In module 1 and 2 we described how to prepare the introduction of risk management and what needs to be considered when defining a risk management strategy.

This module is all about how to identify and collect risks when looking for the first time at a specific treatment process. We cover only the initial risk identification procedure here. As you will see this is quite an extensive procedure, but needs to be performed only once. The re-assessment of the risks will be less time consuming, more details about this in module 6.

Start easy and pick a simple and well known treatment process

To keep the focus on the task to identify and collect risks, ask the group to choose a well-known and simple routine treatment. If you start with a complex process or one still to be implemented, people get easily stuck discussing the process in itself. This discussion are often endless. Your meeting is over and the chance is people will feel frustrated.
Choose one collectively and then get straight to it. Don’t read standing operating procedures in the meeting or look at complex process visualisation files. Start to brainstorm on what could go possibly wrong.

Ask: “what could possibly go wrong?”

The best way to get all involved and spark a lively discussion is to brainstorm. Brainstorming is not about right or wrong or good or bad. It is to share experiences and ideas and build on each other’s answers .
Some contributions may seem surprising or even out of place, but often exactly this contributions will spark important others.
Start sharing what comes to mind and make sure everybody’s opinion is known. If moderated right brainstorming helps to change the group into a team. Everybody can contribute. Shared questions and ideas getting discovered. Input created for further discussion over lunch or at the coffee machine

Brainstorming rules adapted for risk management:

  1. Don’t judge contributions.
  2. Encourage “wild” contributions.
  3. Build on the contributions of others.
  4. Stay focused on the risk identification.
  5. One conversation at a time.
  6. Go for quantity.

It is important for you as a moderator to bring the group every time they divert back to the task to identify risks. It helps to “park” all topics not related to identifying risks on a dedicated page in the app. So you can ensure nothing gets lost. The ones about risk analysis and rating will come handy later. We will discuss this in the next module.

We often get the question why we don’t recommend to display the treatment process and identify risks following the process step by step
in an Failure Modes and Effects Analysis (FMEA) like manner. First, you have to have something to display and second, how do you ensure you present the right amount of details? An important but tricky question. Too many details and you will lose people, because it feels overwhelming, but too little the whole effort becomes meaningless.

What is then the best level of details? Brainstorming will deliver the right level of details. The list of the identified risk is exactly the level of detail the group can handle right now. Maybe a sub-step and its related risks is overseen, but don’t forget you can always add and remove from the list. Risk management may not be a one-time effort, but a continuous agile one.

Collect so many risks as possible

Don’t start analyzing the risks yet. We will talk about analysing and mitigating risks in module 4. For now keep collecting until nobody comes up with more. Don’t worry about not having collected all possible risks. Additional risks can always be added later in one of the regular risk management meetings or in between the meetings by sharing them online. You should supports collaborative working by giving people easy access to documents and inform the others that risks have been added.

Time is a scares resource. A tool designed for collaborative and transparent working helps to work effectively. One example is, that after the initial risk identification effort of the complete team, smaller task groups could continue to identify risks in their area of special expertise e.g. treatment delivery, planning, data transfer. At the next team meeting they are reviewed and discussed.

Record the answers

Write down all the risks the group comes up with. Project what you type. In this way ambiguities can be clarified and misunderstandings removed. If you are using our app, take the Essential Risk Identification Tree which is designed to allow quick input and sorting the risks into groups. The groups will represent process steps. Similar what is done in sticky notes brainstorming. For example somebody says: “error in dose calculation” and you add this into the risk identification tree. The brainstorming continues and you continue to record “really bad beam modelling”, “wrong parameter selected”. You can group these risks for example under “calculate dose to optimization points and dose distribution”. The example is taken from the AAPM TG100 report. The image below shows a part of our app’s risk identification tree based on TG100 report.

Based on TG100 report

The resulting structure will represent the actual treatment process. Even if you started the brainstorming without any process displayed.

A nice bonus is that you get a quality check of your quality documentation for free. You can compare the process based on the identified risks with the one defined in your quality documentation.


  1. Explain brainstorm rules
  2. Project risk identification tree
  3. Record risks
  4. Structure risks