Risk Management

WHAT IS RISK MANAGEMENT?

Most entrepreneurs are risk takers, willing to invest  resources with an expectation and hope, but no guarantee, of reward. But, from the viewpoint of insurance, "risk" is another word for "peril" and refers to things that can go wrong. Crime, vandalism, fire, a personal injury lawsuit, a computer virus, equipment breakdown, non-delivery of raw materials, death or illness of a key employee—the list of adverse events which can cause economic harm to your business or organization goes on.

Risk management is a broad topic. It involves taking steps to minimize the likelihood of things going wrong, a concept known as loss control. It also involves the purchasing of insurance to reduce the financial impact of adverse events on a company when, despite your best efforts, bad things happen. No one likes thinking about what could go wrong. Nevertheless, as a prudent manager, you should understand the risks your business faces. Until you identify risks, you can’t make good decisions about managing them. 

RISK MANAGEMENT REQUIRES LEADERSHIP

Risk management, particularly loss control, begins at the top of any organization. If the head of company makes it a point to emphasize safety, compliance, and lawful and ethical behavior, the rest of the organization is more likely to follow suit.

Risk management costs money, but the costs of not paying attention to safety concerns and not purchasing insurance can be far higher in the long run than any front-end savings. While small companies typically do not hire full-time risk managers, risk management should not be left to chance. Specific individuals should be required to take responsibility for safety and compliance programs as well as for insurance matters. 

RESOURCES FOR RISK MANAGEMENT

Thanks to the Internet, all organizations have easy access to enormous amounts of information on risk management, including loss control measures, safety, compliance and disaster preparedness and recovery. Extensive checklists and suggestions of a general nature are available as well information tailored to specific types of businesses. Check the resources available from your insurance company.

One useful resource is your insurance agent. Invite the agent to tour your premises and discuss how you are currently managing risks. He or she will be able to evaluate your actions and offer suggestions. 

Depending on the nature of your business, it may be a wise investment to engage a risk management consultant. 

LOSS CONTROL AND INSURANCE

Effective loss control—reducing the number and size of losses—may impact both the availability and affordability of insurance.

A business that is indifferent to loss control may have a higher than average number of  insurance claims. A really poor loss history can make it difficult to find insurance. Conversely, businesses that actively manage risks, and thereby control losses, will have fewer claims and will often see those efforts rewarded with lower insurance premiums. 

PREVENTING FIRE LOSSES

Over time, experts have identified the most frequent causes of loss and how to  reduce the extent of damage when accidents occur.  Below are  questions designed to help you decide whether you need to take additional precautions to control the risk of fire.

• Are employees trained in fire safety? Do they know exactly what to do if a fire starts? Is extra training given to those responsible for storage areas, housekeeping, maintenance and operations where there are open flames or flammable substances are used or stored?
• Do you have the right type, size and number of fire extinguishers? Your fire department or fire protection equipment supplier can advise you. Are the fire extinguishers serviced and tagged annually? Do you review with employees at least once a year where the fire extinguishers are and how to use them?
• If needed, have you modernized your electrical system? Faulty wiring causes a large percentage of nonresidential fires. Are electrical panels accessible, with at least three feet of clearance and labeled? Except for temporary use (or surge protection for sensitive electronics such as computers) electrical equipment should be plugged directly into an outlet, rather than into extension cords.
• Have you situated your business in a fire-resistant building—a structure made of noncombustible materials with firewalls (self-supporting solid walls running the full width and height of the building) that create barriers to the spread of fires?
• Does your building have a fire alarm system connected to the local fire department or an alarm company?
• Does your building have a sprinkler system to douse fires? If so, is it serviced, including a main drain test, at least annually? Is your sprinkler system the right one for your kind of building and the materials used in your business? Different types of buildings and contents require different types of fire suppression systems. Your insurance carrier, alarm company or local fire department can assist you in choosing the most appropriate type of system.
• Have smoke detectors been installed, and are they regularly tested?
• Have you posted "No Smoking" signs? Do you enforce the rule? Is there evidence of smoking?
• Do you regularly check your heating system?

