Infection Control Risk Assessment: Building an ICRA That Survives Survey Day

July 17, 2026

Ready to be survey-ready?

See how AccrediCulture turns compliance into an operating system across every facility.

What an ICRA actually is, and what surveyors expect to see

An Infection Control Risk Assessment (ICRA) is a documented, prioritized evaluation of infection transmission risks across your patient population, environment, procedures, and construction activity. Surveyors expect to see it reviewed at least annually, signed off by leadership, tied to measurable goals, and linked to your infection prevention program’s corrective actions. That is the short answer. Everything else is how you defend it on survey day.

The regulatory backbone is 42 CFR §482.42, cited by CMS surveyors as Tag A-0747. The hospital must have active hospital-wide programs for the surveillance, prevention, and control of HAIs and other infectious diseases, and for the optimization of antibiotic use through stewardship, and those programs must demonstrate adherence to nationally recognized infection prevention and control guidelines. Infection prevention and control problems and antibiotic use issues identified in the programs must be addressed in collaboration with the hospital-wide quality assessment and performance improvement (QAPI) program. That QAPI linkage is where most ICRAs fall apart. The document exists. The connection to CAPAs, EOC rounds, and board minutes does not.

Joint Commission rewrote the IC chapter effective July 1, 2024. The revised standards support quality and safety and align with the requirements from the Centers for Medicare & Medicaid Services (CMS), Conditions of Participation (CoPs), and the Centers for Disease Control and Prevention (CDC), and the Joint Commission introduced a new standard, IC.07.01.01, with two new elements of performance to support facilities in preparedness for high-consequence infectious diseases or special pathogens. If your ICRA still reads like it was written in 2019, a surveyor will notice.

Why this matters right now: the citation and cost data

The numbers make the case. In 2023 to 2024, Joint Commission cited hospitals with a Request for Improvement on average more than two times per hospital surveyed, and in 2023, over 77% of hospitals surveyed had at least one IPC RFI. Over the past decade, IPC citations remain among Joint Commission’s most frequently cited findings of non-compliance. If three out of four hospitals get an IPC finding, the question is not whether your ICRA will be scrutinized. It is whether the evidence chain behind it will hold.

The clinical stakes are real too. On any given day in 2023, about 1 in 38 hospital patients had at least one healthcare-associated infection. There is some good news. Between 2023 and 2024, acute care hospitals saw significant decreases in C. Difficile infection (11%), CAUTI (10%), CLABSI (9%), MRSA bloodstream (7%), SSIs following colon surgery (4%), and ventilator-associated events (2%). Cost per event still stings. The average cost per CLABSI, after CPI adjustment, was estimated at $70,696 with a range of $40,412 to $100,980. One preventable event can wipe out a quarter of margin at a mid-size facility.

As The Joint Commission puts it, “IPC is practiced at all levels, facility managers, leadership, staff, patients, and visitors, and all play a role.” Your ICRA is the document that proves those levels actually connect.

The five elements of an ICRA that holds up on survey day

We help operators structure ICRAs so the evidence pulls in minutes, not days. Five elements do the heavy lifting:

Population and setting risk profile. Age, acuity, immunocompromise, procedural mix, and community pathogens active in your service area. Refresh when your case mix shifts, not just at year-end.
Prioritized risk list with scoring. Probability multiplied by severity, ranked. Surveyors want to see how you chose your top three to five priorities, not a flat list of thirty.
Mitigation plan per priority. Named owner, timeline, resource ask, measurable target. Tie each to a CAPA in your compliance program so the corrective action work is traceable.
Construction and renovation ICRA (ASHE ICRA 2.0). Every project, every phase, with pre-construction risk determination, class of precautions, and post-project review. This is separate from your annual programmatic ICRA and both are required if you have active projects.
Governing body sign-off and QAPI integration. Board minutes referencing the ICRA. Evidence the results were reviewed by leadership, not just filed by the infection preventionist.

The evidence chain matters as much as the ICRA itself. A surveyor asks for last quarter’s EOC rounds tied to your top ICRA priority. Can you pull it in under two minutes? That is the standard we build for. Policy version, rounding checklist, incident log, credentialed staff training records, and CAPA status all in one command center view. One source of truth beats five binders every time.

Refreshing the ICRA when risk data changes

Annual review is the floor, not the ceiling. The CDC’s National and State HAI Progress Report gives you national benchmarks. The report includes infection-specific standardized infection ratios (SIRs), which measure progress in reducing HAIs compared to the 2015 baseline time period, and the SIR is the ratio of the observed number of infections to the number of predicted infections for a summarized time period. Your local SIR trend is the trigger. When a device-associated rate moves the wrong direction for two quarters, that is a risk data change your ICRA should reflect before the next survey window opens.

Other refresh triggers we see work well: a new procedure line, a construction phase change, a state health department alert on a regional pathogen, a Joint Commission R3 update, or a CMS QSO memo. Log each trigger, log the review, log the decision. Even a “no change needed” note is defensible evidence. Silent quarters read like neglect.

The construction piece deserves its own discipline. ASHE ICRA 2.0 is the construction-specific tool healthcare engineering teams use to classify precautions during renovation and new build. It does not replace your annual programmatic ICRA. It complements it. Facilities that conflate the two often produce a construction matrix on survey day when the surveyor asked for the programmatic assessment, and vice versa. Keep them clearly labeled, cross-referenced, and both current.

Frequently asked questions

How often must an ICRA be updated under CMS and Joint Commission requirements?
At least annually is the baseline expectation under both CMS §482.42 and Joint Commission IC standards. Update more frequently when risk data changes: new procedures, construction phases, outbreak signals, adverse SIR trends, or regulatory updates like the July 2024 IC chapter revisions.

Who is required to sign off on the ICRA, is the infection preventionist enough or do we need governing body approval?
The infection preventionist owns the assessment. An individual qualified through education, training, experience, or certification in infection prevention and control is appointed by the governing body as the infection preventionist responsible for the infection prevention and control program. Governing body review and acknowledgment is what surveyors want documented in board or committee minutes. Without that, the ICRA reads as an IP-only artifact and does not meet the QAPI integration expectation.

How does ASHE ICRA 2.0 differ from the annual programmatic ICRA and do we need both?
ASHE ICRA 2.0 is a construction and renovation tool used by facilities engineering to classify infection risk during physical projects. The programmatic ICRA is a broader, annual assessment of infection risks across population, environment, procedures, and antibiotic use. If you have any construction activity, you need both, clearly labeled and cross-referenced.

What are the most common ICRA-related survey findings in the last two years?
Joint Commission’s most recent trending data highlights IC.02.02.01, EP 2 on performing intermediate and high-level disinfection and sterilization of medical equipment, and IC.02.01.01, EP 2 on using standard precautions including personal protective equipment to reduce the risk of infection. Common failure modes we see: no evidence of leadership review, no linkage between ICRA priorities and CAPAs, and construction ICRAs that stop at pre-construction with no closeout.

How do we tie ICRA findings to our corrective action plans and Environment of Care rounds?
Every prioritized ICRA risk should map to a CAPA with owner, timeline, and measurable target. Every EOC round checklist should include items pulled from ICRA priorities, so rounding evidence directly supports the assessment. When those threads sit inside one system, retrieval on survey day is a two-minute pull, not a scramble.

References