WHAT IS RISK MANAGEMENT?
Most entrepreneurs are risk takers, willing to invest resources with an expectation and hope, but no guarantee, of reward. But, from the viewpoint of insurance, "risk" is another word for "peril" and refers to things that can go wrong. Crime, vandalism, fire, a personal injury lawsuit, a computer virus, equipment breakdown, nondelivery of raw materials, death or illness of a key employee—the list of adverse events which can cause economic harm to your business or organization goes on.
Risk management is a broad topic. It involves taking steps to minimize the likelihood of things going wrong, a concept known as loss control. It also involves the purchasing of insurance to reduce the financial impact of adverse events on a company when, despite your best efforts, bad things happen. No one likes thinking about what could go wrong. Nevertheless, as a prudent manager, you should understand the risks your business faces. Until you identify risks, you can't make good decisions about managing them.
RISK MANAGEMENT REQUIRES LEADERSHIP
Risk management, particularly loss control, begins at the top of any organization. If the head of company makes it a point to emphasize safety, compliance, and lawful and ethical behavior, the rest of the organization is more likely to follow suit.
Risk management costs money, but the costs of not paying attention to safety concerns and not purchasing insurance can be far higher in the long run than any front-end savings. While small companies typically do not hire full-time risk managers, risk management should not be left to chance. Specific individuals should be required to take responsibility for safety and compliance programs as well as for insurance matters.
RESOURCES FOR RISK MANAGEMENT
Thanks to the Internet, all organizations have easy access to enormous amounts of information on risk management, including loss control measures, safety, compliance and disaster preparedness and recovery. Extensive checklists and suggestions of a general nature are available as well information tailored to specific types of businesses. Check the resources available from your insurance company.
One useful resource is your insurance agent. Invite the agent to tour your premises and discuss how you are currently managing risks. He or she will be able to evaluate your actions and offer suggestions.
Depending on the nature of your business, it may be a wise investment to engage a risk management consultant.
LOSS CONTROL AND INSURANCE
Effective loss control—reducing the number and size of losses—may impact both the availability and affordability of insurance.
A business that is indifferent to loss control may have a higher than average number of insurance claims. A really poor loss history can make it difficult to find insurance. Conversely, businesses that actively manage risks, and thereby control losses, will have fewer claims and will often see those efforts rewarded with lower insurance premiums.
PREVENTING FIRE LOSSES
Over time, experts have identified the most frequent causes of loss and how to reduce the extent of damage when accidents occur. Below are questions designed to help you decide whether you need to take additional precautions to control the risk of fire.
REDUCING VULNERABILITY TO THEFT
Businesses face various types of theft, including burglary and robbery by outsiders, theft by insiders and identity theft.
Burglary - Burglary refers to crimes involving the unlawful entry of a structure with or without force. Burglary prevention starts with making your premises an unattractive target by creating barriers to illicit entry. Appropriate measures will vary depending on the type of business, the premises and the location. For some businesses, security needs may be met simply by leasing a professional office in a building with good security and assuring there are strong doors and appropriate locks. This is particularly true for organizations in low-crime areas without high-value goods on the premises.
An enterprise in a building with numerous entrances and windows, located in an area with a high-crime rate and having high-value goods on hand presents a different picture. Whatever type of business you have, your insurance agent, locksmith, police department and a security consultant can provide information on how to make your premises harder to burgle. They may recommend such improvements as steel doors that fit tightly into doorframes, shatterproof window glass, stronger window locks and a fence around the premises.
Exterior lighting deters burglars. The fewer dark places around your facility, the better. Don't let trees or shrubs grow around windows. These provide an opportunity for criminals to conceal what they are doing. Keep dumpsters away from the building.
Valuable property should be locked up to further deter theft. You may want to invest in an alarm system that rings in the police station or at a private security firm.
Robbery - Robberies involve the taking of valuables from another person(s) by force or threat of force. If you receive cash in your business, train employees what to do in case of robbery. Your local police department can assist you in developing training material. Limit the amounts of cash in cash registers.
Insider Crime - Many businesses put a great deal of effort into protecting their property from theft by outsiders but neglect to put an equal effort into preventing insider theft. Employers should not underestimate the risk of trusted employees stealing from the company.
Loss control experts at the Association of Certified Fraud Examiners (ACFE) encourage employers to adopt two strategies to prevent internal theft: increase the perceived probability of discovery and decrease the probability that an employee will commit the crime.
