Viewpoints: Building Resilience in Health Care

Workforce dynamics further compound this pressure. Persistent shortages of clinical staff, a reliance on contract labor, and wage inflation are increasing costs, as well as risks to continuity and productivity. Competition for IT, cybersecurity, data, and compliance talent is also raising costs.

Revenue uncertainty remains another key risk driver. Payer mix shifts, reimbursement delays, and value-based care adoption complicate forecasting and cash flow management. These challenges are magnified by limited flexibility in cost structures and constrained access to capital, as higher interest rates and tighter credit markets affect borrowing capacity and investment decisions.

Are regulatory and policy changes increasing risk?

Regulatory change is amplifying volatility, particularly in the U.S., following the passage of the One Big Beautiful Bill Act (OBBBA) in July 2025. The law restructures Medicaid funding, Affordable Care Act marketplace subsidies, and certain Medicare provisions. Projections from the Congressional Budget Office and data from Congress.gov show the law will significantly reduce federal outlays by roughly $900 billion over a decade and increase the number of uninsured individuals. While many provisions will phase in over the next several years, organizations must now contend with uncertainty around payer mix, uncompensated care, and long-term revenue sustainability, especially those serving Medicaid-dependent or vulnerable populations.

Beyond OBBBA, ongoing rulemaking from the Centers for Medicare & Medicaid Services and the Department of Health and Human Services continues to expand compliance expectations. Requirements related to price transparency, prior authorization, quality reporting, and data governance increase administrative complexity and enforcement exposure.

At the same time, heightened federal focus on cybersecurity and patient data protection raises the stakes for system resilience and third-party risk management. Complicating matters further, the rollout of policy changes occurs at different times, the rules and instructions continue to change, and each state handles these changes in its own way — creating confusion about how to interpret these new requirements.

How can health-care companies build resilience?

Organizations that are better positioned to navigate a volatile environment are ones that use risk functions to connect emerging risks to decision-making. They stress-test assumptions, helping leadership understand where exposure is growing before it materializes as loss.

More effective organizations move beyond siloed assessments by addressing cross-cutting risks, such as the combined impact of reimbursement changes, workforce shortages, and technology dependencies, and framing them in terms of strategic objectives and tolerance levels.

Internal audit is also increasingly expected to serve as an early-warning mechanism. Through continuous risk assessment, forward-looking audit planning, and targeted audits, internal auditors can identify vulnerabilities in revenue cycle processes, compliance programs, data governance, and third-party relationships before they result in regulatory findings or financial loss.

At the same time, some organizations are not fully leveraging technology and advanced analytics — including artificial intelligence (AI) — in ways that could alleviate these pressures. Resistance to change remains common, particularly where adoption may alter existing roles or raise concerns about job displacement. And efforts to reduce expenses can have unintended consequences. Burnout, turnover, and a reliance on contingent labor can increase clinical, operational, and compliance risks.

Internal audit can help by evaluating whether cost and workforce management initiatives are grounded in reliable data, aligned with clinical priorities, and supported by effective, sustainable governance. For example, reviews over flexible staffing models, scope-of-practice expansion, medical device recalls and warranties, patient throughput, length of stay, or the use of contract labor can identify financial opportunities and help leadership distinguish between structural inefficiencies and necessary investments in care continuity and safety. These reviews move conversations beyond compliance by clarifying how operational decisions affect clinician sustainability and patient experience.

What is the role of emerging technology?

Technology adoption — such as electronic health record optimization, telehealth expansion, automation, and AI in clinical and administrative workflows — promises more efficiency and access. It also introduces risks that have direct implications for patient safety and trust, including cyber threats, data integrity issues, algorithmic bias, and the costs of delayed adoption.

Internal audit needs to be more creative and strategic to help organizations identify where AI and advanced analytics — even within audit activities — can support testing, monitoring, and risk assessment. By leveraging AI-enabled testing, internal audit can reduce reliance on manual validation and dedicate more time to partnering with process owners. This allows internal audit to focus on identifying cost-saving opportunities and modeling innovative and practical AI use cases, while strengthening control environments.

What does good governance look like now?

Health systems today operate in an environment of heightened economic pressure, which demands a shift from retrospective assurance toward insight that is more forward-looking. Provider organizations increasingly rely on rapid decision-making, yet speed can outpace oversight. However, having an adaptive and multidisciplinary governance structure in place can help organizations address emerging risks and reduce costs without compromising their ability to deliver on their promised clinical mission.

In an era of sustained volatility, internal audit is no longer a back-office function. By aligning assurance activities with care delivery realities and strategic priorities, audit leaders can help their organizations remain financially resilient while preserving access to high-quality care.