A risk register built on evidence, not opinion.
Risks surface from what your hospital already sees. Every control is backed by audit data, and the board sees what changed since the last meeting.
4
above appetite
9
rated high
31
controls proven
evidence
Assurance your board can see.
Is each risk under control, and how do we know? Root answers with evidence from the wards.
Incident patterns
Related incidents, clustered
Fixes that didn't hold
A failed recheck raises a risk
Audit findings
Pointer, IPC Suite, EHS
Rounds and walk-throughs
Seen before anything fails
One live register
Every control linked to the audits that test it
Controls proven, not assumed.
A register of opinion, or a register of evidence?
| A register of opinion | A register of evidence, with Root | |
|---|---|---|
| Where risks come from | Workshops and memory | Incident patterns, fixes that didn't hold, audit findings and rounds |
| How controls are assured | A director's judgement | The audits that test them, and the incidents that show where they slipped |
| Reviews | When someone remembers | On a rhythm set by each risk's rating, with overdue items in one view |
| Appetite | A statement in board papers | A number: risks at or above appetite |
| The board report | Compiled by hand | Builds itself, showing what changed since the last meeting |
how it works
From first signal to proven control.
- 01Signals become candidate risks, with evidence cited.
- 02Dismiss, watch, or register.
- 03Inherent, residual and target scores.
- 04Risk, review, response and control owners.
- 05Avoid, mitigate, transfer or accept.
- 06Audits prove each control; reviews keep it live.
one risk, through root
A generator that missed its tests.
On rounds, the facilities director notices the backup generator has missed two quarterly load tests. Nothing has failed yet.
East Tower backup generator
for the board
The committee report that builds itself.
What changed since the last meeting, what sits above appetite, and which controls are proven. A snapshot is saved each time you publish, so the next report compares against exactly what the board saw.
| New | 2 |
| Closed | 1 |
| Increased | 1 |
| Reduced | 3 |
| Unchanged | 11 |
| Reallocated | 1 |
| Above appetite | 4 |
by role
A view for everyone who carries risk.
Risk managers
Register, triage queue, overdue and above appetite.
Risk owners
My risks: what's due, overdue first.
Control owners
Your controls, with the audit evidence.
Committees
Your risks, appetite and changes.
details
The details, when you want them.
Risk areas +
Supports ASHRM's eight domains in one register: clinical and patient safety, operational, hazard, legal and regulatory, financial, strategic, human capital and technology. Four have automated finding; four are entered by hand. Each risk has one main area and optional extra tags.
Identification and triage +
Incident patterns, fixes that fail their recheck, audit and standards findings, rounds and walk-throughs, and colleagues' suggestions. Each candidate is dismissed with a reason, placed on a Watch List below the cutoff, or registered at or above it.
Scoring +
Severity by likelihood on each facility's matrix; expected loss for financial risk (probability multiplied by impact as a share of capital or revenue); inherent, residual and target scores; full score history.
Controls and ownership +
A shared controls library by risk area, a control owner for each, and assurance from linked audits. Every risk has a risk owner, a review owner and a response owner; who found it is recorded separately.
Reviews +
A rhythm set by each risk's rating; overdue items in one view; reminders and escalation.
Governance +
Committees with their own remit; appetite by risk area; a heat map with "high" and "above appetite" shown separately; committee reports with a saved snapshot.
Connected +
Incidents link to existing risks; preventive actions share the corrective action tracker; sites, matrices and standards come from Pointer.
Security +
See IT and security.
resources
Take it to your team
Sample committee report
Change since the last meeting, appetite and control assurance, with sample data.
Request the samplefaq
Questions risk managers ask
Where do risks come from? +
From what your hospital already sees: incident patterns, fixes that didn't hold, audit and standards findings, rounds and walk-throughs, and colleagues' suggestions. You can also enter risks directly.
How does Root show a control works? +
Each control links to the audits that test it, and to any incidents that got past it. Assurance comes from that evidence, not just a judgement.
Does it cover non-clinical risk? +
Yes. Clinical, operational, hazard, legal and regulatory, financial, strategic, human capital and technology risks share one register.
How is financial risk scored? +
On expected loss: the probability of the event multiplied by its impact as a share of capital or revenue.
What does the board see? +
Its own risks, how many sit at or above appetite, control assurance, and what changed since the last meeting.
Do incidents create duplicate risks? +
No. A new incident links to the risk it belongs to, so evidence builds on one record.
How is it priced? +
As an annual subscription. We'll give you an exact quote for your hospital.
Some answers depend on your hospital. We'll cover them with you.
See every risk, and prove every control. Let's start with your register.
Book a walkthrough- →Your price, based on your hospital
- →Moving your current register into Root
- →Setting appetite for each risk area with your board
- →Linking your controls to the audits that test them
- →Your committees and their remits
- →A sample committee report with your own risks