vaayaa Inclusive Education
Healthcare risk assessment

Transplant and Surgical Oncology Risk Assessment: Graft, Handover and Treatment Safety Controls

A worked example of how a transplant and surgical oncology unit finds, scores and controls risks to patient safety, from graft handling and handovers to treatment errors, infection, consent and data protection.

Updated November 2026 8 hazards assessed Review every 3 months Highest risk: Critical to Medium
See the Transplant and Surgical Oncology course

Executive summary

This assessment shows how a transplant and surgical oncology unit can find, rate and control the risks that matter most to patient safety. Eight risks were chosen because they are plausible in everyday surgical, transplant and cancer care. Graft handling errors score highest before controls because a single mismatch can cause loss of an organ and serious harm. Handover gaps, infection in immunosuppressed patients and delayed recognition of deterioration also score High. Each risk is scored before controls and again after existing and added controls. Most fall to Medium or Low once added controls are in place, but graft handling stays at Medium because the impact remains severe. The first actions are electronic graft matching, a structured handover tool, a standard order set for high alert drugs and a tested downtime procedure. The unit is a teaching example, so every score illustrates method, not a real service. Specialist clinical review is needed before any change.

Focus area
Transplant and surgical oncology
Setting
Hospital transplant and cancer surgery unit with inpatient, theatre and outpatient services
Method
Five by five likelihood and impact risk register with clinical governance review

Scope

This assessment covers the care pathway of a hospital transplant and surgical oncology unit, from referral and consent through surgery, graft handling, inpatient recovery and follow up. It considers risks to patient safety, staff, equipment, records and service continuity. Jurisdiction, hospital size, staffing model and information systems are not specified, so they are assumed for teaching only. It does not replace a formal site-specific clinical risk assessment.

Context

The unit has transplant and oncology surgeons, anaesthetists, specialist nurses, pharmacists, a transplant coordinator, theatre staff and an information team. Patients may be immunosuppressed, may receive cytotoxic or targeted treatments, and may be recovering from major resections or organ transplant. Records are held in an electronic system with some paper consent forms and handwritten theatre notes. Each hazard is scored before controls to show its natural level, then again after existing controls and added controls, with an owner role and a review trigger.

Objectives, assets and stakeholders

The objective is to deliver safe transplant and cancer surgery, protect grafts and patients from avoidable harm, keep treatment lawful and consented, and maintain the trust of patients and families. The assets in scope are donor and recipient grafts, the electronic clinical record, theatre equipment, medicines and the reputation of the unit. Stakeholders include patients and families, surgeons, anaesthetists, specialist nurses, pharmacists, the transplant programme, the information team, governance staff and regulators. Every risk has one owner role, and the clinical director reviews the register with the governance lead each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 4, score 16, high: H02 Likelihood 4, impact 5, score 20, critical: H01
3 Possible Likelihood 3, impact 4, score 12, high: H05 Likelihood 3, impact 5, score 15, high: H03 H07
2 Unlikely Likelihood 2, impact 3, score 6, medium: H08 Likelihood 2, impact 4, score 8, medium: H06 Likelihood 2, impact 5, score 10, high: H04
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible
2 Unlikely Likelihood 2, impact 2, score 4, low: H06 Likelihood 2, impact 3, score 6, medium: H03 H05 H07 Likelihood 2, impact 4, score 8, medium: H01 H02
1 Rare Likelihood 1, impact 3, score 3, low: H08 Likelihood 1, impact 4, score 4, low: H04
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Graft allocation, labelling and handling error 20 Critical 8 Medium Transplant coordinator
H02 Surgical handover and staffing gap during complex resections 16 High 8 Medium Clinical lead for surgery
H03 Infection and exposure in immunosuppressed patients 15 High 6 Medium Infection prevention nurse
H04 Cytotoxic and immunosuppressant medication error 10 High 4 Low Lead oncology pharmacist
H05 Consent and documentation gaps for oncology and transplant procedures 12 High 6 Medium Clinical governance lead
H06 Equipment and information system failure in theatre or imaging 8 Medium 4 Low Theatre manager
H07 Delayed recognition of postoperative deterioration 15 High 6 Medium Ward matron
H08 Privacy breach of oncology and transplant records 6 Medium 3 Low Information governance lead
H01

Graft allocation, labelling and handling error

Safety Before 20 After 8

A donor organ or tissue is mismatched, mislabelled, held at the wrong temperature or delayed in transport, so the graft is unsuitable or lost before implantation.