The ACFE recommends stringent accounting controls, which your accountant can help you create, and frequent audits. Having a policy that gives honest employees a way to report theft by their co-workers without fear of reprisal helps cut down insider theft, as does emphasis on ethical practices, rewarding company loyalty and having clear performance standards.
Identity Theft - Identity theft occurs when an individual uses someone else's personal information to commit fraud. Federal law requires businesses to provide identity theft victims with transaction records relating to their identity theft free of charge.
CONTROLLING LIABILITY RISKS
A person cannot prevail in a liability lawsuit against your business or you personally unless he or she can convince the judge, jury or other adjudicator that you breached your legal duty to that person. Examples of such duties include: Making a reasonable effort to maintain a safe environment for the public
In general, to reduce liability risks, you must behave lawfully and with demonstrable responsibility for the welfare of third parties—a group that includes your clients or customers, competitors and the general public. Additionally, you must obey a variety of civil rights laws and other laws that give rights to your employees (if you meet the criteria of a covered business).
If you can provide evidence that you took your responsibility seriously and made reasonable efforts to prevent harm to others, you are much less likely to be found liable. Evidence can be in a variety of forms, depending on the nature of the liability risk. A few examples are:
Notice that in most of these examples, some form of written record is involved. Documenting your efforts to behave lawfully can be vital to proving that you are not liable.
For almost any type of venture, you may find extensive and specific information on reducing liability risk exposures from your insurance agent and insurance company, trade association and the Internet. Briefly discussed here are some areas of concern that apply to many types of business. They include:
Slip and Fall Accidents - These are one of the most common liability risks. Thousands of people are injured every year—some very seriously—in slip and fall accidents on business premises.
Employee training is critical to reducing your slip and fall loss exposure. All employees who are likely to be around third parties on your premises should be trained about what to do should someone suffer a fall. Medical care should be quickly provided to the injured person even if that means calling an ambulance. People who feel they were treated callously or indifferently are more likely to sue.
Elimination of slip and fall hazards should be a periodic scheduled activity. It may be helpful to use a checklist for this. Considerations for indoor areas include:
Considerations for outdoor areas include:
If there are treacherous areas—such as an uneven area of the sidewalk or a ripped carpet—consider marking them as such, using signs to warn people away and putting up barriers around them.
Employment Practices Liability - Federal law restricts employment decisions based on race and national origin, religion and creed, gender, age and disability. The restrictions on race, religion, gender and disability apply to businesses with 15 or more employees. The restrictions on age apply to businesses with 20 or more employees. An employee who feels discriminated against might sue making such charges as extreme emotional distress or wrongful termination. It is not a defense in such cases to say you didn't know your actions were unlawful.
Larger employers typically provide formal training to management and employees on compliance with civil rights laws. As a smaller organization, you may feel you cannot afford the time or money for such programs. There are many lower cost ways of carrying out this training. The Equal Employment Opportunity Commission (EEOC), for one, has low cost materials just for small businesses.
Hiring Practices and Liability Avoidance - Immature, careless and irresponsible people are much more likely to engage in risky behaviors—from reckless driving, to sexual harassment, to cutting corners on safety rules, to stealing from their employers. Similarly, people who have drug and alcohol addictions are liable to present a variety of workplace dangers. The first step in cutting down on your liability exposure is to be as careful and thorough as possible about whom you hire. Failure to use a reasonable screening process for new hires could even expose you to negligent hiring liability.
Clear job descriptions and workplace rules, disseminated to all employees and applied consistently and without favoritism, can be a tremendous help in minimizing the risk of unacceptable behavior.
MANAGING PRODUCT LIABILITY RISKS
One of the most important ways to reduce potential product liability claims is keeping scrupulous records over the entire life of a product, from design to obsolescence. In the event of a product liability lawsuit, those records would be very important to show that you behaved with reasonable concern for the welfare of others.
To reduce the possibility of harm, your products should be carefully designed and fully tested to specifically identify possible product hazards all along the way. Provide the customer with thorough and detailed information about the product and appropriate warnings. Identify products for purposes of prompt recall and have a recall plan.
Loss control experts also recommend that you investigate, follow-up and document all customer complaints, even those that seem minor. This demonstrates your concern about your customers and shows that you take your duty to be responsible for the safety of your product seriously. Complaints could provide an early warning of a possible safety problem or other risk.
