Free Practice Questions for ASHRM CPHRM Exam

According to Health Care Risk Management standards outlined by ASHRM and the American Hospital Association Certification Center, claim files must be carefully structured to preserve confidentiality, protect privilege, and support effective defense strategy. A claim file typically includes correspondence with attorneys and investigators, as this documentation reflects legal strategy, communications, and case development. Literature searches relevant to standards of care may also be included to assist counsel in evaluating clinical issues and expert testimony preparation. Verification of settlement authority is essential documentation to confirm that appropriate approvals were obtained before resolving a claim.

Peer review reports or data, however, should not be included in the claim file. Peer review materials are generally protected under state peer review statutes and federal patient safety privilege provisions. Commingling peer review documents within the claims file may jeopardize privilege protections and increase the risk of discoverability in litigation. Maintaining separation between peer review files and claim files is a critical risk management practice.

Claims and litigation objectives emphasize preservation of privilege, organized documentation, and compliance with legal standards. Therefore, correspondence, literature searches, and settlement authority verification belong in the claim file, while peer review reports should be maintained separately.

Multiple studies showphysicians report fewer incidentsthan nurses and other hospital staff in many voluntary reporting systems, influenced by cultural norms, fear of blame, time constraints, and preference to manage issues “in-house.” This matters because underreporting distorts risk signals: leadership may miss trends in diagnostic delays, handoff failures, and near-misses that physicians uniquely observe. Risk management objectives therefore focus on reducing barriers: simplifying reporting, enabling quick mobile submissions, emphasizing psychological safety, and providing credible feedback that reporting leads to improvement (not punishment). Another proven strategy is integrating reporting into professional practice expectations and aligning medical leadership with “just culture” principles. Increasing physician reporting improves system learning, strengthens peer review insight, and supports defensibility by showing hazards were identified and addressed.

Under Health Care Risk Management principles supported by ASHRM and the American Hospital Association Certification Center, the insurance application is the primary document used by an underwriter to evaluate risk and generate a premium quote. The application provides detailed information about the organization’s operations, services, patient volume, claims history, risk control measures, governance structure, and prior insurance coverage. This information enables the underwriter to assess exposure, determine eligibility, and calculate appropriate pricing and coverage terms.

A certificate of insurance is issued after a policy is in force to verify coverage to third parties and does not serve as a quoting document. The declaration page is part of an existing insurance policy and summarizes coverage limits, deductibles, and endorsements; it reflects finalized terms rather than information used to generate a quote. A certificate of need is a regulatory document related to state approval of healthcare facilities or services and is unrelated to underwriting.

Risk financing objectives emphasize accurate disclosure and thorough completion of insurance applications, as misrepresentation or omission may affect coverage validity. Therefore, the application is the document used by an underwriter to provide an insurance quote.

Telemedicine licensure is largely state-based in the U.S., and many states require the consulting clinician to be licensed in the state where the patient is located (with exceptions such as specific compacts, special telehealth registrations, or emergency provisions). Risk management objectives include verifying licensure/credentialing before services, ensuring privileging-by-proxy processes where applicable, confirming malpractice coverage for telehealth and cross-state practice, and ensuring informed consent/privacy safeguards. Failure to comply can trigger regulatory penalties, payer issues, and liability exposure if care is delivered without proper authorization.

Boards are ultimately accountable for oversight of organizational risk, including patient safety, quality, compliance, and financial sustainability. While executives and risk leaders manage day-to-day operations, board governance sets expectations, ensures resources, monitors performance, and holds leadership accountable for corrective action. Risk management objectives at the governance level include approving risk appetite, reviewing top enterprise risks, ensuring systems exist for event reporting and learning, and verifying that mitigation plans are implemented and effective. In litigation and regulatory scrutiny, board oversight can be a critical factor: a board that demands transparency, tracks harm signals, and supports safety investment strengthens the organization’s defensibility and reduces preventable harm.