REDUCING VULNERABILITY TO THEFT

Businesses face various types of theft, including burglary and robbery by outsiders, theft by insiders and identity theft.

Burglary – Burglary refers to crimes involving the unlawful entry of a structure with or without force. Burglary prevention starts with making your premises an unattractive target by creating barriers to illicit entry. Appropriate measures will vary depending on the type of business, the premises and the location. For some businesses, security needs may be met simply by leasing a professional office in a building with good security and assuring there are strong doors and appropriate locks. This is particularly true for organizations in low-crime areas without high-value goods on the premises.

An enterprise in a building with numerous entrances and windows, located in an area with a high-crime rate and having high-value goods on hand presents a different picture. Whatever type of business you have, your insurance agent, locksmith, police department and a security consultant can provide information on how to make your premises harder to burgle. They may recommend such improvements as steel doors that fit tightly into doorframes, shatterproof window glass, stronger window locks and a fence around the premises.

Exterior lighting deters burglars. The fewer dark places around your facility, the better. Don’t let trees or shrubs grow around windows. These provide an opportunity for criminals to conceal what they are doing. Keep dumpsters away from the building.

Valuable property should be locked up to further deter theft. You may want to invest in an alarm system that rings in the police station or at a private security firm.

Robbery – Robberies involve the taking of valuables from another person(s) by force or threat of force. If you receive cash in your business, train employees what to do in case of robbery. Your local police department can assist you in developing training material. Limit the amounts of cash in cash registers.

Insider Crime – Many businesses put a great deal of effort into protecting their property from theft by outsiders but neglect to put an equal effort into preventing insider theft. Employers should not underestimate the risk of trusted employees stealing from the company.

Loss control experts at the Association of Certified Fraud Examiners (ACFE) encourage employers to adopt two strategies to prevent internal theft: increase the perceived probability of discovery and decrease the probability that an employee will commit the crime.

The ACFE recommends stringent accounting controls, which your accountant can help you create, and frequent audits. Having a policy that gives honest employees a way to report theft by their co-workers without fear of reprisal helps cut down insider theft, as does emphasis on ethical practices, rewarding company loyalty and having clear performance standards.

Identity Theft – Identity theft occurs when an individual uses someone else’s personal information to commit fraud. Federal law requires businesses to provide identity theft victims with transaction records relating to their identity theft free of charge. 

CONTROLLING LIABILITY RISKS

A person cannot prevail in a liability lawsuit against your business or you personally unless he or she can convince the judge, jury or other adjudicator that you breached your legal duty to that person. Examples of such duties include:

• Making a reasonable effort to maintain a safe environment for the public
• Refraining from slander
• Warning about an unsafe condition or product
• Investigating an employee’s complaint of civil rights discrimination

In general, to reduce liability risks, you must behave lawfully and with demonstrable responsibility for the welfare of third parties—a group that includes your clients or customers, competitors and the general public. Additionally, you must obey a variety of civil rights laws and other laws that give rights to your employees (if you meet the criteria of a covered business).

If you can provide evidence that you took your responsibility seriously and made reasonable efforts to prevent harm to others, you are much less likely to be found liable. Evidence can be in a variety of forms, depending on the nature of the liability risk. A few examples are:

• Copies of communications with your customers or employees about safety and risk
• Records of your efforts to verify that someone you hired was not a risk to others
• Testimony that you provided warning signs or other warning signals regarding a hazardous condition on your property
• Evidence from other professionals in your field that the decisions you made and actions you took were consistent with acceptable professional standards
• Records that your equipment was regularly serviced by knowledgeable technicians

Notice that in most of these examples, some form of written record is involved. Documenting your efforts to behave lawfully can be vital to proving that you are not liable. 

