Certified Professional in Healthcare Risk Management
(CPHRM®) Exam 2026 Latest Comprehensive Study Guide
with Practice Questions Risk Management Review —
Detailed Rationales, Verified Answers, Success Workbook
DOMAIN 1: CLINICAL/PATIENT SAFETY (25%)
Question 1
A hospital is implementing a patient safety program. According to the Institute of
Medicine (IOM), which of the following is a core principle for building a safer
health system?
A) Punishing individuals who make errors
B) Designing systems to prevent errors and making it hard for people to do
the wrong thing
C) Relying solely on individual vigilance
D) Focusing only on adverse events that cause harm
Rationale: The IOM's landmark report "To Err Is Human" emphasized
that systems design — not individual blame — is the foundation of patient safety.
Safe systems are designed to prevent errors and make it difficult for individuals
to make mistakes. This principle underlies all modern patient safety initiatives.
Question 2
A risk manager is investigating a patient fall that resulted in a hip fracture. What is
the FIRST step in conducting a Root Cause Analysis (RCA)?
A) Implement corrective actions immediately
B) Assemble a multidisciplinary team and gather all relevant information
about the event
C) Assign blame to the staff involved
D) Notify the patient's family
Rationale: The first step in an RCA is to assemble a multidisciplinary
team and gather all relevant information about the event, including interviews,
chart reviews, and equipment inspections. Corrective actions should only be
,implemented after the analysis is complete. RCAs are designed to identify system
factors, not assign individual blame.
Question 3
Which of the following best describes the concept of a "Just Culture" in
healthcare?
A) A culture where all errors are excused
B) A culture that balances accountability with a non-punitive approach to
learning from errors
C) A culture where individuals are punished for all errors
D) A culture where errors are ignored
Rationale: A Just Culture balances accountability with a non-punitive
approach to errors. It distinguishes between human error (system redesign), at-risk
behavior (coaching), and reckless behavior (disciplinary action). This approach
encourages reporting and learning while maintaining appropriate accountability for
reckless behavior.
Question 4
A risk manager is facilitating a disclosure conversation with a patient after a
medication error caused harm. According to best practices, what should be
included in the disclosure?
A) Only the facts, without any apology
B) Acknowledgment of the event, an expression of regret, an explanation of
what happened, and a plan for preventing recurrence
C) A statement that the error was the nurse's fault
D) A promise that the error will never happen again
Rationale: Best practices for disclosure include: acknowledgment of the
event, expression of regret or apology, explanation of what happened (to the
extent known), and a plan for preventing recurrence. Full disclosure builds trust
and is supported by risk management and ethical standards.
,Question 5
A risk manager is implementing a new patient safety initiative. Which of the
following is a key component of a patient safety culture?
A) Blaming individuals for errors
B) Encouraging reporting of errors and near misses without fear of
punishment
C) Keeping error reports confidential from all staff
D) Focusing only on sentinel events
Rationale: A strong patient safety culture encourages reporting of errors and
near misses without fear of punishment. This reporting enables organizations to
identify and address system vulnerabilities before they cause harm. Fear of
punishment leads to underreporting and missed learning opportunities.
Question 6
What is the primary purpose of a Failure Mode and Effects Analysis (FMEA) in
healthcare?
A) To investigate an adverse event that has already occurred
B) To proactively identify potential failures in a process before they occur
C) To assign blame for errors
D) To document patient complaints
Rationale: FMEA is a proactive risk assessment tool used to identify potential
failures in a process before they occur. It contrasts with RCA, which is reactive
(investigating events that have already occurred). FMEA helps organizations
prevent errors by redesigning processes.
Question 7
A patient develops a pressure injury during a hospital stay. Which of the following
is the MOST appropriate risk management response?
A) Ignore the injury as an expected complication
B) Investigate the cause, document the injury, implement preventive
measures, and consider disclosure to the patient
C) Blame the nursing staff
D) Discharge the patient immediately
, Rationale: Pressure injuries are often preventable and may represent a quality-of-
care issue. The risk manager should investigate the cause, document the
injury, implement preventive measures, and consider disclosure to the patient.
This approach addresses both patient safety and potential liability.
Question 8
A risk manager is reviewing the hospital's informed consent process. Which of the
following is an essential element of valid informed consent?
A) The patient signs the form without reading it
B) The patient receives information about the procedure, risks, benefits, and
alternatives, and demonstrates understanding
C) The physician alone determines what information to share
D) The consent form is signed after the procedure
Rationale: Valid informed consent requires that the patient receives information
about the procedure, risks, benefits, and alternatives, and demonstrates
understanding of this information. Informed consent is a process, not just a signed
form, and must occur before the procedure.
Question 9
A risk manager is analyzing medication error data. Which of the following is a
common contributing factor to medication errors?
A) Adequate staffing levels
B) Look-alike, sound-alike (LASA) drug names
C) Clear communication among staff
D) Well-designed medication storage systems
Rationale: Look-alike, sound-alike (LASA) drug names are a common
contributing factor to medication errors. Examples include
hydralazine/hydroxyzine and Celebrex/Celexa. Risk managers should implement
strategies to reduce LASA errors, such as tall-man lettering and computerized
provider order entry (CPOE).
