Vident Partners provides vetted risk management expert witnesses for cases involving board and officer oversight, enterprise risk programs, hospital patient safety systems, incident reporting and root cause analysis, and disputes over what an organization knew and did about a known hazard. Request a referral today.
Find a Risk Management Expert →Overview
A risk management expert decides whether an organization identified a known hazard, assessed it, assigned someone to act on it, and acted before harm occurred. The question is about the system and not the single bad event. This page covers risk management as a discipline in companies and health care organizations. It is not the physician standard of care, which belongs to a clinical expert, and it is not insurance coverage or claims practice, which sit with the insurance specialties.
For a Delaware corporation, the legal frame is the duty of oversight from Caremark. In re Clovis Oncology (2019) reads the Delaware Supreme Court's decision in Marchand v. Barnhill to mean that when regulation governs a company's "mission critical" operations, the board's oversight function must be more rigorously exercised 1. The standard is still limited: Caremark does not demand omniscience, but it does demand a good faith effort to implement an oversight system and then monitor it 1.
In re McDonald's (2023) extended that duty to corporate officers 2. An officer's duty to set up an information system applies within that officer's area of responsibility, and the duty to address and report red flags generally applies there too, though a particularly egregious red flag may require speaking up outside it 2. A breach still requires bad faith, so weak risk management alone does not make out the claim 2. The expert can describe what a functioning program looks like. Whether conduct amounted to bad faith is a question for the court.
Public companies add a disclosure layer. Regulation S-K Item 407(h) requires a registrant to disclose the extent of the board's role in risk oversight, including how the board administers that function 3. The comparison between that description and the actual record is often the most useful work. The documents are risk registers, committee charters, board and committee minutes, management dashboards, internal audit reports, and the emails showing what moved upward and what stopped.
No single framework is the law. GAO says there is no "one right" enterprise risk management framework, and it names ISO 31000 and the COSO framework as commonly used ones 4. GAO's report addresses federal agencies, but its essential elements are a clear test of whether a program was real: align the process to goals, identify risks, assess them, select a response, monitor, and communicate 4. GAO adds that if an organization did not monitor risks, it would have no way to ensure it had responded successfully 4. The expert must say which framework was adopted, or should have been, and why that one fits a company of that size and sector.
In a hospital, the anchor is the Medicare condition of participation at 42 CFR 482.21. Performance improvement activities must track medical errors and adverse patient events, analyze their causes, and implement preventive actions 5. The governing body, medical staff and administrative officials are accountable for an ongoing program for quality improvement and patient safety 5. A health care risk expert reads event reports, root cause analyses, committee records, and policy revisions to see whether the loop closed: was the event found, analyzed, fixed and rechecked. How much weight a federal participation condition carries in a tort case depends on the forum's law.
The fight over those records is often as important as their content. Under the Patient Safety and Quality Improvement Act, patient safety work product is privileged and is not subject to subpoena or discovery, subject to listed exceptions 7. The definition stops at a patient's medical record, billing and discharge information, and any other original patient or provider record, and it excludes information collected or maintained separately from a patient safety evaluation system 6. So the expert may need to explain how an organization's reporting system actually worked, including what entered it and when.
Health care has a recognized credential. The American Hospital Association Certification Center offers the Certified Professional in Health Care Risk Management, which requires a degree and health care experience pathway plus risk management experience of 3,000 hours or 50 percent of full-time duties within the last three years 8. Enterprise risk has no license. The background is senior work as a chief risk officer, internal audit leader or compliance leader who ran a program at a comparable organization.
Neighbors answer different questions. A physician or nursing expert addresses the care given. A cybersecurity expert addresses technical controls. An accounting expert addresses internal control over financial reporting and the numbers. The risk management expert addresses whether the organization had a working process for seeing and acting on the hazard.
In re Clovis Oncology reads Caremark to demand a good faith effort to implement an oversight system and then monitor it, and says the oversight function must be more rigorously exercised when regulation governs mission critical operations.
Case Types
Stockholder oversight claims over a compliance failure at a regulated company
Disputes over red flags that were or were not escalated to senior officers and the board
Adequacy of an enterprise risk management program after a safety, product or regulatory event
Hospital patient safety and event reporting systems after a serious adverse event
Corporate negligence claims against hospitals and health systems
Discovery fights over incident reports and patient safety work product
Failure to implement corrective actions after a root cause analysis
Risk disclosures that differ from the risk practices the company actually ran
Qualifications
Related Specialties
FAQ
It depends on the setting. Health care matters have a recognized credential, the Certified Professional in Health Care Risk Management from the American Hospital Association Certification Center. Enterprise risk management has no license, so look for someone who ran a program, reported to a board or committee, and has dealt with the type of hazard at issue.
A physician expert addresses whether the care met the clinical standard. A risk management expert addresses the organization's system: how events were reported, analyzed and corrected, and whether known hazards were acted on. Many hospital cases call for both, and each should stay within its own field.
Caremark does not demand omniscience. It demands a good faith effort to implement an oversight system and then monitor it. Delaware courts have said the oversight function must be more rigorously exercised when regulation governs mission critical operations, and McDonald's extended the duty to officers within their areas of responsibility. A claim still requires bad faith.
It depends on what the report is and where it sits. Federal law makes patient safety work product privileged, subject to listed exceptions, but the definition does not reach medical records, billing and discharge information, original patient or provider records, or information kept separately from a patient safety evaluation system. State peer review law may also apply.
No. GAO states there is no one right enterprise risk management framework and names ISO 31000 and COSO as commonly used. An expert should identify what the organization adopted, whether that choice fit it, and whether the program ran in practice as written.
In general, risk management expert fees are determined by the expert themselves, based on a variety of criteria. Among those criteria are professional experience, forensic experience, industry certifications, regulatory knowledge, and publications. Vident does have some influence over expert fees by comparing experts within a specialty, but ultimately it is a personal decision by the expert.
Related Insights
In January we posted a summary review of the Johnson & Johnson (J&J) baby powder litigation. A striking new development warrants an update: Judge Christopher Lopez of the U.S. Bankruptcy Court for...
Practice Area IntelligenceMedicare and Medicaid fraud represent a significant challenge to the financial integrity of the United States healthcare system. The real cost of such fraudulent activities is multifaceted,...
Practice Area IntelligenceAccountants play a key role in litigation by providing a range of specialized services that can support the legal process. Their expertise in financial matters allows them to offer insights and...
Sources
Vident Partners connects attorneys with qualified risk management expert witnesses. Complimentary consultation, 24-hour turnaround, no obligation.
Request an Expert →