Interviewing as a Technique for Risk Identification: Insights from HCA’s David Hughes

In the ever-evolving landscape of enterprise risk management (ERM), organizations are continually seeking effective methods to identify and assess potential risks. One such method gaining traction is the use of structured interviews. In a conversation with Mark Beasley, director of NC State’s ERM Initiative, David Hughes, assistant vice president of Enterprise Risk Management and Business Continuity Planning at Hospital Corporation of America (HCA), shared valuable insights into HCA’s successful implementation of interview-based risk identification.

The Evolution of HCA’s Risk Identification Process

When HCA first launched its enterprise risk management efforts, the company took an innovative approach by implementing an interview-based system to identify risks across the organization. Hughes explains, “We started with just the executive management team and some key middle management people in the company.”

The success of this initial approach led to a significant expansion of the process. “It was so well received the first year that we’ve expanded it each year for a number of years,” Hughes notes. Today, HCA’s risk identification process encompasses a broad spectrum of stakeholders:

• All board members
• The executive management team
• Middle management in various divisions
• Facility CEOs (via survey)

This comprehensive approach ensures that HCA captures a wide range of perspectives on potential risks, from strategic concerns at the board level to operational challenges faced by facility managers.

The Interview Methodology: A Closer Look

HCA’s interview process is both systematic and flexible, designed to extract maximum value from each conversation. Here are the key elements of their approach:

1. One-on-One Conversations: Hughes emphasizes the importance of individual interviews, stating, “We do all of them one on one. Some of them are over the phone. Most of them are face to face.”
2. Time-Efficient: Recognizing the busy schedules of executives, HCA keeps the interviews concise. “Most of them last about 30 minutes. We schedule 30 minutes. Some of them may last 20. Some of them may last 45,” Hughes explains.
3. Simple Yet Effective Questions: The interview revolves around two primary questions:
   • “What are your top three business risks over the next 24 months that could have an impact on the company or the company’s strategic goals and objectives?”
   • “What are you aware of that the company is doing to address those risks? And in your opinion, is that effective?”
4. Two-Person Interview Team: To ensure accurate capture of information, HCA sends two people to each interview. “One will be transcribing a lot, and the other is asking the questions, and we kind of switch off,” Hughes describes.

Timing and Frequency: Aligning with Strategic Planning

HCA conducts these risk identification interviews annually, carefully timing the process to align with the company’s strategic planning cycle. Hughes explains, “We start them generally end of August, first part of September, and that way we can have a lot of the results as we move into the budgeting, planning phase of the company.”

This strategic timing ensures that identified risks are fresh in the minds of decision-makers as they plan for the upcoming year, allowing for more informed and risk-aware strategic decisions.

Scaling the Process: From Interviews to Surveys

As HCA’s risk identification process matured, the company expanded its reach to include a broader base of employees. Hughes reveals, “This past year, we interviewed a little over 80 people, and we surveyed about—I think it was about 170 that we actually got survey results back from.”

This two-pronged approach of in-depth interviews complemented by wider surveys allows HCA to balance the depth of insights from key stakeholders with the breadth of perspectives from across the organization.

Data Management and Analysis: The Challenge of Interpretation

With such a wealth of data collected, managing and analyzing the information presents its own set of challenges. Hughes acknowledges, “It’s gotten a little easier over the years, but it’s still a lot of data crunching.”

For survey data, HCA utilizes a specialized tool that feeds responses directly into a database for analysis. However, the interview data requires a more nuanced approach. “The hardest part of that is just interpreting what you hear and putting it in the right bucket and classifying it properly and making sure that you’re interpreting what they’re telling you properly,” Hughes explains.

This careful interpretation and classification process is crucial for translating raw interview data into actionable risk insights.

Key Takeaways for Implementing Interview-Based Risk Identification

Based on HCA’s experience, organizations looking to implement or improve their interview-based risk identification process should consider the following:

1. Start Small and Expand: Begin with a core group of executives and key managers, then gradually expand the process as it proves valuable.
2. Keep Questions Simple and Consistent: Focus on a few key questions that directly address risk identification and mitigation.
3. Align with Strategic Planning: Time the risk identification process to feed directly into strategic planning and budgeting cycles.
4. Use a Two-Person Interview Team: This approach ensures accurate capture of information and allows for real-time clarification of responses.
5. Complement Interviews with Surveys: Use surveys to gather a broader range of perspectives beyond those captured in interviews.
6. Invest in Data Management: Develop robust systems for managing and analyzing the wealth of data collected through interviews and surveys.
7. Focus on Interpretation: Recognize that the value of the process lies not just in data collection, but in the careful interpretation and classification of the information gathered.

Conclusion: The Power of Structured Conversations in Risk Identification

HCA’s approach to risk identification through structured interviews demonstrates the power of direct, focused conversations in uncovering potential risks across an organization. By systematically engaging stakeholders at all levels, from the boardroom to individual facilities, HCA has developed a comprehensive view of its risk landscape that directly informs strategic decision-making.

For organizations looking to enhance their ERM processes, the interview-based approach used by HCA offers a valuable model that can be adapted to various industries and company sizes. By fostering open discussions about risk and linking these insights directly to strategic planning, companies can build a more resilient and risk-aware culture.

As David Hughes’s insights show, the key to success lies not just in asking the right questions, but in creating a systematic process for gathering, interpreting, and acting upon the wealth of risk knowledge that exists within an organization.

Download a transcript of the conversation here.