A risk management department reviews all incident reports in an effort to avoid future incidents. They look for trends that suggest a problem in policy or process and make recommendations for new policies or processes that will help the hospital avoid future incidents. For example, if there are many medication errors in a hospital, scanning technology can help prevent these through the scanning of the patient's ID and the scanning of the medication "ID." There is software that can act as a failsafe if a medication has not been prescribed or a dose is erroneous.
Now, there are other considerations for a risk management department. For example, cost of new procedures can be prohibitive, and the recommendations of the department must take this into account. Can the hospital afford to acquire a new technology? Another factor is the ease of implementation for a new policy or procedure. Still another is an inquiry into how a new procedure might make things worse, for example, slowing down medical care in the emergency room.
Risk management is a combination of art and science, and it must balance the realities of the running of the hospital against the need to eliminate or decrease risk. No institution can ever eliminate all risk, but the risk management department exists to achieve a reasonable balance.