For almost any type of venture, you may find extensive and specific information on reducing liability risk exposures from your insurance agent and insurance company, trade association and the Internet. Briefly discussed here are some areas of concern that apply to many types of business. They include:

• Slip and Fall Accidents
• Employment Practices Liability
• Hiring Practices and Liability Avoidance

Slip and Fall Accidents – These are one of the most common liability risks. Thousands of people are injured every year—some very seriously—in slip and fall accidents on business premises.

Employee training is critical to reducing your slip and fall loss exposure. All employees who are likely to be around third parties on your premises should be trained about what to do should someone suffer a fall. Medical care should be quickly provided to the injured person even if that means calling an ambulance. People who feel they were treated callously or indifferently are more likely to sue.

Elimination of slip and fall hazards should be a periodic scheduled activity. It may be helpful to use  a checklist for this. Considerations for indoor areas include:

• Lighting:  All areas should be adequately lighted, including hallways and stairs.
• Exits:  Exits should be well marked, well lighted and clear of obstacles.  
• Stairs:  Handrails, steps and landings should be in good condition. Stair treads should be constructed of uniform height and width.  
• Housekeeping:  General housekeeping should be maintained and storage areas kept neat.
• Carpeting:  Carpeting should be tight and smooth.
• Floors:  Any changes in floor level should be clearly marked.
• Doormats:  Doormats should be flat, slip resistant, cleaned and checked regularly in bad weather.
• Spills:  There should be an effective procedure to assure that all spills are immediately cleaned up.

Considerations for outdoor areas include:

• Walkways:  Walkways should be kept in good condition.
• Lighting:  Lighting should be adequate.
• Parking lot:  Potholes, cracks or uneven areas should be repaired.
• Ice and snow:  There should be an effective procedure for assuring ice and snow are removed.

If there are treacherous areas—such as an uneven area of the sidewalk or a ripped carpet—consider marking them as such, using signs to warn people away and putting up barriers around them.

Employment Practices Liability – Federal law restricts employment decisions based on race and national origin, religion and creed, gender, age and disability. The restrictions on race, religion, gender and disability apply to businesses with 15 or more employees. The restrictions on age apply to businesses with 20 or more employees. An employee who feels discriminated against might sue making such charges as extreme emotional distress or wrongful termination. It is not a defense in such cases to say you didn’t know your actions were unlawful.

Larger employers typically provide formal training to management and employees on compliance with civil rights laws. As a smaller organization, you may feel you cannot  afford the time or money for such programs. There are many lower cost ways of carrying out this training. The Equal Employment Opportunity Commission (EEOC), for one, has low cost materials just for small businesses.

Hiring Practices and Liability Avoidance – Immature, careless and irresponsible people are much more likely to engage in risky behaviors—from reckless driving, to sexual harassment, to cutting corners on safety rules, to stealing from their employers. Similarly, people who have drug and alcohol addictions are liable to present a variety of workplace dangers. The first step in cutting down on your liability exposure is to be as careful and thorough as possible about whom you hire. Failure to use a reasonable screening process for new hires could even expose you to negligent hiring liability.

Clear job descriptions and workplace rules, disseminated to all employees and applied consistently and without favoritism, can be a tremendous help in minimizing the risk of unacceptable behavior. 

MANAGING PRODUCT LIABILITY RISKS

One of the most important ways to reduce potential product liability claims is keeping scrupulous records over the entire life

of a product, from design to obsolescence. In the event of a product liability lawsuit, those records would be very important to show that you behaved with reasonable concern for the welfare of others.

To reduce the possibility of harm, your products should be carefully designed and fully tested to specifically identify possible product hazards all along the way. Provide the customer with thorough and detailed information about the product and appropriate warnings. Identify products for purposes of prompt recall and have a recall plan.

Loss control experts also recommend that you investigate, follow-up and document all customer complaints, even those that seem minor. This demonstrates your concern about your customers and shows that you take your duty to be responsible for the safety of your product seriously. Complaints could provide an early warning of a possible safety problem or other risk. 

