Infection risk assessment and infection prevention annual plan

Last updated July 20, 2023.


This tool is intended to guide facilities through the infection risk assessment and plan process. Using this tool is not required. If they use it, facilities should modify it to their needs. They may choose to add or remove sections as appropriate for their setting. It was designed to be comprehensive in order to capture many risk possibilities across different settings.



This risk assessment tool can be used by residential care settings to conduct a facility risk assessment for acquiring and transmitting infections. The risk assessment will identify opportunities and findings, and should be used to provide information about where an organization should focus its infection surveillance, prevention, and control activities. This plan template can be used to help meet the requirements defined in 6 CCR 1011-1, Chapter 2, General Licensure Standard (see part 11 on influenza immunization of employees and direct contractors starting on page 43 and part 12 on infectious disease mitigation and control starting on page 45).

A facility risk assessment is conducted by identifying and reviewing potential risk factors for infection related to the care, treatment, and services provided and to the environment of care in a specific residential care setting. The identified risks of greatest importance and urgency are then selected and prioritized. Based on these identified risks, facility personnel should develop the organization’s infection prevention plan.

The plan should include a goal for reducing the risk of infection associated with each of these identified risks, a measurable objective for each goal, and evidence-based strategies for meeting each of these objectives. The plan should also identify the personnel responsible for implementing the strategies and include mechanisms for evaluating the effectiveness of meeting the plan’s objectives.


Assessment process

Step 1

Convene a team to conduct the risk assessment.

The existing Quality Assurance and Performance Improvement committee should be engaged. If a facility does not have a committee, assemble a team including administrators, director of nursing, assistant director of nursing, environmental services representatives, provider partners, activities personnel, wound care representatives and other frontline team members.

Complete the annual report and facility demographics form.

Step 2

Identify potential risk factors in each event/category listed in the infection risk assessment matrix. Adjust the templated list of events/conditions to reflect your facility’s unique circumstances as needed.

Step 3

Before convening as a group, collect:

  • Observation data for hand hygiene, source control, standard precautions, and transmission-based precautions.
  • Infection rates for each of the communicable diseases identified in both the facility and the community (add hospitalizations and deaths if available).
  • Types of communicable disease outbreaks identified in the facility.
  • Policies and procedures related to infection prevention activities. HCP and resident vaccination rates.
  • HCP and resident vaccine refusal documentation.

Step 4

Completing the forms and toolkits below before conducting the risk assessment will help more accurately evaluate risks and reduce risks associated with lack of preparedness.

Step 4.a

This vaccination and treatment plan template can be used to detail how the facility is meeting vaccination and treatment recommendations, as well as requirements for influenza immunization of employees and direct contractors.

Step 4.b

In order to analyze infection prevention data needed for the Risk Assessment Matrix, consider completing and attaching all applicable templates from the CDC Infection Control Assessment Response Tool for Long-Term Care.

Step 4.c

Consider using the CDC Toolkit: Water Management Program resource to develop strategies to mitigate risks of water-borne illnesses. This is required for CMS facilities and recommended for others.

Step 4.d

The Occupational Safety and Health Administration (OSHA) assures safe and healthy working conditions by setting and enforcing standards, and by providing training, outreach, education, and assistance. An OSHA-compliant respiratory protection program is required for the facility types listed in 6 CCR 1011-1, Chapter 2, General Licensure Standard among other facilities as required by federal laws.

Step 5

Assess and score each potential risk factor based on the following questions in the header row of the infection risk assessment matrix.

Score A: What is the potential impact of the event/condition on residents and staff?

Determined by evaluating the potential for resident illness, injury, infection, death, need for admission to an inpatient facility; the potential for occupational illness, injury, infection, shortage; potential to impact the organization’s ability to function/remain open; and degree of clinical and financial impact.

Score B: What is the probability of the event/condition occurring?

Information regarding historical data, infection surveillance data, the scope of services provided by the facility, and the environment of the surrounding area (topography, interstate roads, chemical plants, railroad, ports, etc.) are considered when determining this score.

Score C: What is the organization's preparedness to deal with this event/condition?

Determined by considering policies and procedures already in place, staff experience and response to actual situations, and available services and equipment.

Step 6

Tally risk scores A, B and C defined above in the infection risk assessment matrix.

After risk scores are assigned in the three assessment groups, total the numbers in each group to provide a numerical risk level for each event/condition.

Step 7

Rank the totaled risk scores.

After risk scores are assigned in the three assessment groups, the numbers in each group are totaled to provide a numerical risk level for each event/condition. The numerical risk level can range from 0 (lowest vulnerability) to 9 (highest vulnerability). The risks with the highest scores will be used for priority focus for developing the infection prevention plan goals and objectives.

NOTE: Some events/conditions with a lower score may be selected for inclusion in the Annual Infection Prevention Plan because they are an accreditation or regulatory requirement (e.g. vaccination and treatment), or can be quickly and easily implemented.

Step 8

Collaboratively finalize the events/conditions to be included in the infection prevention plan.

Share the infection risk assessment matrix and supporting documents with others to solicit comments. Evaluate and incorporate the comments, as needed, and finalize the form. Submit this work to the governing body and the committee for final approvals before the Infection Prevention and Control Plan is developed.

Develop infection prevention plan goals and objectives.

After final approval of the risk assessment findings, develop the infection prevention plan goals and objectives. Develop a goal and supporting objectives for each event or condition from the infection risk assessment matrix that have been chosen to be included in the infection prevention plan.  For reference, this toolkit provides guidance on how to formulate meaningful goals and SMART objectives. Project Firstline resources may be helpful in meeting objectives related to staff training.

Review and update.

The infection risk assessment matrix and infection prevention plan goals and objectives should be reviewed and approved by the organization’s quality assurance and performance improvement committee (or other designated committee). They should be reviewed annually and sooner if circumstances change.