CPHRM ASHRM Certified Professional in Health Care Risk Management (CPHRM) Free Practice Exam Questions (2026 Updated)

According to Health Care Risk Management principles endorsed by ASHRM and the American Hospital Association Certification Center, the effectiveness of an educational program is best measured by demonstrated changes in behavior rather than by subjective or indirect outcomes. Educational initiatives in healthcare risk management aim to improve compliance, enhance patient safety practices, and modify unsafe behaviors.

Analysis of written evaluations primarily reflects participant satisfaction and perceived value of the program, but does not confirm that learning objectives were achieved or that behaviors changed. Reductions in claim frequency or severity are important organizational outcomes; however, these are influenced by multiple variables beyond education alone, including patient volume, case complexity, legal climate, and system-level interventions. Therefore, claims data are indirect and delayed measures.

Observable changes in human behavior, such as improved adherence to safety protocols, increased incident reporting, or consistent compliance with documentation standards, provide direct evidence that learning has translated into practice. Risk management objectives emphasize measurable performance improvement, competency validation, and alignment with patient safety goals.

Thus, observable behavioral change is the most reliable and immediate indicator that an educational program has achieved its intended effect.

Inpatient suicide prevention is a high-stakes patient safety domain where RCAs frequently identifyenvironmental hazards—particularly ligature risks, blind spots, and unit design that limits observation. Joint Commission–style reviews and published analyses note that thephysical environmentis commonly “incriminated” in inpatient suicides, emphasizing design/engineering controls alongside clinical monitoring. Risk management objectives prioritize layered defenses: ligature-resistant fixtures, environmental rounding, safe room standards, removal control for risky items, and observation policies matched to patient risk. Environmental mitigation is especially powerful because it reduces reliance on perfect human vigilance (which is not realistic). By treating suicide prevention as a systems problem—not an individual failure—organizations improve reliability and reduce recurrence. Environmental corrections also strengthen regulatory readiness and demonstrate that the facility addressed known hazards with sustainable controls.

According to Health Care Risk Management standards outlined by ASHRM and the American Hospital Association Certification Center, the Occupational Safety and Health Act includes a provision known as the General Duty Clause. This clause requires employers to furnish a workplace free from recognized hazards that are causing or are likely to cause death or serious physical harm, even when no specific OSHA standard addresses the hazard.

The General Duty Clause grants OSHA authority to cite employers for unsafe conditions not explicitly covered by a detailed regulation. To issue a citation under this clause, OSHA must demonstrate that a recognized hazard exists, that the hazard poses a risk of serious harm, and that feasible methods exist to correct or mitigate the hazard.

Therefore, OSHA retains enforcement authority even in the absence of a specific standard. The agency’s jurisdiction does not disappear simply because no detailed regulation addresses the particular risk.

Legal and regulatory objectives in healthcare risk management emphasize maintaining compliance with federal occupational safety laws and proactively identifying workplace hazards. Accordingly, OSHA may govern the hazard under the General Duty Clause when no specific standard applies.

Within Health Care Risk Management practice as outlined by ASHRM and the American Hospital Association Certification Center, establishing an accurate loss reserve requires an estimation of the probable financial exposure associated with a claim. A loss reserve represents the anticipated cost to resolve a claim, including indemnity payments and defense expenses.

Comparable verdicts in the county are particularly useful because they reflect jurisdiction-specific jury tendencies, local legal climate, and historical award patterns. Venue significantly influences claim valuation, as jury awards can vary substantially between counties and states. Reviewing similar case outcomes allows the claims manager to benchmark potential settlement or verdict ranges based on injury severity and liability factors.

The surgery center’s claims history may inform overall risk trends but does not directly determine the value of a specific claim. The patient’s total medical bills are relevant but represent only one component of damages and do not account for non-economic damages such as pain and suffering. The insurance limit per occurrence defines maximum exposure but does not guide the realistic reserve estimate unless damages approach policy limits.

Therefore, analysis of comparable local verdicts is most helpful in establishing an appropriate and defensible loss reserve.

Under Health Care Risk Management principles established by ASHRM and the American Hospital Association Certification Center, timely notice to a malpractice carrier is a critical obligation, particularly under claims-made policies. A demand letter from a patient constitutes a clear assertion of liability and a request for compensation, which typically meets the definition of a claim under most malpractice insurance policies. Failure to notify the carrier promptly may jeopardize coverage.

A written medical record request from an attorney may signal potential litigation, but it does not necessarily constitute a claim unless accompanied by an allegation of wrongdoing or a demand for damages. An internal incident report is a risk management tool used for quality and safety improvement and does not itself trigger insurance notification requirements. Similarly, disclosure to a patient regarding an adverse event aligns with transparency practices but does not automatically represent a formal claim.

Risk management objectives emphasize understanding policy language, particularly definitions of claim and reporting requirements. Because a demand letter explicitly alleges harm and seeks compensation, it most clearly triggers the duty to notify the malpractice carrier to preserve coverage and initiate appropriate claims handling procedures.

Under Health Care Risk Management standards aligned with ASHRM and the American Hospital Association Certification Center, employment interview questions must comply with federal and state anti-discrimination laws, including the Americans with Disabilities Act ADA, Title VII of the Civil Rights Act, the Pregnancy Discrimination Act, and the Immigration Reform and Control Act.

Questions about prescription medications may violate ADA provisions by eliciting information about potential disabilities prior to a conditional offer of employment. Asking whether a candidate plans to have children may constitute unlawful discrimination based on sex or family status. Inquiring directly about citizenship may violate federal employment eligibility standards; employers may instead ask whether the applicant is legally authorized to work in the United States.

In contrast, asking whether a candidate can meet the organization’s attendance requirements is permissible because it relates directly to essential job functions and business necessity. Employers may inquire about the ability to perform job-related duties, provided questions are applied consistently to all applicants and are not designed to screen out protected classes.

Legal and regulatory objectives emphasize nondiscriminatory hiring practices and adherence to equal employment laws. Therefore, questions regarding attendance requirements are appropriate in a job interview setting.

According to Health Care Risk Management principles outlined by ASHRM and the American Hospital Association Certification Center, high-quality clinical documentation is critical in defending malpractice claims. The medical record serves as the primary evidence of care provided and reflects whether the standard of care was met.

Documentation that clearly describes the provider’s clinical decision-making process is particularly valuable in litigation. It demonstrates assessment findings, differential diagnoses, rationale for chosen interventions, informed consent discussions, and follow-up plans. Thorough documentation provides objective support for clinical judgments and establishes a defensible narrative of care.

Subjective or disparaging comments about the patient can undermine credibility and may be harmful in court. Complete and timely documentation is essential; delayed or incomplete entries may suggest negligence or alteration. Additionally, documentation remains important regardless of when a claim arises, as statutes of limitation may allow claims to be filed years after the event, especially in cases involving minors or discovery rules.

Claims and litigation objectives emphasize accurate, objective, and contemporaneous recordkeeping to reduce liability exposure. Therefore, documentation that clearly outlines the provider’s clinical reasoning best assists in defending a malpractice claim.

Healthcare contracting is a risk control tool. Core terms include effective date, scope, responsibilities, performance standards, indemnification, andinsurance requirements(limits, additional insured, notice of cancellation). Clear terms reduce disputes, clarify liability allocation, and strengthen compliance (HIPAA BAAs, data security, subcontractor controls). Risk management objectives focus on preventing uninsured exposures and ensuring vendors meet safety, credentialing, and regulatory requirements—especially for clinical services, technology, and facility operations.

According to Health Care Risk Management standards supported by ASHRM and enterprise risk management ERM principles, external factors include conditions outside the direct control of the organization that influence strategic, operational, financial, and regulatory risk exposures.

A physician shortage is an external workforce market condition that can affect staffing stability, access to care, and malpractice exposure. New regulations are also external factors, as legislative or regulatory changes may alter compliance requirements, reimbursement structures, or reporting obligations. Similarly, soft insurance market trends reflect external economic and underwriting environments that influence premium pricing, availability of coverage, and risk financing strategy.

Resolution of claims, however, is generally an internal operational or claims management outcome. While influenced by external legal environments, the resolution process itself is primarily part of internal risk management and litigation strategy rather than a broad external environmental factor.

ERM objectives emphasize analysis of external environmental drivers, including regulatory, workforce, economic, and market conditions. Therefore, physician shortages, new regulations, and soft insurance market trends are external factors affecting risk, while resolution of claims is not primarily classified as external.

According to Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, The Joint Commission’s sentinel event policy requires organizations to complete a thorough root cause analysis and develop an action plan within 45 days of becoming aware of the sentinel event.

The root cause analysis must identify underlying system failures and contributing factors rather than focusing solely on individual performance. The resulting action plan must outline specific corrective measures, assign responsibility, establish implementation timelines, and include mechanisms to monitor effectiveness. The emphasis is on sustainable system improvement to reduce the likelihood of recurrence.

Failure to complete the analysis and action plan within the required timeframe may result in additional review, accreditation consequences, or other follow-up actions by The Joint Commission. Timely completion demonstrates organizational accountability, leadership oversight, and commitment to patient safety.

Clinical and patient safety objectives emphasize structured investigation processes, documentation of corrective actions, and alignment with accreditation standards. Therefore, the required timeframe for completion of the root cause analysis and action plan following awareness of a sentinel event is 45 days.

According to Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, projecting contributions to a self-insured retention fund requires actuarially sound financial forecasting. Actuarial reports use historical claims data, trend analyses, loss development factors, and exposure projections to estimate future liabilities and required funding levels. Loss run reports provide detailed historical claims information, including paid losses, reserves, and claim status, which serve as foundational data for actuarial modeling.

Professional and general liability premiums are relevant to insured layers above the retention but do not determine funding requirements for the retained portion. Frequency and severity analyses of pending claims are important components of actuarial evaluation but, standing alone, may not capture long-tail development or incurred but not reported claims. Total incurred losses for the current year provide limited insight without considering historical patterns and future projections.

Risk financing objectives emphasize accurate funding of retained risk to ensure financial stability, regulatory compliance, and protection of organizational assets. Therefore, actuarial reports, supported by comprehensive loss run data, provide the most reliable basis for determining projected contributions to a self-insured retention fund.

Modern communication-and-resolution programs emphasize early, honest communication with patients/families after harm, including a timely explanation of what is known, an authentic expression of empathy and apology, and a commitment to investigate and prevent recurrence. This approach supports core risk management objectives: preserve trust, reduce emotional harm, strengthen transparency, and improve learning. Evidence-based disclosure models link timely communication and apology with improved patient experience and, in some programs, fewer claims and lower litigation costs—especially when paired with strong investigation and corrective action. Importantly, organizations should coordinate disclosure through trained coaches and follow local policy and state apology protections. The purpose is not to “admit fault prematurely,” but to communicate responsibly, support patients, and demonstrate accountability and improvement.

Failure Mode and Effects Analysis FMEA is the most appropriate tool in this scenario because it is a proactive risk assessment methodology designed to identify and mitigate potential failures before harm occurs. According to Health Care Risk Management principles outlined by ASHRM and the American Hospital Association Certification Center, FMEA is specifically used when introducing new processes, services, or high-risk clinical operations, such as an anticoagulation clinic involving medications with narrow therapeutic indices and significant bleeding risks.

FMEA systematically evaluates each step in a proposed process, identifies possible failure modes, analyzes their causes and effects, and prioritizes risks using severity, occurrence, and detectability scoring. This structured approach aligns with patient safety objectives by reducing preventable adverse events before implementation.

In contrast, Root Cause Analysis RCA is a retrospective tool used after an adverse event has occurred. A cause and effect diagram is a component often used within RCA or FMEA but is not a comprehensive risk assessment tool on its own. A scatter diagram is primarily used for statistical correlation analysis and does not evaluate process failures.

Therefore, for proactive risk identification and mitigation prior to clinic opening, FMEA is the best and most appropriate tool.

Effective risk management requires more than tools—it needs organizational commitment (tone at the top), operational visibility (access to events, leaders, data), and physician engagement because many high-severity risks involve medical decision-making and clinical leadership. Risk management objectives include preventing harm (patient safety), reducing financial loss (claims and insurance costs), ensuring compliance, and building a learning culture. Without executive and board support, corrective actions stall; without visibility, emerging risks are missed; without physician buy-in, clinical process redesign fails. Successful programs integrate with quality, patient safety, compliance, legal, and operations, and they use structured methods (RCA/FMEA, audits, claims trend analysis) to drive measurable improvement. This also strengthens defensibility: it shows governance, action, and continuous improvement—key elements in regulatory review and litigation.