risk assessment

The Risk You Don’t Know Can Hurt Your Biz

Tom Bullen speaks on behalf of Premier Risk Management now part of the risk advisory arm of AETHOS Consulting Group in the Jennings Wire podcast.

Tom Bullen is with Premier Risk Management, the risk management advisory arm of AETHOS Consulting Group, a hospitality focused executive search and human capital services firm. AETHOS speaks with hospitality companies around the world and hears the concerns of CEOs and leadership, and the question of risk is always top of their minds.

Listen to the podcast here!

Who, What, When, Where – Does Your Risk Management Program Dig In?

We recommend using the 4W’s as a method of digging in to better understand the operations of a business. This concept is not new and sounds simple but is often not utilized appropriately.

The 4W’s concept can be used as the building blocks with a focus at all stages of operations when considering risk management. Here’s the problem; while every department head is very knowledgeable about their individual expertise it can be difficult if not overwhelming to think about it from the wide-ranging standpoint of risk.

“Digging In” – By using these four basic questions you can gather a wealth of knowledge about your business; the trick is to do this at the various stages of operation and not just the top-level thus coordination is important.

This valuable approach is overlooked and many times in Premier’s early analysis we find that businesses are generalized by the insurance industry and brokers. There is a lack of special attention to the individual company beyond “what is your business”.

This generalization becomes the cracks in the foundation … by doing these analyses you can better understand what risk you are accepting, how to transfer the risk, and/or mitigate the risk. While accepting risk is easy, when it comes to transferring risk most companies are unsure, and mitigating risk falls through the cracks because companies don’t know how to ask the right questions or utilize the services available.

After Premier “Digs In” we helps you better understand what risk to accept or transfer, ultimately we focus on mitigating risk. Imagine speaking to the insurance industry no longer being generalized but having a wealth of understanding. Not only will you be better prepared internally but since you are appropriately addressing risk this practice will result in lower premiums and lower total cost of risk. It’s a Win – Win.

Cyber Security – The Stark Reality

It’s in the news every day. Just recently there was a report of a breach at the IRS. You’d think that of all of the government entities holding personal information the IRS would be one to have an all but impenetrable and completely locked down system. In addition there is more and more media focusing on cyber-security related to smartphones and how easy it is for a hacker to gain access to phones and all of the information contained therein.

The hard fact is that cybercrime is pervasive. Cyber thieves are crafty and persistent in finding ways and opportunities to breach security to gain access to personal information and beyond.

Cyber Attack Realities

The Risk – If your business uses computers, chances are someone will try to hack them.

The Fallout – Data breaches can result in fines, litigation, business interruption and reputation damages.

The Solution – Having the right protocols and insurance policies in place can mitigate the damage caused by a cyber-attack.

The ramifications of a cyber-breach can be both financially and operationally catastrophic to any business. We live in a cyber-world where we must learn to deal with the associated risks from both a business and a personal perspective.

How can a business best deal with Cyber Security?

Start by performing risk assessments from both an IT as well as an insurance perspective. As technology is constantly changing, this should be done on a continuous basis. Insurance coverage aspects need to be evaluated in-depth as exposures for each business entity, as well as specific coverage offerings, will vary from insurance company to insurance company. Do your due diligence. Here are just a few of the areas to consider when limiting exposures and liability:

Initial Steps in the Risk Management Process

Businesses should first focus on developing a robust internal risk management program, including the establishment of strong policies and procedures; Training and insurance can reduce the chances of a data breach and mitigate the damages if a breach occurs.

In general an organization should review the following areas to begin developing a well-rounded risk management program:

Corporate Security policy
Asset classification and control
Personnel security
Computer network and management protocols for vulnerability
System access controls
Privacy and regulatory compliance

Then, ask yourself “what does our company have in place to mitigate our exposures?”

Do we have an effective privacy policy? A policy that your company does not follow is worse than not having a policy at all; therefore, ensure that your policies are distributed among, and followed by, employees.
Do we have an effective privacy breach response plan? Review your incident response plan regularly and ensure that the team members are prepared to jump in when an incident occurs.
Do we continuously test our disaster response and business continuity plans? Work closely with your business partners to ensure that they are properly handling your confidential data. Vendors are the cause of at least 1/3 of all data security incidents.

Continually Assess Risks and Exposures

Companies should continuously assess risks, exposures and insurance policies. It is imperative to conduct a yearly security risk assessment to identify any vulnerability in your processes and procedures for handling confidential data. Some laws, such as HIPAA, require periodic risk assessments, and as such it is good practice as organizational risks change with changing practices.