Who or what is affected: Transplant recipients, surgical team and donor programme

Causes

Manual labelling, busy theatre schedules and transfers made late at night.

Consequences

Graft loss, rejection, emergency retransplant and serious harm to the patient.

Existing controls

  • Two person identity check is made before the graft leaves storage.
  • Transport containers are logged with temperature records.

Control gaps

Electronic matching does not cover every transfer, and temperature logs are reviewed only after the event.

Additional controls

  • Prevent: Use barcoded labels and electronic matching of donor and recipient at each handover point.
  • Detect: Review temperature logs and time stamps for each transfer and flag any gap.
  • Respond: Hold the graft and follow the transplant programme escalation pathway at once.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Transplant coordinator Target: Within 30 days Early warning: A graft transfer with a missing identity match or a late temperature record.
H02

Surgical handover and staffing gap during complex resections

People Before 16 After 8

Long operations, fatigue and uncovered absences leave patients without a clear handover or senior review, so early signs of bleeding, infection or organ problems are missed.

Who or what is affected: Inpatients, surgical trainees and senior clinicians on call

Causes

Long operations, fatigue, unplanned admissions and leave that is not covered.

Consequences

Missed signs of bleeding or infection, delayed review and patient harm.

Existing controls

  • Surgeons use a written handover for each patient on the list.
  • Rotas are checked for minimum senior cover each week.

Control gaps

Handover sheets vary between teams and are not checked for completeness.

Additional controls

  • Prevent: Use a structured handover tool and a fixed checklist for the operating list and post operative plan.
  • Detect: Audit a sample of handovers each month against the agreed checklist.
  • Recover: Rebalance the rota and bring in cover from the on call pool when a gap appears.
Likelihood 4 x impact 4 before; 2 x 4 after Owner: Clinical lead for surgery Target: Within 45 days Early warning: A shift starts with fewer senior clinicians than the minimum set in the rota.
H03

Infection and exposure in immunosuppressed patients

Safety Before 15 After 6

Immunosuppressed patients with central lines, wounds or long stays are exposed to bacterial, viral or fungal infection from staff, visitors or the environment, which can delay surgery and threaten the graft.

Who or what is affected: Transplant and cancer patients, ward staff and visitors

Causes

Immunosuppression, central lines, long stays and visitors with symptoms.

Consequences

Sepsis, graft infection, delayed surgery and prolonged stay.

Existing controls

  • Hand hygiene audits are run on the ward each quarter.
  • Patients with known infection risk are placed in single rooms where possible.

Control gaps

Screening results are not always linked to the bed plan.

Additional controls

  • Prevent: Screen patients for infection before admission and set prophylaxis plans with the pharmacist.
  • Detect: Track wound and line infections on a shared dashboard each week.
  • Respond: Start the agreed isolation and antimicrobial pathway within the hour of a positive result.
Likelihood 3 x impact 5 before; 2 x 3 after Owner: Infection prevention nurse Target: Within 30 days Early warning: Two or more infections on the same ward within a week.
H04

Cytotoxic and immunosuppressant medication error

Safety Before 10 After 4

A dose of a cytotoxic or immunosuppressant drug is calculated, transcribed or given incorrectly, or a verbal order is acted on without a check, causing toxicity or loss of graft function.

Who or what is affected: Patients receiving treatment, nurses and prescribers

Causes

Complex regimens, weight based doses, interruptions and similar drug names.

Consequences

Toxicity, graft rejection, organ damage or death.

Existing controls

  • Chemotherapy is prescribed through an electronic system with dose checks.
  • A pharmacist verifies each cytotoxic and immunosuppressant dose before it is given.

