Chapter 4 Evolving Risk Management: Fundamental Tools

The Risk Management Process

A typical risk management function includes the steps listed above: identifying risks, assessing them, forecasting future frequency and severity of losses, mitigating risks, finding risk mitigation solutions, creating plans, conducting cost-benefits analyses, and implementing programs for loss control and insurance. For each property risk exposure, for example, the risk manager would adopt the following or similar processes:

• Finding all properties that are exposed to losses (such as real property like land, buildings, and other structures; tangible property like furniture and computers; and intangible personal property like trademarks)
• Evaluating the potential causes of loss that can affect the firms’ property, including natural disasters (such as windstorms, floods, and earthquakes); accidental causes (such as fires, explosions, and the collapse of roofs under snow); and many other causes noted in Chapter 1 "The Nature of Risk: Losses and Opportunities";
• Evaluating property value by different methods, such as book value, market value, reproduction cost, and replacement cost
• Evaluating the firm’s legal interest in each of the properties—whether each property is owned or leased
• Identifying the actual loss exposure in each property using loss histories (frequency and severity), accounting records, personal inspections, flow charts, and questionnaires
• Computing the frequency and severity of losses for each of the property risk exposures based on loss data
• Forecasting future losses for each property risk exposure
• Creating a specific risk map for all property risk exposures based on forecasted frequency and severity
• Developing risk management alternative tools (such as loss-control techniques) based upon cost-benefit analysis or insurance
• Comparing the existing solutions to potential solutions (traditional and nontraditional)—uses of risk maps
• Communicating the solutions with the whole organization by creating reporting techniques, feedback, and a path for ongoing execution of the whole process
• The process is very similar to any other business process.

Identifying Risks

The process of identifying all of a firm’s risks and their values is a very detailed process. It is of extreme importance to ensure that the business is not ignoring anything that can destroy it. To illustrate how the process takes shape, imagine a business such as Thompson’s department store that has a fleet of delivery trucks, a restaurant, a coffee shop, a restaurant, and a babysitting service for parents who are shopping. The risk manager who talks to each employee in the store usually would ask for a list of all the perils and hazards (discussed in Chapter 1 "The Nature of Risk: Losses and Opportunities") that can expose the operation to losses.

A simple analysis of this department store risk exposure nicely illustrates risk identification, which is a critical element of risk management. For the coffee shop and restaurant, the risks include food poisoning, kitchen fire, and injuries to customers who slip. Spilled coffee can damage store merchandise. For the babysitting service, the store may be liable for any injury to infants as they are fed or play or possibly suffer injuries from other kids. In addition to worry about employees’ possible injuries while at work or damage to merchandise from mistreatment, the store risk manager would usually worry about the condition of the floors as a potential hazard, especially when wet. Most risk managers work with the architectural schematics of the building and learn about evacuation routes in case of fires. The location of the building is also critical to identification of risks. If the department store is in a flood-prone area, the risks are different than if the store were located in the mountains. The process involves every company stakeholder. Understanding the supply chain of movement of merchandise is part of the plan as well. If suppliers have losses, risk managers need to know about the risk associated with such delays. This example is a short illustration of the enormous task of risk identification.

Today’s CRO also reviews the financial statement of the firm to ensure the financial viability within the financial risks, the asset risks and product risks the firm undertakes. We elaborate more on this aspect with examples in Chapter 5 "The Evolution of Risk Management: Enterprise Risk Management".

Risk Identification and Estimates of Frequency and Severity

Strategies for risk mapping will vary from organization to organization. Company objectives arise out of the firm’s risk appetite and culture. These objectives help determine the organization’s risk tolerance level (see Chapter 3 "Risk Attitudes: Expected Utility Theory and Demand for Hedging"). As in the separate risk management process for each risk exposure, the first step in mapping risk is to identify the firm’s loss exposures and estimate and forecast the frequency and severity of each potential risk. Figure 4.2 "Notable Notions Risk Map" displays (for illustration purposes only) quantified trended estimates of loss frequency and severity that risk managers use as inputs into the risk map for a hypothetical small import/export business, Notable Notions. The risk map graph is divided into the four quadrants of the classical risk management matrix (which we discuss in detail later in this chapter). As we will see, such matrices provide a critical part of the way to provide risk management solutions to each risk.

