Making Risk Easy!
8 Non-Financing Risk Control Methods, Avoidance #1 (check back every week for an another article)
Darius Delon, MBA FCIP CCIB RIMS-CRMP
In the dark ages (300 years ago), risk managements primary tool was insurance – buy enough of it until you feel good enough to sleep well at night. Good tool to use before the 1950’s and the invention of risk management.
Today the insurance industry has done a tremendous job in providing more insurance products (crime, environmental impairment liability, directors and officers, errors and omissions, and cyber) to address the risks that the organization faces thereby allowing the organization to avoid less operations and continue to maximize opportunities.
When do you avoid operations? Has insurance provided for all of your operational solutions when managing risk – no! Sometimes you need to avoid risks – but only after you have examined 6 other non-risk financing (insurance) solutions; reduction, prevention, segregation, duplication, diversification, and non-insurance transfer (plus a seventh – adaptation). Then you can insure the heck out of the risk or you can avoid the risk in its entirety. Remember, no risk – no reward.
What, Why and When to avoid risk? Manage and insure the risks that you fully understand and have control over and avoid those high hazard risks that take lots of resources that are not part of your core operations. For example, you manufacture a widget and decide to buy a truck and deliver the widgets to your wholesalers. People love the widgets – you manufacture more (build more manufacturing capacity) and you buy more trucks and train drivers. Your truck drivers are late, call in sick, form a union and are getting into accidents and shipments are not arriving on time or at all – sales are flat or reduced. You have lots of money invested in manufacturing equipment and trucks. The vertical integration looks like it is efficient and effective – ok, maybe not so effective. Probably not as efficient either if you were to factor in all your time and effort to buy the trucks, maintain them, hire good drivers, check their qualifications, train them, discipline them, rehabilitate their driving and eventually fire the bad ones after they have two accidents. It might not be efficient. Do the math – and consider avoidance if the conclusion is that it is neither; effective, efficient or part of your core operations.
Who and How to avoid the risk? Now that the conclusion is to avoid the risk you need to do it in such a way as you can get the benefit from avoiding the risk while taking advantage of your opportunity to sell products to a wholesaler. One possible solution, not the only solution, hire a third-party transportation firm to deliver your products. Make sure they are responsible for effective delivery and are responsible (contractually) for any loss of product, time delay, damage to the wholesaler warehouse, injury to their drivers, and damage to their vehicles and other vehicles on the road. When you are finished transferring the risk to the trucking company – make sure they have adequate insurance to pay for your damages and please have them prove it every year with a copy of their Certificate of Insurance.
In summary, there is an appropriate time to avoid the risk but please use this option sparingly since if you avoid all risks – you avoid all opportunity.
8 Non-Financing Risk Control Methods, Reduction # 3
Darius Delon, MBA FCIP CCIB RIMS-CRMP), Risk and Insurance Consultant – www.riskmanagement101.ca
We know to sparingly avoid risk and how to improve our prevention (frequency) effectiveness but what is reduction (severity) all about when not viewed in combination with prevention (frequency). Reduction by its very nature is the lowering of the impact by lowering the severity of the exposure.
Reduction is putting systems in place, such as administrative, engineered or personal protective equipment, that when an incident (fire, car crash, electrical short, chemical spill) occurs the severity of the incident is reduced due to the reduction system in place. The best example of this is a fire sprinkler system in a commercial building. If the sprinkler is fully operational in a building you can expect the fire loss to be one tenth of the total of a building fire that does not have a sprinkler or sprinklers that are not operational. I refer to a statistic published by FM Global, it states, on average, you can expect a fire loss to cause $400,000 worth of damage to a building with operating sprinklers versus an average loss of $4,000,000 when the sprinkler system is non-existent or not operating (valves turned off, valves partially closed, flow not monitored, pipes not maintained, incorrect sprinkler heads used for the occupancy, etc.).
Another great example is the system of safety protection in cars today. We started in the old days with bumpers to protect our pretty cars from physical damage (property reduction), and added lap belts to prevent us from flying through the windshield (injury reduction), lap and shoulder belts to prevent us from hitting the steering wheel and dash (further injury reduction), and airbags to lessen the injury potential further. Now we have safety systems (blind spot detection, lane keeping assist, automatic braking) that reduce the severity of the car crash beyond the reflex response of a human and in fact work to prevent the incident from happening in the first place (see 8 Non-Financing Risk Control Methods, Prevention # 2, earlier).