(CPHRM®) Exam 2026 Latest Comprehensive Study Guide
with Practice Questions Risk Management Review —
Detailed Rationales, Verified Answers, Success Workbook
DOMAIN 1: CLINICAL/PATIENT SAFETY (25%)
Question 1
A hospital is implementing a patient safety program. According to the Institute of
Medicine (IOM), which of the following is a core principle for building a safer
health system?
A) Punishing individuals who make errors
B) Designing systems to prevent errors and making it hard for people to do
the wrong thing
C) Relying solely on individual vigilance
D) Focusing only on adverse events that cause harm
Rationale: The IOM's landmark report "To Err Is Human" emphasized
that systems design — not individual blame — is the foundation of patient safety.
Safe systems are designed to prevent errors and make it difficult for individuals
to make mistakes. This principle underlies all modern patient safety initiatives.
Question 2
A risk manager is investigating a patient fall that resulted in a hip fracture. What is
the FIRST step in conducting a Root Cause Analysis (RCA)?
A) Implement corrective actions immediately
B) Assemble a multidisciplinary team and gather all relevant information
about the event
C) Assign blame to the staff involved
D) Notify the patient's family
Rationale: The first step in an RCA is to assemble a multidisciplinary
team and gather all relevant information about the event, including interviews,
chart reviews, and equipment inspections. Corrective actions should only be
,implemented after the analysis is complete. RCAs are designed to identify system
factors, not assign individual blame.
Question 3
Which of the following best describes the concept of a "Just Culture" in
healthcare?
A) A culture where all errors are excused
B) A culture that balances accountability with a non-punitive approach to
learning from errors
C) A culture where individuals are punished for all errors
D) A culture where errors are ignored
Rationale: A Just Culture balances accountability with a non-punitive
approach to errors. It distinguishes between human error (system redesign), at-risk
behavior (coaching), and reckless behavior (disciplinary action). This approach
encourages reporting and learning while maintaining appropriate accountability for
reckless behavior.
Question 4
A risk manager is facilitating a disclosure conversation with a patient after a
medication error caused harm. According to best practices, what should be
included in the disclosure?
A) Only the facts, without any apology
B) Acknowledgment of the event, an expression of regret, an explanation of
what happened, and a plan for preventing recurrence
C) A statement that the error was the nurse's fault
D) A promise that the error will never happen again
Rationale: Best practices for disclosure include: acknowledgment of the
event, expression of regret or apology, explanation of what happened (to the
extent known), and a plan for preventing recurrence. Full disclosure builds trust
and is supported by risk management and ethical standards.
,Question 5
A risk manager is implementing a new patient safety initiative. Which of the
following is a key component of a patient safety culture?
A) Blaming individuals for errors
B) Encouraging reporting of errors and near misses without fear of
punishment
C) Keeping error reports confidential from all staff
D) Focusing only on sentinel events
Rationale: A strong patient safety culture encourages reporting of errors and
near misses without fear of punishment. This reporting enables organizations to
identify and address system vulnerabilities before they cause harm. Fear of
punishment leads to underreporting and missed learning opportunities.
Question 6
What is the primary purpose of a Failure Mode and Effects Analysis (FMEA) in
healthcare?
A) To investigate an adverse event that has already occurred
B) To proactively identify potential failures in a process before they occur
C) To assign blame for errors
D) To document patient complaints
Rationale: FMEA is a proactive risk assessment tool used to identify potential
failures in a process before they occur. It contrasts with RCA, which is reactive
(investigating events that have already occurred). FMEA helps organizations
prevent errors by redesigning processes.
Question 7
A patient develops a pressure injury during a hospital stay. Which of the following
is the MOST appropriate risk management response?
A) Ignore the injury as an expected complication
B) Investigate the cause, document the injury, implement preventive
measures, and consider disclosure to the patient
C) Blame the nursing staff
D) Discharge the patient immediately
, Rationale: Pressure injuries are often preventable and may represent a quality-of-
care issue. The risk manager should investigate the cause, document the
injury, implement preventive measures, and consider disclosure to the patient.
This approach addresses both patient safety and potential liability.
Question 8
A risk manager is reviewing the hospital's informed consent process. Which of the
following is an essential element of valid informed consent?
A) The patient signs the form without reading it
B) The patient receives information about the procedure, risks, benefits, and
alternatives, and demonstrates understanding
C) The physician alone determines what information to share
D) The consent form is signed after the procedure
Rationale: Valid informed consent requires that the patient receives information
about the procedure, risks, benefits, and alternatives, and demonstrates
understanding of this information. Informed consent is a process, not just a signed
form, and must occur before the procedure.
Question 9
A risk manager is analyzing medication error data. Which of the following is a
common contributing factor to medication errors?
A) Adequate staffing levels
B) Look-alike, sound-alike (LASA) drug names
C) Clear communication among staff
D) Well-designed medication storage systems
Rationale: Look-alike, sound-alike (LASA) drug names are a common
contributing factor to medication errors. Examples include
hydralazine/hydroxyzine and Celebrex/Celexa. Risk managers should implement
strategies to reduce LASA errors, such as tall-man lettering and computerized
provider order entry (CPOE).