Figure 4.2 Notable Notions Risk Map

Capital Budgeting: Cost-Benefit Analysis for Loss-Control Efforts

With the ammunition of reducing the frequency of losses, Dana is planning to continue her loss-control efforts. Her next step is to convince management to invest in a new innovation in security belts for the employees. These belts have proven records of reducing the severity of WC claim in other facilities. In this example, we show her cost-benefit analysis—analysis that examines the cost of the belts and compares the expense to the expected reduction in losses or savings in premiums for insurance. If the benefit of cost reduction exceeds the expense for the belt, Dana will be able to prove her point. In terms of the actual analysis, she has to bring the future reduction in losses to today’s value of the dollar by looking at the present value of the reduction in premiums. If the present value of premium savings is greater than the cost of the belts, we will have a positive net present value (NPV) and management will have a clear incentive to approve this loss-control expense.

With the help of her broker, Dana plans to show her managers that, by lowering the frequency and severity of losses, the workers’ compensation rates for insurance can be lowered by as much as 20–25 percent. This 20–25 percent is actually a true savings or benefit for the cost-benefit analysis. Dana undertook to conduct cash flow analysisAnalysis that looks at the amount of cash that will be saved and brings it into today’s present value. for purchasing the new innovative safety belts project. A cash flow analysis looks at the amount of cash that will be saved and brings it into today’s present value. Table 4.3 "Net Present Value (NPV) of Workers’ Compensation Premiums Savings for Energy Fitness Centers When Purchasing Innovative Safety Belts for $50,000" provides the decrease in premium anticipated when the belts are used as a loss-control technique.

The cash outlay required to purchase the innovative belts is $50,000 today. The savings in premiums for the next few years are expected to be $20,000 in the first year, $25,000 in the second year, and $30,000 in the third year. Dana would like to show her managers this premium savings over a three-year time horizon. Table 4.3 "Net Present Value (NPV) of Workers’ Compensation Premiums Savings for Energy Fitness Centers When Purchasing Innovative Safety Belts for $50,000" shows the cash flow analysis that Dana used, using a 6 percent rate of return. For 6 percent, the NPV would be ($66,310 – 50,000) = $16,310. You are invited to calculate the NPV at different interest rates. Would the NPV be greater for 10 percent? (The student will find that it is lower, since the future value of a lower amount today grows faster at 10 percent than at 6 percent.)

Risk Management Information System

Risk managers rely upon data and analysis techniques to assess and evaluate and thus to make informed decisions. One of the risk managers’ primary tasks—as you see from the activities of Dana at Energy Fitness Centers—is to develop the appropriate data systems to allow them to quantify the organization’s loss history, including

• types of losses,
• amounts,
• circumstances surrounding them,
• dates, and
• other relevant facts.

We call such computerized quantifications a risk management information systemComputerized data systems to allows a risk manager to quantify the organization’s loss history., or RMIS. An RMIS provides risk managers with the ability to slice and dice the data in any way that may help risk managers assess and evaluate the risks their companies face. The history helps to establish probability distributions and trends analysis. When risk managers use good data and analysis to make risk reduction decisions, they must always include consideration of financial concepts (such as the time value of money) as shown above.

The key to good decision making lies in the risk managers’ ability to analyze large amounts of data collected. A firm’s data warehousingA system of housing large sets of data for strategic analysis and operations. (a system of housing large sets of data for strategic analysis and operations) of risk data allows decision makers to evaluate multiple dimensions of risks as well as overall risk. Reporting techniques can be virtually unlimited in perspectives. For example, risk managers can sort data by location, by region, by division, and so forth. Because risk solutions are only as good as their underlying assumptions, RMIS allows for modeling data to assist in the risk exposure measurement process. Self-administered retained coverages have experienced explosive growth across all industries. The boom has meant that systems now include customized Web-based reporting capabilities. The technological advances that go along with RMIS allows all decision makers to maximize a firm’s risk/reward tradeoff through data analysis.

The Risk Management Decision—Return to the Example

Dana, the risk manager of Energy Fitness Centers, also uses a risk management matrix to decide whether or not to recommend any additional loss-control devices. Using the data in Table 4.3 "Net Present Value (NPV) of Workers’ Compensation Premiums Savings for Energy Fitness Centers When Purchasing Innovative Safety Belts for $50,000" and Figure 4.3 "Workers’ Compensation Frequency and Severity of Energy Fitness Centers—Actual and Trended", Dana compared the forecasted frequency and severity of the worker’s compensation results to the data of her peer group that she obtained from the Risk and Insurance Management Society (RIMS) and her broker. In comparison, her loss frequency is higher than the median for similarly sized fitness centers. Yet, to her surprise, EFC’s risk severity is lower than the median. Based on the risk management matrix she should suggest to management that they retain some risks and use loss control as she already had been doing. Her cost-benefit analysis from above helps reinforce her decision. Therefore, with both cost-benefits analysis and the method of managing the risk suggested by the matrix, she has enough ammunition to convince management to agree to buy the additional belts as a method to reduce the losses.