An assessment might be as simple as asking the following questions:

What are our risks/exposures? These can be broken down into two parts, first party claims and third party claims:

First Party Claims would include Forensic Examination Expenses; PCI/PFI Audit Costs; Privacy Notification Costs; Privacy Counsel Fees; Mailing Notification Costs; Credit Monitoring & Call Center Services; Business Interruption (loss of income); Intellectual Property Loss; Public Relations; Extortion.

Third Party Claims include Claims by Private Litigants, Consumers, or other businesses; Claims by State Attorney Generals; Claims by FTC; Regulatory Fines & Penalties; PCI Fines & Penalties; Loss of Business; Damage to Reputation

Insurance coverage aspects address the exposures listed above. However, keep in mind that each insurance carrier will have various definitions, terms and conditions that will play a part in each of these coverage areas. Some of these terms include:

Invasion of Privacy and Identity Theft
Breach of Security, Network Disruption
Intellectual Property
Errors & Omissions
Defamation & Product Disparagement
Discrimination & Harassment
Extortion
Digital Theft & Forgery
Business Income
Disaster Recovery
Crisis Response Costs

Consider:

What are the threats? Cyber criminals, organized criminal groups, Bot-network operators, hackers, insiders, phishers, spammers, corporate espionage, even terrorists.
Where are we exposed? Corporate intellectual property, employee data, client data, third party data, web sites, social media outlets. What parts of our systems are at risk?
What are the gaps in our existing coverage? What’s covered and what’s not – how will our policy respond is there is a cyber-security event? How can the gaps be addressed?

The bottom line here is that cyber-attacks and data breaches have become an everyday threat to both individuals and businesses. The diverse types of cyber risks are ostensibly limitless and it’s all but impossible to predict exactly how and when you or your business may become a bull’s eye for cyber-criminals. Be diligent in your efforts to control what you can and mitigate exposure where possible.

Cost of Risk & The Price of Your Risk Management Program

Every facet of your organization affects your cost of risk. It is difficult, at best, to quantify all aspects of this total cost of risk. For example, if you manufacture specialty equipment or products and you are faced with a recall, what is your loss of reputation or market share? In contrast, other components of your total cost of risk are easily quantifiable, such as insurance premiums, or the downtime of a custom piece of machinery and the resulting lost production.

Total cost of risk is an insurance term describing the cost of both pure and speculative risk. Additionally, cost of risk is synonymous with price — the price of your risk management program. By taking a total cost of risk approach you can positively affect your price.

The goal then is to structure a risk management program that protects the four main asset categories of your business:

Organization
Personnel
Property
Net income

The structure of your risk management program looks to the endgame of your price. To reach the endgame you seek, you must first further define Risk Management into four key tenets:

Identification of exposures through analysis
Implementation of control measures to those exposures
Risk transfer or financing
Management of current and future exposures

Identification of Exposures – Things to Think About

Exposures are both qualitative and quantitative. Analyses into both arenas offer the starting foundation of understanding your current exposures to develop forward-thinking approaches. The qualitative discussion will confirm if the business initiatives are in correlation to the risk management program.

As a CFO, you should look to confirm that your risk management approach supports your overall business objectives. What risks or concerns do you have relative to your business i.e. what type of event would shut you down? If that concern happened, how would your income or cash flow be affected if there were unforeseen depletions of capital or a shutdown in the plant?

A discussion on the qualitative aspects of your business provides the important details needed to solidify the most appropriate game plan to your endgame, price.

What is your viewpoint on risk? Are you/your company risk averse? Is your company in a financial position to take on more risk versus transferring that risk to another party or contractually to a carrier?

To help determine your risk aversion, it helps to assess your company history. For example, if you are a start-up company, cash flow and funds are typically tight, so you are more likely to be adverse to risk to protect the financial viability of your start-up organization.

Conversely, if your company has a 20+ year history, there are also risks, including becoming obsolete, stagnant, or too conservative with your business plan.

Furthermore, consider your industry, market position, and competition in positioning your risk management solution to the changing needs and direction of your business.

Quantitative analysis supports the qualitative interview. Look at the “hard numbers” and prior losses to identify trends in your performance. Also analyze losses to identify a variety of variables, such as:

average incurred costs per loss
total incurred trends
top loss drivers
locations with high frequency issues
fraud behaviors
reporting lag time
frequency vs. severity ratios
OSHA recordable performance

The results of this type of analysis will reveal opportunities to approach the critical areas driving your total cost of risk, price. This evaluation will help to isolate the root causes of these problematic areas and look to implement control measures to mitigate this exposure.

Implementation of Control Measures

Now that you have identified exposures you can focus the appropriate resources to areas that will deliver the highest impact on your bottom line. Control measures should be designed from a pre-loss perspective.

