Risk…Is Yours Being Managed?

click here for original pdf

By Jeffrey Cavignac, CPCU, RPLU,  ARM, CRIS, MLIS

Cost of Risk is not a line item found on a company’s income statement, yet this can be one of the largest and most volatile expenses that a company has. Depending on the industry, some businesses may pay 5% or more of their gross income for risk-related costs. In an industry with tight profit margins, effectively managing risk can sometimes mean the difference between making a profit or not, and in some cases, the survival of the business.

What is Cost of Risk?

Cost of Risk is typically includes:

  • Time spent analyzing and managing risk – This includes the time invested to identify potential losses and their causes and to decide on a strategy to manage those losses. It also includes time spent managing your safety program, human resources and claims.
  • Time spent dealing with losses – This could involve efforts to work with employees and designated clinics for a worker’s compensation claim, dealing with an insurance adjuster on a property claim, or participating in your defense of a lawsuit against your company.
  • Cost of funding retained losses – Losses are either intentionally retained (deductibles, self-insured retentions or self-insurance) or retained by accident. Firms with large retentions can incur significant retained losses. Effective risk management should help avoid retaining a loss accidentally.
  • Productivity losses due to time lost by injured workers
  • Cost of training new employees
  • In cases of bad publicity, the cost to your brand or reputation
  • Loss of market during the time your business is shut down
  • Insurance premiums – These include, but are not limited to: general liability, auto, property, excess, worker’s compensation, professional liability, pollution liability, employment practices liability, inland marine, surety, and employee benefits. The cost of insurance is often less than 50% of the total cost of risk.

What is Risk Management?

Traditional risk management focuses on what is called Hazard Risk. Hazard Risk, as opposed to Business Risk, deals with accidental or fortuitous losses. These risks involve the potential for loss without any corresponding possibility of gain. Business Risk, on the other hand, deals with the risk of conducting business. It includes the possibility of loss, no loss, or gain. Investment in a new piece of machinery or acquiring another entity are examples of Business Risk.

Collectively, Hazard Risk and Business Risk make up what is known as Enterprise Risk Management. Enterprise Risk Management can encompass nearly every decision made by a business. This article will focus on Hazard Risk Management, and for the sake of simplicity we will refer to it simply as ‘risk management’.

In its simplest form, risk management involves the identification, evaluation, and management of a company’s exposures to loss. A Loss Exposure is defined as any condition that could result in financial loss to an organization. In other words, risk management attempts to mitigate the occurrence of losses while initiating advance planning to assure that adequate funds will be available to cover any losses that do occur. The primary function of risk management is to protect the assets and financial viability of the company, and secondarily, to lower the total cost of risk.

Whether or not someone has the official title of Risk Manager in your company doesn’t matter; someone is managing your risk. Of course, if you don’t know who that person is, your risk may not be managed very well. The first step in an effective risk management program is to designate an individual or those individuals who will be responsible for this function.

The Risk Management Process

To effectively manage risk, it helps to develop a systematic approach. There are a number of ways to do this, but an effective Risk Management Process should include the following steps:

I. Risk Analysis

II. Risk Control

III. Risk Finance

IV. Risk Review and Refinement

These are the steps we follow when working with our clients to manage their risk. We’ve packaged this into a specific program we call the Cavignac Risk Management Process.

I. Risk Analysis

Risk Analysis is the first and perhaps the most important step in the Risk Management Process. The purpose is to identify loss exposures, or things that, if they go wrong, could cost the company money.

There are only four types of loss exposures:

  • Property
  • Loss of Income
  • Personnel
  • Third Party Liability

The correct way to identify and analyze exposures is to do so systematically using an exposure analysis program or checklist. In addition to the checklist, items such as financial statements, flow charts, contracts and marketing materials may be helpful.

Once exposures have been identified, they need to be analyzed. Some exposures are minimal and can be retained; others lend themselves to being controlled, and still others will need to be transferred, avoided, or financed. The key is to be proactive in this process. It is better to understand your risks and make conscious decisions about how to handle them than to find out at the time of a loss that you are uncovered and unprepared.

Risk Control

Risk Control involves any strategies or techniques that you can implement to lower the frequency and/or severity of a loss exposure. Risk Control includes safety, claims management and human resources.

Safety – A safe workplace is important for every company, but for some, it is critical. For a construction business or manufacturing firm, a poor safety record can escalate risk management costs significantly. Put bluntly, unsafe companies in these industries won’t survive long. A poor safety record and loss history can drive a company’s insurance costs so high that they simply can’t compete. Like a lot of things, most safety issues are fundamental and straightforward.

  • Is your Injury and Illness Prevention Program (IIPP) valid and compliant with the California Code of Regulations?
  • Are your supervisors familiar with your safety program and are they able to teach and monitor that program?
  • Does management make safety a priority?

You and your safety officer should do a self-analysis of your company’s safety culture and determine where you need to improve. Work with your broker and insurance company to develop a Schedule of Risk Control Services which will help you accomplish your objectives.

Claim Management – Claim management is equally as important. Even the best run firms will have accidents. How you manage an accident can have a material effect on the ultimate cost.