To understand the risk management matrix alternatives, we now concentrate on each of the cells in the matrix.

Risk Transfer—Insurance

The lower-left corner of the risk management matrix represents situations involving low frequency and high severity. Here we find transfer of riskDisplacement of risk to a third, unrelated party.—that is, displacement of risk to a third, unrelated party—to an insurance company. We discuss insurance—both its nature and its operations—at length in Chapter 6 "The Insurance Solution and Institutions" and Chapter 7 "Insurance Operations". In essence, risk transference involves paying someone else to bear some or all of the risk of certain financial losses that cannot be avoided, assumed, or reduced to acceptable levels. Some risks may be transferred through the formation of a corporation with limited liability for its stockholders. Others may be transferred by contractual arrangements, including insurance.

Corporations—A Firm

The owner or owners of a firm face serious potential losses. They are responsible to pay debts and other financial obligations when such liabilities exceed the firm’s assets. If the firm is organized as a sole proprietorship, the proprietor faces this risk. His or her personal assets are not separable from those of the firm because the firm is not a separate legal entity. The proprietor has unlimited liability for the firm’s obligations. General partners in a partnership occupy a similar situation, each partner being liable without limit for the debts of the firm.

Because a corporation is a separate legal entity, investors who wish to limit possible losses connected with a particular venture may create a corporation and transfer such risks to it. This does not prevent losses from occurring, but the burden is transferred to the corporation. The owners suffer indirectly, of course, but their loss is limited to their investment in the corporation. A huge liability claim for damages may take all the assets of the corporation, but the stockholders’ personal assets beyond their stock in this particular corporation are not exposed to loss. Such a method of risk transfer sometimes is used to compartmentalize the risks of a large venture by incorporating separate firms to handle various segments of the total operation. In this way, a large firm may transfer parts of its risks to separate smaller subsidiaries, thus placing limits on possible losses to the parent company owners. Courts, however, may not approve of this method of transferring the liability associated with dangerous business activities. For example, a large firm may be held legally liable for damages caused by a small subsidiary formed to manufacture a substance that proves dangerous to employees and/or the environment.

Contractual Arrangements

Some risks are transferred by a guarantee included in the contract of sale. A noteworthy example is the warranty provided a car buyer. When automobiles were first manufactured, the purchaser bore the burden of all defects that developed during use. Somewhat later, automobile manufacturers agreed to replace defective parts at no cost, but the buyer was required to pay for any labor involved. Currently, manufacturers typically not only replace defective parts but also pay for labor, within certain constraints. The owner has, in effect, transferred a large part of the risk of purchasing a new automobile back to the manufacturer. The buyer, of course, is still subject to the inconvenience of having repairs made, but he or she does not have to pay for them.

Other types of contractual arrangements that transfer risk include leases and rental agreements, hold-harmless clauses“A Hold Harmless Agreement is usually used where the Promisor’s actions could lead to a claim or liability to the Promisee. For example, the buyer of land wants to inspect the property prior to close of escrow, and needs to conduct tests and studies on the property. In this case, the buyer would promise to indemnify the current property owner from any claims resulting from the buyer’s inspection (i.e., injury to a third party because the buyer is drilling a hole; to pay for a mechanic’s lien because the buyer hired a termite inspector, etc.). Another example is where a property owner allows a caterer to use its property to cater an event. In this example, the Catering Company (the “Promisor”) agrees to indemnify the property owner for any claims arising from the Catering Company’s use of the property.” From Legaldocs, a division of U.S.A. Law Publications, Inc., http://www.legaldocs.com/docs/holdha_1.mv. and surety bonds.A surety bond is a three-party instrument between a surety, the contractor, and the project owner. The agreement binds the contractor to comply with the terms and conditions of a contract. If the contractor is unable to successfully perform the contract, the surety assumes the contractor’s responsibilities and ensures that the project is completed. Perhaps the most important arrangement for the transfer of risk important to our study is insurance.