An estimated 75 percent of commercial insurance expenses are claims driven. Look to control and reduce this percentage through pre- and post-loss control measures.

A comprehensive loss control evaluation points to strengths and weaknesses in loss control programs. One may have strong management leadership behind his or her initiatives but have no employee buy-in or participation. Create a risk reduction culture, establish a safety committee, delivering a comprehensive employee safety education campaign. Your business operations will determine the types of measures and approaches to take in addressing your exposures.

There are many post-loss or cost containment strategies. A proactive and effective Return to Work program is one strategy that positively affects your bottom line: offering a bank of modified duty jobs for employees and informing the doctor there is modified work available.

Also, establish a relationship with a local occupational medicine clinic. Interview them to learn about their services and tour their facilities. Invite the physicians into your business to get a first-hand look and understanding of your operations. By providing them with the details of your operations, they can accurately evaluate reported injuries to confirm if they are work related.

Fraudulent claim behavior can drive the cost of risk out of control. The National Insurance Crime Bureau often approaches insurance fraud rings between doctors, physicians and people. Whether it’s an auto accident or alleged workplace accident, send a clear message that fraud will not be tolerated.

Anti-fraud tactics include educating employees on the effects of insurance fraud through payroll stuffers and worksite posters, and offering safety incentives for solid performance. Also, keeping a motor vehicle accident kit in each one of your company vehicles, along with a disposable camera, allows you to document evidence, providing a stronger subrogation results.

An active Loss Control Program and post-loss procedures are key to cost containment.

Risk Transfer/Financing

Once you have identified exposures and created control measures, you can focus on the remaining exposures to transfer and/or finance. You will want to address questions such as: How much risk can you afford to assume in-house? How can we assist in contractually transferring that risk to a third party? Lastly, what portion of the exposures do we want to finance through an insurance policy?

Addressing these questions offers a direction as to how to approach the financing of your risk. Think about current cash flow needs. Are account receivables current? If there is a lag, how long is it, and are there resources to correct it?

Considerations involve self-insured retentions if you have a mature loss control program and the financial reserves to cover those shock losses that occur. Therefore, a combination of insurance and non-insurance strategies should be considered.

Manage Your Exposures

It is estimated that 25 percent of businesses that sustain a major catastrophe are no longer in business within a year’s time. If there is an interruption in your operations, are you prepared?

In a dynamic business environment, risks and exposure change constantly. Therefore, continual monitoring of the programs in place is essential, as well as future business expansions, will help to dictate the course of your risk management program.

We highly recommend you:

Develop a Strategic Action Plan to put the needed control measures in place, including a Disaster Recovery Plan. This involves backing up your policies and procedures.

Offer consistent loss control policies and procedures to all divisions and departments within your organization.

Cost of Risk Resources

To develop the most appropriate risk management program for your organization, you should look to approach ‘insurance’ through a variety of insurance and non-insurance strategies, such as:

Identification processes (qualitative and quantitative)
Loss analysis tools to uncover exposures
Implementation of pre- or post-loss initiatives that address cost containment
Business continuation planning/disaster recovery
Risk financing options, retained losses or transferred
Regulatory compliance issues

As you can see, risk management and protecting your organization is not about just buying an insurance policy. It is about developing a strategic action plan, execute on that plan, and fully commit to the monitoring and support of those initiatives.

“Total cost of risk is an insurance term describing the cost of both pure and speculative risk. Additionally, cost of risk is synonymous with price — the price of your risk management program. We at Premier Risk Management take a total cost of risk approach to positively affect your price.” We dig deep to advocate for you.

This Cost of Risk, Price Control Risk Insights is not intended to be exhaustive nor should any discussion or opinions be construed as legal advice. Readers should contact legal counsel or an insurance professional for appropriate advice.

Risk Tip: 2 important tenets of risk management

Don’t risk more than you can afford to lose…& don’t risk a lot for a little.

Comment: These two are both basics – the first refers to the idea that if you don’t have enough money to pay for the exposure to loss (risk) out of your pocket/balance sheet, then insure for the risk, transfer the risk or avoid the risk. This becomes the client’s comfort level with the risk at hand. Some companies are very comfortable with risk – they plan for it and manage it. Some companies are very uncomfortable with risk and want to chance nothing.

The second has to do with the fact that a business organization can protect vast fortunes and assets for a relatively small amount of money, comparatively speaking. That would be the prudent move for any business owner.

Bottom line: Everyday and in just about everything we do we are faced with risk. Sometimes we choose to take the risk – sometimes we are a little more conservative. No matter how big or how small the business, we all must make choices relative to appropriate risk tolerance for that business. Therefore we must know what those risks are and what the choices and alternatives are to better protect the business organization.

