The “Risk Rating” for a residential care home can have a major impact on the home’s operations. The rating can influence the frequency of assessments by the Aged Care Quality and Safety Commission (ACQSC) and the severity of a response to non-compliance. Yet it remains unclear how the ACQSC determines the Risk Rating for a residential aged care home. Here’s what we know and don’t know.

What is a “Risk Rating”?

A risk rating is a tool used by the ACQSC as part of its Regulatory Strategy and Compliance and Enforcement Policy for assessing aged care providers’ compliance with the Aged Care Quality Standards and other legal/regulatory obligations. It is different from the “Service Compliance Rating” which we discussed in a previous article.

“Risk Rating” is not a term used in official ACQSC guidance, but it is sometimes used by assessors in conversation with providers. “Risk Rating” means the same thing as “level of assessed risk”, which is the official term used in the Regulatory Strategy. There are three levels of assessed risk (and therefore, three Risk Ratings that a home can receive):

• Low/Medium Risk
• High Risk
• Severe Risk

When does an aged care home receive a Risk Rating?

If your aged care home is assessed, and found non-compliant, the ACQSC assessors will ascribe you a Risk Rating. It is also possible that the ACQSC will ascribe a blanket Risk Rating to all aged care homes in response to a sector-wide event, such as the COVID-19 pandemic.

One Risk Rating or many?

Is there a single, overarching Risk Rating for the home or are there separate Risk Ratings for each area of non-compliance? The Regulatory Strategy suggests that a separate Risk Rating applies to each area of non-compliance, meaning that a home could have more than one Risk Rating (e.g., you might be ranked Low/Medium Risk in regard to governance but High Risk in regard to clinical care). However, some providers have suggested to ACE that ACQSC assessors sometimes talk about the Risk Rating as if it were a single ranking applied to the home as a whole.

Why does the Risk Rating matter?

A Risk Rating can influence the frequency of ACQSC assessments and the severity of a response to non-compliance. For example, according to the Regulatory Strategy, a finding of Low/Medium non-compliance will result in a Direction, but a finding of Severe Risk non-compliance will lead immediately to sanctions.

How does the ACQSC determine the Risk Rating?

As at 1 November 2021, we do not have a detailed picture of how the ACQSC assessors determine whether a particular risk is Low/Medium, High or Severe. There are no detailed, published criteria.

There is, however, some guidance from the Regulatory Strategy, which says that in determining a regulatory response to an individual service, the ACQSC considers:

• harm to the safety, health, well-being and quality of life of consumers, consequence of failure in terms of the potential effect of the provider’s actions on consumers through the management and delivery of care and services
• where relevant, trust of the provider (likelihood of managing harm) based on the extent to which the provider demonstrates effective leadership and governance to prevent and manage consumer risks, has a history of providing quality and safe care, monitors its own effectiveness and solves its quality problems.

The Regulatory Strategy also notes that the ACQSC “uses a range of performance information, including non-compliance with the Quality and/or Prudential Standards, complaints data and non-compliance with other responsibilities under the Aged Care Act 1997, to understand the likelihood and consequence of the risk occurring. We also work with other regulators and entities where appropriate to inform this.” Additional information is provided in the Compliance and Enforcement Policy.

Finally, the Regulatory Strategy lists “some circumstances [that] will increase service risk”, such as:

• material change in key personnel
• building works or renovations in progress
• rapid expansion or change in service offering.

However, overall, the ACQSC’s process and criteria for assessing risk are not clear. One of the ACQSC’s own Site Audit Frequently Asked Questions raises the issue directly, but the ACQSC’s answer refers to the Regulatory Strategy, which itself provides scant detail on this issue:

Q: When is the Commission going to publish how it assesses risk? How do we assess risk?

A: The Commission has undertaken considerable work on strengthening its approach to risk. The Commission has published its Regulatory Strategy which outlines its approach to managing risk.

When assessing providers compliance with the Quality Standards, the Commission is broadening its focus on outcomes for consumers, the quality of consumer experience and the prevention of harm. This involves listening more closely to consumers, giving them better information and building the Commission’s use of regulatory intelligence and risk about individual services and providers.

What to do about your Risk Rating

Risk assessments are complex. One of the reasons the ACQSC is vague on its process for assessing risk may be because risk assessments need to be done on a case-by-case basis according to flexible principles rather than rigid criteria. For this reason, the best way to learn more about your Risk Rating(s), might be to ask the ACQSC assessors directly when they contact you about assessing your service. Questions you may want to ask include:

• Do I have a Risk Rating? If so, what is it?
• Do I have one Risk Rating for the service or multiple Risk Ratings tied to particular issues?
• How will the Risk Rating(s) affect the ACQSC’s regulatory strategy in regard to my service?
• How can I improve my Risk Rating(s)?