Insurance is a common form of planned risk transfer as a financing technique for individuals and most organizations. The insurance industry has grown tremendously in industrialized countries, developing sophisticated products, employing millions of people, and investing billions of dollars. Because of its core importance in risk management, insurance is the centerpiece in most risk management activities.

Risk Assumption

The upper-left corner of the matrix in Table 4.4 "The Traditional Risk Management Matrix (for One Risk)", representing both low frequency and low severity, shows retention of risk. When an organization uses a highly formalized method of retention of a risk, it is said the organization has self-insured the risk. The company bears the risk and is willing to withstand the financial losses from claims, if any. It is important to note that the extent to which risk retention is feasible depends upon the accuracy of loss predictions and the arrangements made for loss payment. Retention is especially attractive to large organizations. Many large corporations use captives, which are a form of self-insurance. When a business creates a subsidiary to handle the risk exposures, the business creates a captive. As noted above, broadly defined, a captive insurance company is one that provides risk management protection to its parent company and other affiliated organizations. The captive is controlled by its parent company. We will provide a more detailed explanation of captives in Chapter 6 "The Insurance Solution and Institutions". If the parent can use funds more productively (that is, can earn a higher after-tax return on investment), the formation of a captive may be wise. The risk manager must assess the importance of the insurer’s claims adjusting and other services (including underwriting) when evaluating whether to create or rent a captive.

Risk managers of smaller businesses can become part of a risk retention groupA group that provides risk management and retention to a few players in the same industry who are too small to act on their own..President Reagan signed into law the Liability Risk Retention Act in October 1986 (an amendment to the Product Liability Risk Retention Act of 1981). The act permits formation of retention groups (a special form of captive) with fewer restrictions than existed before. The retention groups are similar to association captives. The act permits formation of such groups in the U.S. under more favorable conditions than have existed generally for association captives. The act may be particularly helpful to small businesses that could not feasibly self-insure on their own but can do so within a designated group. How extensive will be the use of risk retention groups is yet to be seen. As of the writing of this text there are efforts to amend the act. A risk retention group provides risk management and retention to a few players in the same industry who are too small to act on their own. In this way, risk retention groups are similar to group self-insurance. We discuss them further in Chapter 6 "The Insurance Solution and Institutions".

Risk Reduction

Moving over to the upper-right corner of the risk management matrix in Table 4.4 "The Traditional Risk Management Matrix (for One Risk)", the quadrant characterized by high frequency and low severity, we find retention with loss control. If frequency is significant, risk managers may find efforts to prevent losses useful. If losses are of low value, they may be easily paid out of the organization’s or individual’s own funds. Risk retention usually finances highly frequent, predictable losses more cost effectively. An example might be losses due to wear and tear on equipment. Such losses are predictable and of a manageable, low-annual value. We described loss control in the case of the fitness center above.

Loss preventionEfforts that seek to reduce the probability of a loss occurring. efforts seek to reduce the probability of a loss occurring. Managers use loss reductionEfforts to lessen loss severity. efforts to lessen loss severity. If you want to ski in spite of the hazards involved, you may take instruction to improve your skills and reduce the likelihood of you falling down a hill or crashing into a tree. At the same time, you may engage in a physical fitness program to toughen your body to withstand spills without serious injury. Using both loss prevention and reduction techniques, you attempt to lower both the probability and severity of loss.

Loss prevention’s goal seeks to reduce losses to the minimum compatible with a reasonable level of human activity and expense. At any given time, economic constraints place limits on what may be done, although what is considered too costly at one time may be readily accepted at a later date. Thus, during one era, little effort may have been made to prevent injury to employees, because employees were regarded as expendable. The general notion today, however, is that such injuries are prevented because they have become too expensive. Change was made to adapt to the prevailing ideals concerning the value of human life and the social responsibility of business.

Risk Avoidance

In the lower-right corner of the matrix in Table 4.4 "The Traditional Risk Management Matrix (for One Risk)", at the intersection of high frequency and high severity, we find avoidance. Managers seek to avoid any situation falling in this category if possible. An example might be a firm that is considering construction of a building on the east coast of Florida in Key West. Flooding and hurricane risk would be high, with significant damage possibilities.

Of course, we cannot always avoid risks. When Texas school districts were faced with high severity and frequency of losses in workers’ compensation, schools could not close their doors to avoid the problem. Instead, the school districts opted to self-insure, that is, retain the risk up to a certain loss limit.Etti G. Baranoff, “Determinants in Risk-Financing Choices: The Case of Workers’ Compensation for Public School Districts,” Journal of Risk and Insurance, June 2000.

