Risk Management

A five-step process to manage your company’s risk

Risk Management is a necessary part of every business and a disaster recovery plan is integral to any risk management program. This article outlines a five step process to assist in the evaluation of risk and help the business formalize a risk management document.

Step 1: Identify Exposures to Loss

Methods for identifying loss exposure include, but are not limited to, standardized questions, prior loss history, flowcharts, personal inspections and expert analysis. Four categories of loss should be identified: property, net income, liability and personnel. There are three dimensions to every loss exposure, including the type or value exposed to loss, the peril causing the loss, and the potential financial consequence of the loss.

While every business owner understands securing physical assets and making sure personnel are secure, other less noticeable issues can occur that may be overlooked. One of the most important aspects of identifying exposures is to brainstorm worst case, what-if scenarios.

This article focuses on four exposures typical to every distributor: fleet, invoice records, cylinders, power. The process will be via these exposures. For example, in the event of catastrophic weather, i.e., hurricane bringing winds and flooding, are fleet vehicles able to be moved? (Superstorm Sandy damaged over 250,000 autos due to flooding and other damage.)

While not always possible, can vehicles be moved out of the path of the storm?

How are your invoice records kept? Are they stored electronically? On site or off site? Backed up daily? If using a remote server/backup, is the site in the same region as your business in the event of a natural disaster?

Cylinders comprise a large portion of income and inventory. How are cylinders tracked? Are there paper records or electronic tracking?

How will the loss of power or other utilities affect your business?

Step 2: Examine Various Risk Management Techniques

Risk Management involves stopping losses from happening (risk control) or paying for those losses that inevitably will occur (risk financing). Risk control techniques include exposure avoidance, loss prevention, loss reduction, segregation, duplication and contractual transfer. Risk financing techniques can be broken down into two groups: risk retention or transfer such as insurance.

Using the exposure examples cited in Step 1, moving fleet units out of harm’s way is a risk control technique that may not always be practical. Risk financing the physical damage of the fleet could involve transferring the risk to a commercial insurance policy covering physical damage, or retaining the risk by self insuring the physical damage.

Utilizing a risk control method such as segregation of exposures, a company could physically separate invoices to a more secure site, or have duplicate invoices at an off-site facility. Insurance is available also as a risk financing method for valuable papers or accounts receivables to assist in reconstruction of invoices.

A risk control method for cylinders could be the use of cylinder tracking software. The backup of this software is another critical component in the risk management process. Those who do not use this method may transfer the risk contractually as part of the lease process. However, this method is still dependent upon being able to physically locate the cylinders at time of loss. Insurance is available for the physical asset on the value of the cylinder, as well as coverage for valuable papers/accounts receivables to assist in reconstruction of records.

Another risk control method could be obtaining cylinders from an unaffected location or directly from the gas supplier. While this is an effective method to reduce the potential loss, there is still the extra expense of having cylinders come from a longer distance or at a higher rate from supplier. Commercial insurance policies can provide loss of income and/or extra expense coverage for such situations if the distributor has a physical loss at an affected location. Confusion can come into play on the coverage trigger when the distributor has no physical loss at their location.

Loss of power is a critical component in any business. A loss prevention plan may be to have a backup generator installed on site or have portable generators available. Restoring power is critical to reducing loss of income. A risk financing technique would be the transfer of risk via business income and/or extra expense coverage.

Again, confusion can come into play when the distributor is down due to power outages/disasters that don’t physically affect their location. Coverage is only triggered when the distributor suffers direct damage from a covered peril. Coverage for “off-premises” utility services can be found in the commercial marketplace. A word of caution: Coverage generally excludes “overhead” transmission or communication lines. The coverage for overhead lines is extremely difficult to find in the marketplace.

Unlike a normal business, the adjustment of income loss looks at the prior month’s income level and post loss income levels. The history pre/post is expanded in the event of a natural disaster as the recovery period for a natural disaster impacts the customer base as well. While income levels may be impacted for a short time, it is possible that post-loss sales will increase substantially as products are in much greater demand during the recovery, potentially negating loss of income.

Step 3: Select the Best Techniques

The best technique is chosen based on a model of effectiveness—being able to achieve organizational goals such as profit level or growth; or a model of economy—achieving goals at the least possible cost.

Selecting the best technique for the risk management program depends greatly upon risk appetite, legal requirement, budget constraints and resources. Business owners have to look upon their tolerance for risk: Are you willing to take a financial risk against the probability of loss? Do you have legal requirements through some kind of contractual transfer or statute to cover certain perils? What does your budget allow between the transfer or retention of exposures?

Step 4: Implement the Techniques

Depending on the implemented technique using risk control or risk financing, the implementation is dependent upon the company’s delegation of technical risk management vs. managerial decision-making authority. Typically, risk managers have line authority— authority to give orders/direction over technical decisions, but only staff authority—the right to advise over managerial decisions. Decisions made by a risk manager may be presented to a committee for review or acceptance. In small companies, the owner or managing entity may make the sole decisions on the plan of action.

Step 5: Monitor and Improve

Monitoring the risk management program is essential to determine if the expected results are being achieved. Generally, acceptable standards are measured against a results standard; i.e., a decline in frequency or severity of losses. An activity standard measures the amount of activity that is focused on quality and quantity of risk management tasks. Over time, the plan is monitored to make sure the assumptions and techniques are in sync. As new exposures develop, they too have to be integrated. Risk management plans also have to be tested against the objectives set out for the organization, be they results or activity driven.

William McCloy

William McCloy holds the designation of associate in risk management and is the managing director-insurance programs at AMWINS Program Underwriters located in Charlotte, North Carolina, and at www.wdp.amwins.com.