Let us not forget about administrative systems that reduce the severity and are as necessary as engineered systems. Having a First-Aid trained and qualified person in the office, just in case something happens (incident reduction – survive a heart attack). Telling your staff to not work alone (buddy system) when in an isolated space (in the middle of the arctic or in a confined space with restricted airflows). If they need to work alone, developing a system to help them if the need arises so they can first report their distress which starts the emergency response systems.
The most effective administrative system has full buy-in from leadership, engages the staff to know what training they need, provides the training, monitors the activity, disciplines people when they are not following rules (hopefully as a near-miss that is recorded) and trains the new staff – whether new to the site or new to the organization. The combination of appropriate risk avoidance, risk prevention and severity reduction goes a long way to significantly reducing inherent risk in your organization.
Beyond the systems, the one piece that I see missing in organizations is a cohesive risk awareness culture, that does not primarily rely on avoidance and insurance purchasing, that engages all levels of leadership and staff into identifying the risks and dealing with them in an appropriate manner. Some call this system holistic (looking at the entire body) risk management while managers of risk (including Risk Managers) call it Enterprise Risk Management (ERM).
QUOTES AND PUBLICATIONS - LINKS
CANADIAN UNDERWRITER - http://www.canadianunderwriter.ca/keyword/darius-delon/
Author: Darius Delon, MBA FCIP CCIB RIMS-CRMP
If an adult student attends your school do you owe them any Duty of Care? Yes, you do.
We generally understand that minor students need a higher level of Duty of Care on-site and off-site. They need a safe space, supervision, training for response in medical, fire or active assailant situations (not just teaching the subject matter in text books) and have a safety system in place in case of incident (police, fire, medics, hospital, counselling/family).
When we take away the safe space (existing school) we then need to replace it with something similar with the same standard of care. The same standard is easy to find in Canada and needs to be assessed outside of Canada since the environment is often different - sometimes extremely different.
Supervision of minors needs to be consistent with the local school - in terms of number of supervisors, their training and their orientation with the off-site location. How well trained are volunteer supervisors on the unique issues they will face in a foreign country (language, weather, crime, medical response, cultural sensitivities).
The safety system in other locations is sometimes vastly different - starting with what number to call for emergencies to an inability to call emergency services when outside of the major cities. The quality of the services, response times, could be significantly reduced when compared to Canadian wait times.
When we take away the Canadian safety system - we need to replace it with something similar with the same standard of care. If we cant replace it we need plans to counteract the issues (training, communication, first-aid).
When we replace the minor student with an adult student (post-secondary education) the Duty of Care does not revert to zero. As an organization you are saying these students will receive a benefit from attending a foreign credit/non-credit program and in effect require them to attend to graduate. You have different options available to you to manage adult students less supervision but this means more training and a greater reliance on systems for response - since often times there is little to no supervision when off-site in a foreign country. Who is your go-to responder when out of country incidents (medical, physical threats, emotional wellbeing, crime)?
The solutions are sometimes complex and expensive. However, the solutions have already been developed for others and you can learn from their experiences which means it becomes less complex and less expensive.
Time to assess your off-site travel/activity risks.
8 Non-Financing Risk Control Methods, Prevention #2
(Darius Delon, MBA FCIP CCIB RIMS-CRMP)
We know to not use the risk avoidance technique unless we absolutely have to. What does preventing a risk really mean – frequency reduction.
We know, as a non-statistical rule of thumb, that a catastrophic loss risk will occur once, there will be 10 intermediate losses, 100 small losses, 1000 losses under the deductible/threshold (awareness) and 10,000 near misses (most times not recorded or even acknowledged as a near miss (luck)). This is not a statistically proven model – just an example to orient people on the near miss to catastrophic loss ratios. Prevention works to reduce the catastrophic loss by reducing the number of near misses. There is no guarantee that a catastrophic loss will not occur but you are trying to spread out the period of time in-between catastrophic losses. This does mean that you are trying to eliminate the 10,000 near misses, this becomes your key performance indicator, on an enterprise wide (hazard, operations, finance, reputation and strategy) incident management perspective. This concept already works well from a hazard perspective (insurable risks) and can work really well from an enterprise wide risk perspective if the data is being collected – which it is usually not. Lack of data collection is the problem for enterprise wide management of risk.