Risk Tip: How to tailor a risk management program

An organization’s risk management (insurance) program must be tailored to its overall objectives and should change when those objectives change.

Comment: An insurance broker/advisor cannot recommend insurance products and services without knowing what the client actually does, how they do it and what is important to them with regard to their insurance program. Once it is known what they do, how they do it and what their objectives are they can be better advised in terms of coverage and exposure to risk. However, many times this step in the risk management process is overlooked or not addressed in the detail that it should be. Unfortunately, in the haste to sell product coverage issues, exposures are often missed. In addition, every business is a moving target, in that, it is constantly changing and/or the business environment around them is changing. To further that thought, brokers/advisors have to continually keep in touch with their clients in order to find out where they are taking their businesses and how they intend to go about it.

Have operations changed?
Are any mergers or acquisitions on the horizon?
Has there been a bump in the number of employees?
Are there any new tenants that may create an increased hazard?

By paying close attention to the client’s business operations and understanding their objectives, a true risk management program can then be developed and managed. Over time this will serve to limit their exposure to new risks and thus save money.

Bottom line: Have a detailed risk analysis performed of the business exposures you face along with a review of your business plan. Then develop a plan to address those exposures.

Contact us for a FREE consultation >>>

Decisions, Decisions, Decisions…are you capable of making them?

In a recent Harvard Business Review post by Nick Tasler 3 Myths That Kill Strategic Planning, he shares that the most “precious ability” a great leader has is his or her ability to make decisions based on strategic thinking. He uses a Napoleon quote to make his point:

“Nothing is more difficult, and therefore more precious, than to be able to decide.”

It may seem like common sense but decisions go hand in hand with knowledge and as the old saying goes “knowledge is power”. However, leaders should ask themselves – “Do I feel comfortable enough to solely make decisions?”

The goal of get things done well, deciding where to focus, and ultimately having an actionable decision could also be the chapters seen in a risk management 101 course. The reality is, senior management typically wear multiple hats and suffer from resource constraints when it comes to risk management. So the question again is – “do you feel comfortable with the go-at-it alone approach?” As Nick stated in his blog “strategic thinking is about deciding on which opportunities to focus your time, people, and money.”

Fortune 500 companies utilize the knowledge of an in-house risk manager to assist with strategic thinking and in the past many middle market firms assumed an adviser was unnecessary given the presence of a broker. While a broker offers a certain level of knowledge, an outsourced adviser’s knowledge does not come with the sale of a product and the broker relationship is maintained like it does with Fortune 500 firms. Times have changed and in the absence of a full-time in-house risk manager, many middle markets firms have realized the need of an outsourced adviser. It is becoming an industry standard and the companies are realizing both the short and long-term benefits.

While Nick clarified the 3 myths that kill strategic planning; the shortage of knowledge can also be a killer.

Approaches to Risk Management: Part 3 Enterprise Risk Management (ERM)

In parts 1 (The Basic Concepts) & 2 (Digging Deeper) we gave you the “traditional silo” approach to risk management. Another school of thought we would like to share is ERM – Enterprise Risk Management.

ERM is a framework to identify risk that typically involves identifying particular events or circumstances relevant to the organizations objectives (risk and opportunities) …assessing them in terms of likelihood and magnitude of impact …determining a response strategy …and monitoring progress.

Some of the primary risk functions (departments and committees) in larger organizations that may participate in an ERM program typically include:

Strategic Planning – it identifies both external threats and competitive opportunities, along with strategic initiatives to address them.
Compliance & Ethics – monitors compliance with code of conduct and directs fraud investigations.
Operations Management – ensures the business runs day-to day and that related barriers are surfaced for resolution.
Accounting /Finance Compliance – directs the Sarbanes-Oxley Section 302 and 404 assessments, which identifies financial reporting risks.
Insurance – ensures the proper insurance coverage for the organization
Marketing – understands the target customer to ensure product/service alignment with customer requirements
Treasury – ensures cash is sufficient to meet business needs, while management risk related to commodity pricing or foreign exchange.
Law Department – manages litigation and analyzes emerging legal trends that may impact the organization.
Operational Quality Assurance – verifies operational output is within tolerances.
Credit – ensures any credit provided to customers is appropriate to their ability to pay.
Customer Service – ensures customer complaints are handled promptly and root causes are reported to operations for resolution.
Internal Audit – evaluates the effectiveness of each of the above risk functions and recommends improvement.