RISK MANAGEMENT FOR INFORMATION TECHNOLOGY
The greater the role that computers, the Internet and e-commerce play in your business, the more exposure you have to both property and liability risks involving information technology.
Digitally stored information is subject to many of the same risks as any other property (fire, flood, tornado, etc.) as well as special risks (computer viruses, malicious hackers, etc.). To prevent the loss of your accounts receivables, customer orders, client records or other such data, you should back up the data regularly and often and store the backup copies in a separate, secure location. Prevent data loss or corruption by viruses and hackers by keeping up-to-date antivirus software and firewalls on all your business computers.
If you rely on a Web site, either you or your Web site host should back up all critical material at least daily. To assure your Web site doesn't go down, a real-time “mirror image” of all your site data should be maintained so that it can be transferred immediately if the original site crashes for any reason.
Digital technology also presents liability risks. You could be sued if there is a breach of your security and sensitive information about others is exposed or stolen. Make sure you use reputable vendors. You could face a lawsuit claiming that your Web site uses another's copyrighted material or slanders someone. Some measures that could help control these risks include:
REDUCING MOTOR VEHICLE RISKS
Traffic accidents are the number one cause of on-the-job fatalities. Effective risk management can reduce the number of injuries and deaths and the potential liability lawsuits that may result from accidents in which employees were involved.
These are some recommended practices:
REDUCING THE RISK OF WORK-RELATED INJURIES
For most employers the cost of an employee's work-related injury is covered by workers compensation insurance, which pays for medical care and replaces some of the income that the injured employee lost while unable to work. There is no coverage, however, for the hidden costs to your organization of that injury, such as reduced efficiency, the cost of training replacements and increased overtime expenditures. The effects can be particularly pronounced in a smaller enterprise.
On-the-job injuries or vehicle accidents aren't limited to occupations that are obviously dangerous. In most years the top three causes of injuries in the workplace are overexertion (injuries caused from excessive lifting, pushing, pulling, holding, carrying or throwing of an object), falls on level ground and bodily reaction (injuries from bending, climbing, slipping or tripping without falling). Such injuries can affect workers in most environments. Whatever your industry, attention to such risks can pay dividends.
Employees should be trained to recognize hazards and to report them to the appropriate person so that the hazard can be corrected as soon as possible. Work requirements involving safety should take precedence over any other.
Any near miss, first aid incident, accident or other workplace injury-related event should be investigated. Where possible, the investigation should be carried out immediately by a team that includes both management and hourly employees, all of whom have been trained in incident investigation. The goal of investigations is to identify the cause of the accident or injury rather than assign blame and to correct any hazards or other problem found, such as poor communication.
Supervisors and managers should also be trained to recognize and correct unsafe behaviors that can lead to injuries, including rushing, frustration, complacency and fatigue.
Once a year a team should review all incidents from the prior year to see whether there are any patterns in the accidents and, if so, how to address the problems identified.
Each work site should confer with its fire and police departments and hospital about plans for all potential emergencies, including fire, explosion, accident, severe weather, loss of power and violence. Emergency drills should be used to ensure that employees know what to do and to assess the effectivenes of emergency plans.
Depending on the size and nature of your business, you may want to have employees on each work shift trained by qualified Red Cross instructors to provide first aid and CPR. Someone should be designated to keep first aid kits stocked and accessible.
For additional information, visit the Web site of the Federal Occupational Safety and Health Administration. Other useful resources include your insurance agent and insurer, trade or industry organizations and the Internet.
DISASTER RESPONSE AND RECOVERY PLANNING
Every year disaster strikes a certain number of small businesses, whether it is fire, earthquake, hurricane, tornado or something else.
To reduce the destructive impact of these disasters, you should have a plan—both to respond to the immediate emergency and to get your business operating again, even if your usual premises and business equipment and materials have been destroyed. This requires careful advance planning. You may find helpful the publications and small business planning aids from the nonprofit Institute for Business & Home Safety (IBHS), an insurance industry organization whose purpose is to make homes and businesses safer from natural disasters.
Generally, risk management experts recommend the following actions as preparation for immediate disaster response:
Consider how you would resume critical business operations quickly after the total destruction of your premises and the property located there. As part of the plan, you need to line up alternative facilities, replacement equipment, supply sources, etc. Here are some suggestions:
Source: Insurance Information Institute www.iii.org