How does this translate into your operations? Let’s use a university off-site student travel example. A 1000 students will leave Canada from XYZ University and travel to various countries rated from a low, mid and high security (assuming you do not send students to extreme risk countries) risk perspective. If the students were to travel on their own, without any orientation, the above 10,000/1,000/100/10/1 ratio (inherent risk) will apply. If you send 1000 students per year – expect a large incident in 10 years. If you provide each student with country specific training (places to go and not go, cultural sensitivity training, vaccinations, etc.) you could expect your near misses to reduce to 5,000 – spreading out your next large incident to 20 years. If you were to restrict the locations that students were able to visit to just low and mid-level security risk countries you could expect to perhaps reduce your near misses by 50%, perhaps 2,500, with a corresponding spread to your catastrophic incident frequency to 40 years.
In effect, you are reducing the frequency of all the ratio types – catastrophic, intermediate, small, under threshold and near, by reducing the near miss frequency.
At any given time, you can have a large catastrophic incident, either today, tomorrow or in 40 years which is why we do not try to manage the catastrophic risk with prevention. We try to manage the catastrophic, intermediate, and small with reduction.
Tune in next week for #3 in the series of Non-Risk Financing Risk Control Methods – Reduction.
8 Non-Financing Risk Control Methods, Segregation # 4
Darius Delon, MBA FCIP CCIB RIMS-CRMP
Risk and Insurance Consultant – www.riskmanagement101.ca
Segregation is defined as “...the action or state of setting someone or something apart from other people or things…”. Thanks Google. Another word for it is separation of items at risk or don’t put all your eggs in one basket!
A simple example, from a personnel risk perspective, is to limit the number and rank of staff that fly on the same airplane. If the CEO, CFO, COO and CIO, from a public company, travel on the same plane and it crashes the company that they worked for is at extreme risk of either; failure (bankruptcy), significant reduction in share value, reduced long term strategic prospects/sales or a reduced leadership in the short term. Any one of those four could cause a loss to the company but the aggregate value of the loss of all four would exceed the risk tolerance of most public companies. This is a great example of a risk that cannot be insured and the risk control method is purely policy based with very little incremental cost (each has to get their own cab to the hotel and cannot share the expense) and reduced of convenience. There is a loss of potential productivity if all four are seated together and discuss business but we can see that the catastrophic risk to the organization exceeds the incremental increase in potential productivity. A solution may be to allow 2 C-Suite members to fly on the same aircraft. This example does apply to just C-Suite members. Research teams, leadership in some departments, and activity based risks for all of the staff can create similar personnel risks. Does the reward exceed the black swan risk?
Some examples are not as simple. Consider a large commercial real estate portfolio (200 buildings at $100mm each spread across the ten provinces equally) and the amount of insurance you need to buy. The entire portfolio might have a value of $20bn spread out all across Canada – but you would not buy $20bn of property insurance limits, it is very difficult and expensive, to satisfy your financial risk. Most times a fraction of the total can be purchased and you would be able to sleep well at night. Some would insure for the highest value building, $100mm, but this does not take into account the region the buildings are situated in and the risks (fire, flood, earthquake, terrorism, other) they are exposed to. A relatively simple answer would be to insure the value of the whole city, $2bn, but you may still be over insuring the amount (although the whole city scenario is not a bad answer on the surface). The best answer considers the risks to the property (are some targets for political expression), proximity to other owned buildings (two owned buildings next to each other), the risk of the region (flood, quake) from an aggregate perspective (many buildings over a wide area are exposed to flood and earthquake), the owners of the property (political affiliation), the occupancy of the buildings (fireworks factory – don’t say it never happens – google it), the construction, elevation, etc. A full analysis should be completed if you want the best and most cost-effective answer. A thumb nail guess is ok if you are happy with a higher overall limit, expense and it fits your risk tolerance and appetite.
With these four risk control methods (avoidance, prevention, reduction and separation) you are now exposed to half the strategies available – how will you improve your organizational risk?