Control gaps

Dose checks do not cover verbal orders given in theatre or on the ward.

Additional controls

  • Prevent: Use standard order sets for common regimens and block free text doses for high alert drugs.
  • Detect: Review near miss reports from infusion and drug round errors each month.
  • Respond: Stop the infusion, check the patient and inform the prescriber and pharmacist at once.
Likelihood 2 x impact 5 before; 1 x 4 after Owner: Lead oncology pharmacist Target: Within 30 days Early warning: A verbal or handwritten high alert drug order without a pharmacist check.
H05

Consent and documentation gaps for oncology and transplant procedures

Legal and compliance Before 12 After 6

Consent is taken without a clear record of risks, alternatives and capacity, or the signed form is not linked to the procedure performed, so the treatment may lack valid consent.

Who or what is affected: Patients, surgeons and the clinical governance team

Causes

Urgent lists, unclear capacity assessment and paper forms that are misfiled.

Consequences

Invalid consent, complaints, claims and loss of patient trust.

Existing controls

  • Consent forms are signed before the procedure list is confirmed.
  • Surgeons record consent discussions in the clinical notes.

Control gaps

Paper forms are scanned late and not always linked to the electronic record.

Additional controls

  • Prevent: Use a single electronic consent template with required fields for risks, alternatives and capacity.
  • Detect: Audit a monthly sample of consent records against the procedure performed.
  • Respond: Pause any non urgent procedure where consent is incomplete and refer to the consent lead.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Clinical governance lead Target: Within 60 days Early warning: A procedure booked with a consent form not scanned 48 hours before the date.
H06

Equipment and information system failure in theatre or imaging

Technology and data Before 8 After 4

A critical device, network link or the electronic record fails during surgery or imaging, so procedures are delayed, cancelled or completed with incomplete information.

Who or what is affected: Theatre teams, patients on the list and the information team

Causes

Ageing equipment, software updates and network faults.

Consequences

Delayed surgery, cancelled procedures and missing records.

Existing controls

  • Critical equipment has a planned maintenance schedule.
  • The electronic record has a daily backup managed by the information team.

Control gaps

Downtime drills are not held on a regular basis.

Additional controls

  • Prevent: Keep a tested standby monitor, pump and imaging route for every major list.
  • Detect: Run daily system health checks and log any interface failure to the theatre list.
  • Recover: Use a downtime procedure with paper records and a tested restore time target.
Likelihood 2 x impact 4 before; 2 x 2 after Owner: Theatre manager Target: Within 60 days Early warning: A critical device fails a daily check or a system outage lasts over 15 minutes.
H07

Delayed recognition of postoperative deterioration

Safety Before 15 After 6

Observations are missed, recorded late or not acted on, so a patient who is getting worse after surgery is not escalated in time for bleeding, sepsis or organ failure.

Who or what is affected: Postoperative and transplant inpatients and ward nurses

Causes

Missed observations, staff focused on other patients and unclear escalation routes.

Consequences

Sepsis, bleeding, unplanned critical care admission and avoidable death.

Existing controls

  • Early warning score charts are recorded at set intervals.
  • Surgical team reviews the ward patients each morning.

Control gaps

Observation charts are not reviewed in real time and escalation depends on individual judgement.

Additional controls

  • Prevent: Set escalation thresholds on early warning scores and link them to a named response team.
  • Detect: Review missed or late observations weekly and feed the results to the ward lead.
  • Respond: Call the critical care outreach team at once when a threshold is crossed.
Likelihood 3 x impact 5 before; 2 x 3 after Owner: Ward matron Target: Within 30 days Early warning: Observations overdue by more than one hour on a high risk patient.
H08

Privacy breach of oncology and transplant records

Technology and data Before 6 After 3

Shared logins, unattended screens or printed notes allow staff without a clinical need to view or share sensitive cancer and transplant records.

Who or what is affected: Patients, families and staff named in records

Causes

Shared devices, printouts left on wards and curiosity about known patients.

Consequences

Harm to privacy, complaints, regulatory investigation and loss of trust.

Existing controls

  • Staff access to the record is limited by role.
  • Staff complete data protection training each year.

