Risk management
NextHealth Flow
NextHealth Flow
Flow Risk is sold separately
NXH Flow risk management keeps a risk register with named owners. Each risk records its description, threat, vulnerability and existing controls, and is scored from an asset value, a probability and an impact, each rated 1 to 5. A residual score can be recorded after mitigation. Mitigation plans, acceptance types, owners and target completion dates sit on the record, with reminders before and after the date. Status changes follow the facility’s workflow, and an audit trail keeps the changes.
Give each risk an owner and reviewable context
-
Step 1
Assess
Score asset value, probability and impact
-
Step 2
Control
Record threats, vulnerabilities and controls
-
Step 3
Assign
Set the owners and a target date
-
Step 4
Review
Move the status through review and approval
What your team can do
- Score each risk from asset value, probability and impact.
- Record a residual probability, impact and score after mitigation.
- Record threats, vulnerabilities and existing controls with each risk.
- Maintain mitigation actions and record the acceptance type.
- Assign risk and mitigation owners, with a target completion date.
- Move each risk through a status workflow the facility can configure.
- Keep an audit trail and export the recorded risk information.
Risk scores need context ownership and a review decision.
Give each risk an owner and reviewable context
A risk register loses value when the score is visible but the reasoning, controls and next review are not. Managers need to understand what the risk concerns and who is expected to revisit it, particularly when conditions change between formal review meetings.
NXH Flow scores each risk from an asset value, a probability and an impact. The asset value is the highest of the confidentiality, integrity and availability ratings, and every rating runs from 1 to 5. The score is the product of the three, up to 125, and falls in a band from very low to extreme. After mitigation the team can record a residual probability and impact, which Flow scores in the same way.
Threats, vulnerabilities, existing controls, mitigation actions and the acceptance type sit on the same record, with a risk owner, a mitigation owner and a target completion date. Owners are reminded as the date approaches and when it passes. Status changes follow a workflow the facility can configure, and an audit trail keeps the changes.
Illustrative example: a pharmacy cold storage risk
This example uses synthetic data.
A pharmacy manager records the risk that a vaccine refrigerator fails overnight. Availability is the highest of the three ratings, which sets the asset value, and the team rates probability and impact. Flow shows the score and its band. The existing control is a temperature alarm. The team adds a mitigation action, names a mitigation owner and sets a target date, and later records the residual probability and impact. The risk moves to review, where an approver records the decision.
Bring a representative operational risk to the demonstration and record the assessment, ownership and status changes. The software organises the record. The organisation chooses the controls, judges whether they work and decides whether a risk is acceptable. Flow does not assess how well the organisation governs risk.
Related NXH Flow modules
2 more modules
Common questions
-
Risk management sits within Flow Risk, which is sold separately. Flow has no compulsory core package; choose the commercial modules your facility needs.
-
Yes. Risks can be linked to threats, vulnerabilities and controls, with mitigation plans and acceptance decisions retained as part of the record.
-
Risk owners and mitigation owners are assigned, and Flow sends reminders as a mitigation target date approaches and when it passes. Status changes move through a review workflow that the facility can configure.
-
No. Recording a control does not establish its effectiveness. The responsible team must assess the risk, review evidence and decide whether further action is needed.
Not answered here? Contact the team