RCA and systems safety models (e.g., Swiss Cheese) emphasize that adverse events typically requiremultiple contributing factors—small process breakdowns, latent conditions, and active failures—to align. This is why focusing only on the last person who touched the patient (“sharp end blame”) rarely prevents recurrence. Risk management objectives are to identify and strengthen defenses: policies, training, equipment design, staffing models, communication standards, and redundancy where needed. A series-of-events understanding enables targeted corrective actions (forcing functions, standardization, automation with safeguards, independent double checks for high-alert processes). It also supports just culture: accountability is preserved for reckless behavior, but most improvement comes from redesigning systems that make errors more likely. This approach improves reliability, reduces repeat harm, and provides defensible evidence of organizational learning and corrective action.

According to Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, periodic review of policies and procedures is essential to ensure alignment with current laws, regulatory standards, accreditation requirements, and best practices. Reviewing policies helps ensure consistency between written procedures and actual clinical practice, thereby reducing liability exposure.

Policy review also supports identification of potential risk exposures by detecting outdated language, conflicting guidance, or gaps in processes that could lead to adverse events. Additionally, monitoring compliance with standards—such as federal regulations, state statutes, and accreditation requirements—is a central purpose of policy review, ensuring that organizational practices meet required benchmarks.

Maintaining staff competency, however, is primarily addressed through education, training programs, credentialing, and performance evaluation processes. While policies provide guidance for staff conduct, competency assessment is not the primary objective of policy review itself.

Health Care Operations objectives emphasize governance oversight, regulatory compliance, and risk mitigation through clear, current policies. Therefore, maintaining staff competency is not a direct reason for performing risk management review of policies and procedures, making it the correct exception.

Wrong-site surgery is a high-severity, preventable event. Joint Commission analyses repeatedly identifycommunication failuresas a leading root cause—breakdowns in scheduling, consent/site verification, handoffs, and intraoperative confirmation. Risk management objectives therefore emphasize standardized verification systems: correct patient/procedure/site documentation, pre-op verification, surgical site marking, and a robust time-out performed with full team engagement. Communication failures can include ambiguous documentation, incorrect or incomplete handoff information, and hierarchy barriers that prevent speaking up. Improving communication reduces reliance on memory and individual vigilance and increases system reliability. In addition, organizations must audit compliance, address workarounds, and strengthen team empowerment so any member can stop the line if a mismatch is detected.

According to Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, coverage determination depends on both the policy trigger and relevant dates. The alleged negligence occurred on September 5, 2003. Under an occurrence policy in effect from 1/1/03 to 1/1/04, coverage applies because the event occurred during that policy period, regardless of when the claim was filed. Therefore, option 2 applies.

For a claims-made policy covering 1/1/03 to 1/1/04, coverage would require that the claim be made and reported during the policy period unless tail coverage is in place. Because the claim was received on July 3, 2004, after expiration of the 1/1/03 to 1/1/04 claims-made policy, coverage would apply only if a 1-year tail was purchased. Thus, option 3 applies.

Option 1 would not apply because the claim was made after the claims-made policy period ended, and no tail is specified. Option 4 would not apply because occurrence coverage from 1/1/04 to 1/1/05 would not cover an event that occurred in 2003.

Risk financing objectives emphasize understanding policy triggers, reporting requirements, and tail coverage. Therefore, the applicable coverage scenarios are the occurrence policy for 2003 and the claims-made policy with tail coverage.

According to Health Care Risk Management standards endorsed by ASHRM and the American Hospital Association Certification Center, a risk manager’s role in community disaster preparedness extends beyond narrow liability analysis. The appropriate scope involves integration of emergency management into the organization’s broader enterprise risk management framework.

Enterprise risk management ERM is a structured, organization-wide approach to identifying, assessing, and managing risks that may affect strategic objectives, operations, financial stability, and reputation. Disaster preparedness is a critical operational risk that must be aligned with governance, compliance, continuity planning, and asset protection strategies. By incorporating emergency management into ERM, the risk manager ensures coordination across clinical services, facilities, supply chain, communications, and leadership structures.

Option A focuses only on post-event liability. Option C limits involvement to quantification without strategic integration. Option D addresses reimbursement processes rather than preparedness strategy.

Health Care Operations objectives emphasize collaboration with emergency management teams, regulatory compliance with preparedness standards, and resilience planning to protect patients, staff, and assets. Therefore, integrating emergency management into a comprehensive enterprise risk management plan best defines the risk manager’s appropriate scope of involvement.