Understanding its own risks and patient care vulnerabilities is vital to a health organization, but gaining that understanding is hard. Hospital leaders in the Harvard system are enthusiastic about outside risk assessments from CRICO, because the recommendations that come out are tangible, with no punitive component.