RISK MANAGEMENT FOR INFORMATION TECHNOLOGY

The greater the role that computers, the Internet and e-commerce play in your business, the more exposure you have to both property and liability risks involving information technology.

Digitally stored information is subject to many of the same risks as any other property (fire, flood, tornado, etc.) as well as special risks (computer viruses, malicious hackers, etc.). To prevent the loss of your accounts receivables, customer orders, client records or other such data, you should back up the data regularly and often and store the backup copies in a separate, secure location. Prevent data loss or corruption by viruses and hackers by keeping up-to-date antivirus software and firewalls on all your business computers.

If you rely on a Web site, either you or your Web site host should back up all critical material at least daily. To assure your Web site doesn’t go down, a real-time “mirror image” of all your site data should be maintained so that it can be transferred immediately if the original site crashes for any reason.

Digital technology also presents liability risks. You could be sued if there is a breach of your security and sensitive information about others is exposed or stolen. Make sure you use reputable vendors. You could face a lawsuit claiming that your Web site uses another’s copyrighted material or slanders someone. Some measures that could help control these risks include:

• Using a "security seal" from a reputable security certification organization to encrypt data
• Posting a formal privacy policy
• Having your legal counsel approve your Web site content and your privacy statement 

REDUCING MOTOR VEHICLE RISKS

Traffic accidents are the number one cause of on-the-job fatalities.  Effective risk management can reduce the number of injuries and deaths and the potential liability lawsuits that may result from accidents in which  employees were involved.

These are some recommended practices:

• Before allowing anyone to drive company vehicles, check motor vehicle department records in any  state where the person previously lived or worked.
• Prohibit driving and drinking or use of certain non-prescribed drugs.
• If intoxication or substance abuse is proven, have a safety-oriented procedure for dealing with it.
• Implement and enforce a mandatory seat-belt policy for all drivers and passengers.
• Prohibit employees from using cell phones while driving. Require that they pull off the road before talking on a cell phone.
• Recognize that aggression and hostility are personality traits that may lead to accidents.  Some drivers may need behavior modification training.   
• Require drivers to report any off-duty accidents to the company.  Review the motor vehicle records of your company drivers at least annually.
• Limit non-business use of vehicles.
• Require employees that regularly drive vehicles in the course of their employment to complete a driver-training program that includes: safe following distance, speed awareness and control, and proper backing techniques.
• Implement a periodic safety inspection and maintenance program for all vehicles used for business purposes.
• Offer recognition to accident free drivers to encourage better driving overall.
• Make sure that your work schedule doesn’t pressure drivers to speed, complete paperwork while driving or engage in other poor driving habits.
• Have a procedure for drivers to follow after any accident.
• Investigate the causes of all accidents and use the results as a training opportunity for all drivers.
• Use security measures to prevent theft and vandalism of vehicles stored on your property. 

REDUCING THE RISK OF WORK-RELATED INJURIES

For most employers the cost of an employee’s work-related injury is covered by workers compensation insurance, which pays for medical care and replaces some of the income that the injured employee lost while unable to work. There is no coverage, however, for the hidden costs to your organization of that injury, such as reduced efficiency, the cost of training replacements and increased overtime expenditures. The effects can be particularly pronounced in a smaller enterprise. 

On-the-job injuries or vehicle accidents aren’t limited to occupations that are obviously dangerous. In most years the top three causes of injuries in the workplace are overexertion (injuries caused from excessive lifting, pushing, pulling, holding, carrying or throwing of an object), falls on level ground and bodily reaction (injuries from bending, climbing, slipping or tripping without falling). Such injuries can affect workers in most environments. Whatever your industry, attention to such risks can pay dividends.

Employees should be trained to recognize hazards and to report them to the appropriate person so that the hazard can be corrected as soon as possible. Work requirements involving safety should take precedence over any other.