  • Have you appointed a Risk Manager or Claim Supervisor in your company who is responsible for coordinating all claims and accidents?
  • Have the appropriate individuals in your company been educated in Post-Accident Response Training?
  • Have you designated a Medical Provider Network for worker’s compensation claims?
  • Have you developed an Early Return-to-Work Program?
  • Have you established a relationship with your broker’s claim manager as well as your insurance company’s claims adjusters?

The importance of both pre-claim and post-claim training cannot be over emphasized.

Human Resources – Human resources (HR) is a major area of concern for all of our clients. If you have even one employee, you can have HR issues. The challenge of making certain your HR practices comply with the myriad of laws and regulations imposed by the numerous organizations that deal with these issues is mind-numbingly difficult (we’ve developed a specific program to deal with compliance).

  • Do you have a full-time HR staffer or have you appointed someone in your company to handle this function?
  • Has your employee handbook been reviewed for compliance?
  • Have your supervisors been through Sexual Harassment Prevention Training (AB 1825)? This training is required for all employers with 50 or more employees.
  • Are you confident that your hiring, firing, and discipline policies and procedures are legal and effective?

Once again, the key is to identify where you need to get better and then develop a Schedule of Services to accomplish your objectives. There are numerous tools available to help a company improve its HR practices (HR That Works, a web-based resource, is one of the best). The key is identifying where you need to improve.

Risk Finance

Once you have identified and analyzed your risk and developed Risk Control techniques to lower the frequency and severity of your loss exposures, it is time to consider Risk Finance. How will you pay for the risk you elect to transfer to others (Risk Transfer) or those risks you elect to retain? Risk can be transferred in two ways:

Contractual Risk Transfer (CRT) involves transferring risk to another party via contract. Some industries use CRT more than other contracts, but most if not every contract that any business enters into will involve risk transfer. Whether it is an indemnity agreement, an additional insured requirement, or a waiver, risk is being transferred. There are several keys to managing CRT:

  • Do you understand the risk you are being asked to assume?
  • Do you know if it is insurable?
  • Do you know if your insurance program meets the insurance requirements of the agreement?
  • Do you have an attorney and insurance broker you can utilize when you have questions or issues?

Insurance Risk Transfer involves transferring your risk to an insurance company. Basically you are agreeing to transfer the potential consequences of certain specified loss exposures to an insurance company for an agreed-upon cost or premium. Insurance is often the most expensive component of the Cost of Risk, but there is a reason it is the third step in the Risk Management Process. It is only after you have identified and analyzed your exposures and have implemented effective Risk Control techniques that you can determine what you want to insure.

If you have done the first two steps correctly, you should be in a better position to approach the insurance marketplace with a well thought out submission that highlights the attributes of your company’s risk management efforts. This will show why you are a better-than-average risk from the underwriter’s standpoint and why you deserve a favorable rate. The keys to successful Insurance Risk Transfer include:

  • Aligning yourself with the right insurance broker – Risk management is complicated and goes well beyond buying insurance and providing reactive services. Your broker will quarterback your risk management efforts and it is critical you work with a brokerage that understands your business and has the right staff and appropriate insurance company relationships to effectively negotiate and market your program. The services offered by brokers differ dramatically and a formal broker selection process is recommended in order to make sure you are working with the right advisor.
  • Selecting the right insurance company – Insurance companies also differ greatly; some merely bear risk while others work with their insureds to manage risk. While price is important, you should consider the risk management services your insurance companies offer in addition to the pricing of their program.
  • Marketing your program – Have you given thought to whether or not it makes sense to market your program? As mentioned earlier, the key is to make sure you are with the right broker and the right insurer. If you are, you should have your broker take your program to the market every 3 to 5 years to make sure you have the right insurance company at the lowest realistic cost. We don’t recommend you market your program every year as insurance companies that see a risk over and over will stop quoting it at some point. We refer to this as market fatigue.

Retention can be intentional or accidental. Ideally, it is intentional. Some exposures are low severity and should be retained and managed. Other exposures are low frequency and high severity and should be transferred (usually insured). Finally, some are high frequency and high severity and should be avoided.

Regardless, you should decide how much risk you want to retain and tailor your insurance program accordingly with appropriate deductibles and self-insured retentions.

Risk Review and Refinement

Risk management is a process that does not end with Risk Transfer. Nearly every major business decision will have risk management implications. Exposures change and need to be evaluated and effectively managed. Your designated Risk Manager needs to be kept in the loop on any changes that might affect the company’s risk profile, and he or she needs to discuss this with your insurance broker.


Cost of Risk is a concept many businesses have never thought about despite the fact that it is one of their largest expense items. An effective Risk Management Process will provide a logical approach to managing the risks that a company faces. The process doesn’t have to be complex; as a matter of fact, it should be simple and straightforward. The key is to have the support of the company principals and a qualified insurance professional who can guide you through the process.

Risk Definitions

Loss Exposure — Any condition that presents a possibility of loss, whether or not an actual loss occurs

Risk Analysis — The process of identifying and analyzing exposures to loss

Risk Control — Strategies and techniques designed to reduce the frequency and severity of a loss exposure

Risk Finance – Strategies to either fund risk transfer or pay for retained losses

Risk Management — The practice of identifying and analyzing loss exposures and taking steps to minimize the financial impact of the risks they impose