Each department of the management team then selects a risk-response strategy for specific risks identified and analyzed, these may include:

Avoidance: Exiting the activities giving rise to risk
Reduction: Taking action to reduce the likelihood or impact related to the risk
Share or insure: Transferring or sharing a portion of the risk, to reduce it
Accept: No action is taken, due to a cost/benefit decision

Each approach described in this blog post series – “Traditional Silo” and the ERM Model – has its advantages and disadvantages. Each approach, utilized separately, is not fully valid as a comprehensive stand-alone approach.

Every business large or small faces many of the same issues just in different ways and varying degrees. A melded strategy will position company principals to investigate both internal and external risks that can and will affect their business at some point in time. The bottom line is that a well thought out strategy needs to be developed touching upon a wide variety of an organizations business operational issues. Another point to keep in mind is that risk management is an ongoing process…the risks we face today may not necessarily be the ones we face in the future.

Approaches to Risk Management: Part 2 Digging Deeper

In part one of this series, Approaches to Risk Management: The Basic Concepts, we recommended you analyze your business risk management program from 7 major aspects. Beyond these basic concepts, some academic authorities suggest the following as necessary considerations in the development of a formal Risk Management Process as well.

Assets & Exposures – it all starts here. What exactly are your company’s risks and exposures? Look at everything and think outside of the box.

Measure the Risks – qualitative and quantitative analysis for severity – probably loss and estimated maximum financial loss from each occurrence and for frequency – probability of loss occurring. Be in a position to identify problem areas…this is only possible if you have devised a way to analyze your loss information.

Control the Risks – both before loss and after loss. Be in position to limit or mitigate exposures via loss control methods before the loss occurs…that way anything that falls through the cracks can be addressed as part of the post loss evaluation to limit repeat occurrences.

Finance the Risks – how are losses to be paid for? Transfer it to an insurance company or to your balance sheet? Think about it.

Risk Administration and Communication – this involves the implementation and monitoring of the risk management program. Who is going to be assigned to oversee this?

There are many sub-components to each of the categories, which can be considered after these fundamental issues have been evaluated. This subject matter is complex. There are many “moving parts”. Below are a few select areas that certainly rank high for additional review and deeper digging.

Operational Risks – Manufacturing, sales, labor, supply lines, distribution lines, shipping, storage, inventory, advertising, internet and web site usage and disposal of waste to name a few.
Exposure to Business Income Interruption – It is all about the potential for the flow of income being interrupted. Every business has its own unique exposure based on the way they individually conduct business. The question becomes, how can those operations become interrupted? Important point – it’s not just your business but it is those businesses that you rely on to sell to or to receive goods from in order for you to continue your business process.
Physical Risks – these are the risks you face when you own, lease or rent property. What are the exposures that are faced under each scenario?
Financial Risk – Here you are considering such things as cash flow, financial markets, credit risk, lending, liquidity and being over-leveraged or under-leveraged. These issues all play a part in determining how a proper risk management program should be set up.

The important point to illustrate here is that there is a process to be followed and to give you something to think about. As you can see, there is more to it than getting renewal policies and putting them up on a shelf. What was discussed in this and the previous blog is referred to as the traditional “silo” approach to risk management. In our next blog, we will look at another approach to risk management…Enterprise Risk Management (RM).

The Bold Truth About Risk Assessment

Risk Management by definition is the practice of protecting an organization from financial harm by identifying, analyzing, and controlling risk at the lowest possible cost.

This is a very blunt definition that should be top of mind when discussing the purchase of an insurance product or discussing other risk management techniques. The challenge is to think about ways in which to reduce costs, properly communicate the pros and cons of each choice and arrive at the proper solutions that will best protect the organization.

Now add to that definition ACTIVE identification, evaluation and management of all potential hazards and exposures to loss that a company may experience. It is absolutely essential that you keep informed about things going on around you — locally, nationally, and internationally — that bristle with the potential to affect your business/organization in an adverse way. Once you recognize a certain “exposure”, you must act on it one way or the other. And, obviously, one of the “act on it” steps may be classic insurance.

And finally this process should be CONTINUOUS. It’s not appropriate to establish or simply renew your insurance program and then put it up on the shelf until next year. Risk management is a constant practice that begins even before a policy is written and does not really end at all. It is a work in progress where you continually look to improve coverage, terms, conditions, claims reporting/handling, loss control/mitigation, exposure analysis/identification and the like, year after year.

Protecting your organization from financial harm is the #1 goal. Doing that, at the least possible cost, is admirable (but not practical) – you must be actively involved in recognizing potential exposures and hazards on a continuing basis throughout the year.

Jump in with both feet and ask, “How can we improve our risk management program today and tomorrow and beyond?” That’s a question you should consistently consider.