Not all avoidance necessarily results in “no loss.” While seeking to avoid one loss potential, many efforts may create another. Some people choose to travel by car instead of plane because of their fear of flying. While they have successfully avoided the possibility of being a passenger in an airplane accident, they have increased their probability of being in an automobile accident. Per mile traveled, automobile deaths are far more frequent than aircraft fatalities. By choosing cars over planes, these people actually raise their probability of injury.

The Effect of Risk Handling Methods

We can create another map to show how a particular risk management strategy of the maximum severity that will remain after insurance. This occurs when insurance companies give only low limits of coverage. For example, if the potential severity of Notable Notions’ earthquake risk is $140 million, but coverage is offered only up to $100 million, the risk falls to a level of $40 million.

Using holistic risk mapping methodology presents a clear, easy-to-read presentation of a firm’s overall risk spectrum or the level of risks that are still left after all risk mitigation strategies were put in place. It allows a firm to discern between those exposures that after all mitigation efforts are still

1. unbearable,
2. difficult to bear, and
3. relatively unimportant.

In summary, risk mapping has five main objectives:

1. To aid in the identification of risks and their interrelations
2. To provide a mechanism to see clearly what risk management strategy would be the best to undertake
3. To compare and evaluate the firm’s current risk handling and to aid in selecting appropriate strategies
4. To show the leftover risks after all risk mitigation strategies are put in place
5. To easily communicate risk management strategy to both management and employees

Ongoing Monitoring

The process of risk management is continuous, requiring constant monitoring of the program to be certain that (1) the decisions implemented were correct and have been implemented appropriately and that (2) the underlying problems have not changed so much as to require revised plans for managing them. When either of these conditions exists, the process returns to the step of identifying the risks and risk management tools and the cycle repeats. In this way, risk management can be considered a systems process, one in never-ending motion.

Forecasting of Frequency and Severity

When insurers or risk managers use frequency and severity to project the future, they use trending techniques that apply to the loss distributions known to them.Forecasting is part of the Associate Risk Manager designation under the Risk Assessment course using the book: Baranoff Etti, Scott Harrington, and Greg Niehaus, Risk Assessment (Malvern, PA: American Institute for Chartered Property Casualty Underwriters/Insurance Institute of America, 2005). Regressions are the most commonly used tools to predict future losses and claims based on the past. In this textbook, we introduce linear regression using the data featured in Chapter 2 "Risk Measurement and Metrics". The scientific notations for the regressions are discussed later in this appendix.

Figure 4.5 Linear Regression Trend of Claims of A

Figure 4.6 Linear Regression Trend of Losses of A

Using Linear Regression

Linear regression attempts to explain the relationship among observed values by applying a straight line fit to the data. The linear regression model postulates that

,where the “residual” e is a random variable with mean of zero. The coefficients a and b are determined by the condition that the sum of the square residuals is as small as possible. For our purposes, we do not discuss the error term. We use the frequency and severity data of A for 5 years. Here, we provide the scientific notation that is behind Figure 4.5 "Linear Regression Trend of Claims of A" and Figure 4.6 "Linear Regression Trend of Losses of A".

In order to determine the intercept of the line on the y-axis and the slope, we use m (slope) and b (y-intercept) in the equation.

Given a set of data with n data points, the slope (m) and the y-intercept (b) are determined using:

Figure 4.7 Showing the Slope and Intercept

The graph is provided by Chris D. Odom, with permission.

Most commonly, practitioners use various software applications to obtain the trends. The student is invited to experiment with Microsoft Excel spreadsheets. Table 4.6 "Method of Calculating the Trend Line for the Claims" provides the formulas and calculations for the intercept and slope of the claims to construct the trend line.

Future Forecasts using the Slopes and Intercepts for A:

• Future claims = Intercept + Slope × (X)
• In year 6, the forecast of the number of claims is projected to be: {8.1 + (0.7 × 6)} = 12.3 claims

• Future losses = Intercept + Slope × (X)
• In year 6, the forecast of the losses in dollars is projected to be: {−15, 100 + (26,000 × 6)} = $140,900 in losses

The in-depth statistical explanation of the linear regression model is beyond the scope of this course. Interested students are invited to explore statistical models in elementary statistics textbooks. This first exposure to the world of forecasting, however, is critical to a student seeking further study in the fields of insurance and risk management.