: The 'Swiss Cheese Model' of accident causation is used in risk identification to illustrate that:

Multiple system defenses must all fail simultaneously for harm to occur (Correct answer)
Human error is the primary cause of all adverse events
Risk identification should focus only on frontline workers
A single failure is always sufficient to cause harm

Correct answer: Multiple system defenses must all fail simultaneously for harm to occur

The Swiss Cheese Model shows that harm results when holes (failures) in multiple defensive layers align, enabling a hazard to reach the patient.

Question 101: The Hospital Consumer Assessment of Healthcare Providers and Systems (HCAHPS) survey measures:

Patients' perspectives on their hospital care experience (Correct answer)
Physician adherence to evidence-based treatment guidelines
Clinical complication rates across standardized diagnoses
Staff satisfaction with workplace safety culture

Correct answer: Patients' perspectives on their hospital care experience

HCAHPS is a standardized survey that publicly reports patients' perspectives on hospital care, including communication, responsiveness, and cleanliness.

Question 102: Under CMS CoPs, the medical staff bylaws must address which of the following related to credentialing?

The process for granting, renewing, and revoking privileges (Correct answer)
The minimum malpractice insurance limits required
The specific clinical privileges granted to each physician
The maximum number of physicians that can be credentialed

Correct answer: The process for granting, renewing, and revoking privileges

CMS CoPs require medical staff bylaws to include processes for appointment, reappointment, and clinical privileges, including the criteria and procedures for granting, renewing, revising, and revoking privileges.

Question 103: A risk manager quantifies the 'pure premium' for a self-insured retention layer. Pure premium is calculated as:

Total incurred losses divided by the number of exposure units (Correct answer)
Expected loss ratio multiplied by reinsurance limit
Total premium paid minus administrative expenses
Frequency rate times average severity per claim

Correct answer: Total incurred losses divided by the number of exposure units

Pure premium represents the actuarial cost of losses per unit of exposure, calculated by dividing total incurred losses by exposure units.

Question 104: Which metric measures the average cost of claims closed within a specified period, used to evaluate claims management effectiveness?

Occurrence rate per 1,000 patient days
Average paid loss per closed claim (Correct answer)
Loss development factor
Incurred but not reported (IBNR) reserve

Correct answer: Average paid loss per closed claim

Average paid loss per closed claim benchmarks how much money the organization is paying per resolved claim, indicating claims management efficiency.

Question 105: Patient harm events are classified by severity level. Which classification system does the National Coordinating Council for Medication Error Reporting and Prevention (NCC MERP) use?

A through I index categories (Correct answer)
Level 1 through Level 5 severity scale
Green, Yellow, Red risk classification
Minor, Moderate, Major, Catastrophic tiers

Correct answer: A through I index categories

NCC MERP uses Categories A through I to classify medication errors from no harm potential (A) to death (I).

Question 106: Under a retrospective rating plan, the final premium is determined primarily by:

An industry-wide loss ratio
The insured's actual loss experience during the policy period (Correct answer)
The insurer's fixed expense loading
Projected future losses only

Correct answer: The insured's actual loss experience during the policy period

Retrospective rating adjusts the premium after the policy period ends based on the organization's actual losses, rewarding favorable experience with lower costs.

Question 107: Which of the following BEST defines 'claims-made' insurance coverage?

Coverage tied to the claimant's date of discovery
Coverage for any claim regardless of when filed
Coverage for incidents that occurred and are reported during the policy period (Correct answer)
Coverage only for previously settled claims

Correct answer: Coverage for incidents that occurred and are reported during the policy period

A claims-made policy provides coverage only if the incident occurred and the claim is reported while the policy is in force.

Question 108: Which of the following BEST describes 'high reliability organizations' (HROs) in healthcare?

Organizations that exceed benchmarks in patient satisfaction scores only
Organizations accredited by multiple regulatory agencies simultaneously
Organizations with zero employee turnover and high patient volume
Organizations that consistently minimize harm despite operating in complex, high-risk environments (Correct answer)

Correct answer: Organizations that consistently minimize harm despite operating in complex, high-risk environments

HROs are characterized by a persistent preoccupation with failure, sensitivity to operations, commitment to resilience, and deference to expertise at all levels.

Question 109: A risk manager applies a 'bow-tie' model to a medication error risk. The LEFT side of the bow-tie represents:

Consequences and recovery controls
Corrective actions taken after an incident
Regulatory penalties associated with the risk
Threats and preventive barriers leading to the hazardous event (Correct answer)

Correct answer: Threats and preventive barriers leading to the hazardous event

The left side of a bow-tie diagram maps threats (causes) and preventive controls that reduce the likelihood of the central hazardous event.

Question 110: What is the recommended first step when a CPHRM professional identifies a compliance violation?

Ignore it if minor
Discuss on social media
Document and report through proper channels (Correct answer)
Wait for someone else to report it

Correct answer: Document and report through proper channels

All compliance violations should be documented and reported through established channels to ensure proper investigation and resolution.

ASHRM Certified Professional in Healthcare Risk Management (CPHRM) Exam

The ASHRM CPHRM exam certifies healthcare risk management professionals in risk identification, risk analysis, loss prevention, claims management, patient safety, regulatory compliance, quality improvement, insurance and finance, legal issues, and enterprise risk management.

110

Questions

150 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds