Important ASHRM CPHRM Exam Questions

Answer: D

Explanation:

According to Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, a culture of safety is grounded in open communication, transparency, and shared accountability. An essential element of safety culture is the expectation that all staff members feel empowered and psychologically safe to speak up about concerns, near misses, unsafe conditions, or potential errors without fear of retaliation.

Speaking up supports early identification of risks and fosters continuous improvement. It aligns with just culture principles, which distinguish between human error, at-risk behavior, and reckless conduct, promoting learning rather than automatic punishment. Encouraging staff to voice concerns strengthens teamwork, situational awareness, and patient-centered care.

While trending occurrences is an important analytical tool for quality improvement, it is a process measure rather than a core cultural principle. Disciplining employees and assigning blame, when applied indiscriminately, undermine trust and discourage reporting, thereby weakening safety culture.

Clinical and patient safety objectives emphasize communication, accountability, and nonpunitive reporting environments. Therefore, speaking up is integral to supporting and sustaining a safety culture within a healthcare organization.

Answer: C

Explanation:

According to Health Care Risk Management principles supported by ASHRM and the American Hospital Association Certification Center, insurance coverage for liability exposures is often structured in layers. The first layer of insurance that responds to a covered loss is known as the primary policy.

Primary insurance provides initial coverage once any applicable deductible or self-insured retention has been satisfied. It is responsible for defense and indemnity payments up to the policy's stated per-occurrence and aggregate limits. Only after the primary policy limits are exhausted do excess or umbrella policies respond.

Terms such as baseline, foundation, and frontline are not recognized technical classifications in layered insurance structures. In professional and general liability programs, organizations commonly maintain a primary layer followed by one or more excess layers to protect against catastrophic losses.

Risk financing objectives emphasize understanding policy structure, limits, attachment points, and coordination between layers to ensure adequate protection of organizational assets. Therefore, the correct term for the first layer of insurance that responds to a loss is the primary policy.

Answer: D

Explanation:

Under Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, the implantation of a medical device that lacks FDA approval and Institutional Review Board oversight presents significant legal and regulatory violations. Use of an unapproved device outside of an approved investigational protocol may violate federal regulations governing human subject research and medical device approval processes.

The risk manager's primary responsibility is to immediately mitigate regulatory and liability exposure. Because the procedure is scheduled for the next day, urgent intervention is required. Contacting the FDA would not resolve the immediate risk. Verifying informed consent is insufficient, as patient consent cannot legitimize use of an unapproved device outside regulatory pathways. Calling a special IRB meeting would not retroactively authorize an unapproved device without appropriate investigational device exemption processes.

Escalating the issue to the chief of surgery to halt or cancel the procedure is the most appropriate immediate step. This ensures that organizational leadership addresses the compliance violation before patient harm occurs. Risk management objectives emphasize proactive prevention of regulatory breaches, protection of patient safety, and preservation of institutional integrity. Therefore, stopping the procedure is the correct and immediate action.

Answer: A

Explanation:

According to Health Care Risk Management standards outlined by ASHRM and the American Hospital Association Certification Center, the governing board has ultimate responsibility for organizational oversight, quality of care, and patient safety. As part of its fiduciary and governance duties, the board approves high-level policies that establish the organization's philosophy, strategic direction, and commitment to safety and risk management.

A philosophy regarding medical error management reflects the organization's approach to disclosure, reporting, just culture principles, accountability, and system improvement. Because this philosophy sets the tone for organizational culture and impacts patient safety, legal exposure, and regulatory compliance, it requires board-level approval to ensure alignment with governance expectations and accreditation standards.

In contrast, the risk management department's annual budget is typically approved through financial governance processes rather than as a policy document. Risk analyses are operational tools conducted by management and do not require board approval. Departmental personnel job descriptions are administrative documents managed at the executive or human resources level.

Health Care Operations objectives emphasize board engagement in safety culture and oversight of enterprise risk management. Therefore, the philosophy regarding medical error management should be approved by the organization's board of directors.

Answer: B

Explanation:

According to Health Care Risk Management standards endorsed by ASHRM and the American Hospital Association Certification Center, a risk manager's role in community disaster preparedness extends beyond narrow liability analysis. The appropriate scope involves integration of emergency management into the organization's broader enterprise risk management framework.

Enterprise risk management ERM is a structured, organization-wide approach to identifying, assessing, and managing risks that may affect strategic objectives, operations, financial stability, and reputation. Disaster preparedness is a critical operational risk that must be aligned with governance, compliance, continuity planning, and asset protection strategies. By incorporating emergency management into ERM, the risk manager ensures coordination across clinical services, facilities, supply chain, communications, and leadership structures.

Option A focuses only on post-event liability. Option C limits involvement to quantification without strategic integration. Option D addresses reimbursement processes rather than preparedness strategy.

Health Care Operations objectives emphasize collaboration with emergency management teams, regulatory compliance with preparedness standards, and resilience planning to protect patients, staff, and assets. Therefore, integrating emergency management into a comprehensive enterprise risk management plan best defines the risk manager's appropriate scope of involvement.