Control gaps

Access logs are reviewed only after a complaint.

Additional controls

  • Prevent: Remove shared logins and require individual sign in with automatic log out.
  • Detect: Review access logs for records viewed without a clinical reason each month.
  • Respond: Report confirmed breaches to the information governance lead within 24 hours.
Likelihood 2 x impact 3 before; 1 x 3 after Owner: Information governance lead Target: Within 60 days Early warning: Repeated access to one record by a user with no assigned patient.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Minor to Catastrophic for patient harm, service disruption, legal exposure and trust. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. Inherent risk is the score before any controls. Residual risk is the score after existing and added controls, and it can never be higher than the inherent score. Where the inherent score is 10 or more, the residual score must be lower. Patient harm is judged at the level of the worst credible outcome, not the most common one, so a rare graft error is not rated down for being rare. Critical risks need immediate senior action and a dated plan, High risks need a named owner and review within the month, Medium risks need routine controls, and Low risks are accepted and watched. Clinicians, nurses, pharmacists and patient representatives should challenge the ratings, and any rating is reviewed whenever an indicator reaches its threshold or an incident occurs.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 3 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Graft transfers with a missing identity match or temperature record.Escalate to the transplant coordinator at once and to the clinical director within 24 hours if any transfer is unverified.
Shifts that start below the minimum senior cover in the rota.Escalate to the clinical lead for surgery before the shift, and to the medical director if cover remains short for more than one day.
High risk patients with observations overdue by more than one hour.Escalate to the ward matron when one patient is overdue, and to the critical care outreach team if an early warning threshold is crossed.
Infections on the same ward within a week, or positive screens not linked to a bed plan.Escalate to the infection prevention nurse at once, and to the infection control committee if two or more cases occur on the same ward.
Record views without a clinical reason in the monthly access log.Escalate to the information governance lead within 24 hours, and to the data protection officer if a breach is confirmed.

Contingency arrangements

If a serious event occurs, such as a graft mismatch, a major medication error or a system outage that stops theatre, the clinical lead stops related activity, secures the patient and informs the responsible consultant at once. The transplant coordinator follows the programme escalation pathway and records the timeline. The theatre manager activates the paper downtime procedure and moves lists where needed. Incidents are reported through the governance route, families are told promptly and openly, and the risk owner reviews the register within a week.

Prioritized action plan

  1. Introduce electronic donor and recipient matching at every graft transfer, owner transplant coordinator, within 30 days.
  2. Adopt a structured handover tool for all surgical lists and check completeness weekly, owner clinical lead for surgery, within 45 days.
  3. Set escalation thresholds on early warning scores with a named response team, owner ward matron, within 30 days.
  4. Standardise order sets for high alert drugs and log near misses monthly, owner lead oncology pharmacist, within 30 days.
  5. Run a downtime drill with paper records and a tested backup restore, owner theatre manager, within 60 days.

Conclusion

Safe transplant and cancer surgery depends on a few steady habits: checked graft identity, structured handovers, timely escalation, verified treatment doses, complete consent and tested downtime plans. The highest scores sit with graft handling, handovers and infection, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle and seek qualified clinical, legal and governance advice for any real decision.

Assumptions and limitations

Assumptions

  • The unit is part of a hospital with established clinical governance, incident reporting and a formal transplant programme.
  • Staff hold recognised professional registration and receive mandatory training and competence sign off.
  • The electronic record and theatre systems are managed by a separate information team with a daily backup routine.

Limitations

  • The scores are examples for learning and do not describe any real service, patient group or hospital.
  • Clinical protocols, transplant rules and cancer treatment standards vary by country and change over time, so specialist review is needed.
  • This is educational content and is not clinical, legal or medical advice.

Related frameworks to study

  • Clinical governance framework with incident learning
  • Hierarchy of controls
  • Structured handover tool such as SBAR
  • Root cause analysis
  • Three lines model of risk ownership

Healthcare Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Transplant and Surgical Oncology course Read the best practices for this course

More Healthcare risk assessments

Hourly Active: 45,552 Learners