Any near miss, first aid incident, accident or other workplace injury-related event should be investigated. Where possible, the investigation should be carried out immediately by a team that includes both management and hourly employees, all of whom have been trained in incident investigation. The goal of investigations is to identify the cause of the accident or injury rather than assign blame and to correct any hazards or other problem found, such as poor communication.

Supervisors and managers should also be trained to recognize and correct unsafe behaviors that can lead to injuries, including rushing, frustration, complacency and fatigue.

Once a year a team should review all incidents from the prior year to see whether there are any patterns in the accidents and, if so, how to address the problems identified.

Each work site should confer with its fire and police departments and hospital about plans for all potential emergencies, including fire, explosion, accident, severe weather, loss of power and violence. Emergency drills should be used to ensure that employees know what to do and to assess the effectiveness of emergency plans.

Depending on the size and nature of your business, you may want to have employees on each work shift trained by qualified Red Cross instructors to provide first aid and CPR. Someone should be designated to keep first aid kits stocked and accessible.

For additional information, visit the Web site of the Federal Occupational Safety and Health Administration . Other useful resources include your insurance agent and insurer, trade or industry organizations and the Internet. 

DISASTER RESPONSE AND RECOVERY PLANNING

Every year disaster strikes a certain number of small businesses, whether it is fire, earthquake, hurricane, tornado or something else.

To reduce the destructive impact of these disasters, you should have a plan—both to respond to the immediate emergency and to get your business operating again, even if your usual premises and business equipment and materials have been destroyed. This requires careful advance planning. You may find helpful the publications and small business planning aids from the nonprofit Institute for Business & Home Safety (IBHS), an insurance industry organization whose purpose is to make homes and businesses safer from natural disasters.

Generally, risk management experts recommend the following actions as preparation for immediate disaster response:

• Write an emergency response plan, train employees how to use it and use drills to reinforce the training. Learn from the drills and improve the plan.
• Store emergency response supplies such as first-aid kits, flashlights, heavy gloves and battery powered radios.
• Plan for the backup resources you may need during an emergency, such as alternative sources of power and communications systems.
• Have a written plan of action to carry out immediately after the disaster to ensure the security of your building and contents. A typical plan includes such actions as:
  • Securing entry points to reduce the threat of unauthorized access
  • Ensuring your burglar alarm system is working
  • Hiring temporary security guards
  • Making any needed temporary repairs—for example, boarding up windows or doors and covering holes in the roof to protect your property. Plan ahead by knowing which contractors you would call if needed to perform this type of work and having their phone numbers (including cell-phone numbers) readily available.
  • Possibly relocating equipment and property to a protected area
• As soon as feasible after the disaster, thoroughly inspect your property and record a complete description of all damage to it.
• Keep damaged property for inspection unless circumstances make immediate disposal necessary. In that case, try to make a photographic record of any items that are being disposed of.
• If you and your employees are involved in clean-up activities, use appropriate safety gear such as gloves, eye goggles, etc.

Consider how you would resume critical business operations quickly after the total destruction of your premises and the property located there. As part of the plan, you need to line up alternative facilities, replacement equipment, supply sources, etc. Here are some suggestions:

• For an alternative facility, you may want to consider making a reciprocal agreement with a competitor outside of your immediate area so that if either of you experiences a disaster, the other will temporarily share its facilities.
• If you rely primarily on suppliers in your local area, consider developing relationships with suppliers from further away in case your local suppliers are affected by the disaster.
• Have a communications plan for letting your customers know how to reach you if you cannot use your usual premises.
• Compile a list of important phone numbers, including cell phone numbers. The list should include company officials and employees (home and cell-phone numbers), local and state emergency agencies, major clients or customers, contractors, suppliers, realtors, financial institutions, insurance agents and claims representatives.
• Store the following information offsite:
  • A list of important phone numbers
  • A list of your insurance policies
  • An inventory of business equipment and other items (you may also want to have a videotape of these items)
  • Back ups of your business computer records
• Review your disaster recovery plan on a regular basis and communicate changes to key employees.