From falls and safeguarding to sharps disposal and cyberattacks, care homes face a widening set of exposures. Amy Ticehurst from Specialist Risk Group and Jenna Davies-Leach from Vernacare explain where the costliest gaps really lie, and what closes them.
Risk management has always sat at the heart of good care, but the scope of what “risk” means has widened considerably. Resident needs are becoming more complex, workforce pressures show no sign of easing, and newer threats such as cyberattacks are now firmly on the agenda. For care home leaders, thinking about risk in isolation, one incident type at a time, is no longer enough.
Where the costs really fall
Falls, staff injuries, medication errors and safeguarding concerns remain the most frequently recorded incidents across the sector, according to Amy Ticehurst, Development Executive at Specialist Risk Group. Falls are significant simply because of how often they occur, and because they can cause serious injury, particularly among older or frailer residents. Staff injuries follow closely behind: manual handling is the second most common cause of non-fatal workplace injury in Great Britain, accounting for 17% of all cases, with back injuries making up 43% of work-related musculoskeletal disorders nationally, according to Health and Safety Executive figures.
Medication errors appear less often in insurers’ claims data but can be costly when they occur. The most expensive incidents by far, however, are safeguarding concerns and allegations of neglect, which typically bring lengthy legal proceedings, regulatory scrutiny and reputational damage alongside any compensation. As Ticehurst puts it, no provider can eliminate risk entirely. What matters is whether risks are identified, managed and properly documented.
The gap between policy and practice
Documentation is where many homes fall down. Ticehurst describes a recurring pattern: strong policies exist on paper, but aren’t always followed consistently day to day. Risk assessments can drift into a tick-box exercise instead of a living document that evolves with a resident’s needs, and gaps in record-keeping make it difficult to prove good care was delivered, even when it was.
The scale of the issue shows up in regulatory data. Under the CQC’s Single Assessment Framework, 26% of adult social care services were rated “Requires Improvement” and a further 5% “Inadequate” on the Safe key question in 2025, the domain covering safeguarding, risk management and medicines records. High staff turnover and reliance on agency workers can compound the problem, making consistent training harder to embed across care teams.
Getting the basics right
Reducing these high-frequency incidents rarely requires anything exotic. For falls, regular review of residents’ mobility, health conditions, medication and environmental hazards makes a measurable difference: NICE guidance suggests individualised, multifactorial assessment can reduce falls among high-risk older adults by 20 to 30%. For staff injuries, moving and handling training needs to be refreshed regularly and backed by competency checks, not treated as a box-ticked exercise done once and forgotten.
Infection control as a risk category in its own right
Alongside these operational risks sits a category that rarely gets the same attention: infection prevention and clinical waste. Jenna Davies-Leach, Global Product Manager for Clinical Waste Management at Vernacare, points to respiratory infections and gastrointestinal illnesses such as norovirus as ongoing concerns, but says the bigger issue is usually inconsistent application of basic measures such as hand hygiene, PPE use and sharps disposal.
The most common sharps error, she notes, is failing to dispose of items immediately at the point of use. Injuries tend to happen when sharps are carried elsewhere, handled more than once, or passed between staff.
On the waste side, over-classification is a widespread problem: items are often treated as infectious clinical waste when they could go through alternative streams such as offensive waste, pushing up disposal costs unnecessarily. Familiarity with HTM 07-01 guidance, Davies-Leach says, helps homes segregate waste correctly, control costs and maintain infection control standards simultaneously, showing that safety and sustainability need not pull in different directions.
Turning incident data into prevention
Both contributors point to the same underlying opportunity: most homes already collect substantial incident data but rarely take a step back to look for patterns. Are falls clustering at particular times or in specific areas? Are staff injuries concentrated among certain shifts or teams? The stakes are considerable. The HSE has identified health and social care as one of the UK sectors with the highest reported musculoskeletal disorder rates, affecting an estimated 52,000 workers in human health and social work activities each year, and accounting for a fifth of all work-related ill health in the sector.
Claims data adds a further layer, helping providers see where incidents are becoming more frequent or costly over time. Sharing those lessons across an organisation, rather than leaving them within individual teams, is what turns data into genuine prevention.
What’s coming next
Cyber security is the risk most likely to catch providers off guard. Many still treat it as purely an IT issue, yet a breach can disrupt care records, medication management, rostering and payroll all at once. The government’s 2025 Cyber Security Breaches Survey found that 41% of health and social care organisations had experienced a breach or attack in the previous 12 months, though 66% now have an incident response plan in place, well ahead of the 23% average across UK businesses generally.
Workforce pressures and rising claims costs round out the picture. Legal costs and compensation awards are increasing, meaning incidents that once carried modest financial consequences can now prove far more expensive.
The common thread across both operational and infection-related risk is the same: effective risk management isn’t about eliminating every possible incident. It’s about building a culture where risks are consistently identified, managed and evidenced, so that when something does go wrong, providers can demonstrate they did everything reasonably possible to prevent it.