2.1 Definition of Risk Management
Risk Management refers to the identification, measurement and treatment of exposure to potential accidental losses almost always in situations where the only possible outcomes are losses or no change in the status. It is a general management function that seeks to assess and address the causes and effects of uncertainty and risk on an organization. The purpose of risk management is to enable an organization to progress towards its goals and objectives in the most direct, efficient, and effective path. Risk Management is the executive function of dealing with specified risks facing the business enterprise. In general, the risk manager deals with pure, not speculative risk.
Generally, risk management is defined as a systematic process for the identification and evaluationof pure loss exposures faced by an organization or individuals and for the selection and implementation of the most appropriate techniques for treating such exposures. Many risk managers use the term “loss exposure” to identify potential losses. Loss exposure is a situation or circumstance in which a loss is possible, regardless of a loss occurs. For example defective products that may result in lawsuits against the company.
2.2 Objectives of Risk Management
The objectives of risk management can be broadly classified into two:
- Pre-loss Objectives
- Post-loss Objectives
An organization has many risk management objectives prior to the occurrence of a loss. The most important of such objectives are as follows;
- The first objective is that the firm should prepare for potential losses in the most economical way possible. This involves as analysis of safety program, insurance premiums and the costs associated with the different techniques of handling losses.
- The second objective is the reduction of anxiety. In a firm, certain loss exposures can cause greater worry and fear for the risk manager, key executives and unexpected stockholders of that firm. For example, a threat of a lawsuit from a defective product can cause greater anxiety than a possible small loss from a minor fire. However, the risk manager wants to minimize the anxiety and fear associated with such loss exposures.
- The third pre-loss objective is to meet any externally imposed obligations. This means that the firm must meet certain obligations imposed on it by the outsiders. For example, government regulations may require a firm to install safety devices to protect workers from harm. Similarly, a firm’s creditors may require that property pledged as collateral for a loan must be insured. Thus, the risk manager is expected to see that these externally imposed obligations are met properly.
Post-loss objectives are those which operate after the occurrence of a loss. They are as follows:
- The first post-loss objective is survival of the firm. It means that after a loss occurs, the firm can at least resume partial operation within some reasonable time period.
- The second post-loss objective is to continue operating. For some firms, the ability to operate after a severe loss is an extremely important objective. Especially, for public utility firms such as banks, dairies, etc, they must continue to provide service. Otherwise, they may lose their customers to competitors.
- Stability of earnings is the third post-loss objective. The firm wants to maintain its earnings per share after a loss occurs. This objective is closely related to the objective of continued operations. Because, earnings per share can be maintained only if the firm continues to operate. However, there may be substantial costs involved in achieving this goal, and perfect stability of earnings may not be attained.
- Another important post-loss objective is continued growth of the firm. A firm may grow by developing new products and markets or by acquiring or merging with other companies. Here, the risk manager must consider the impact that a loss will have on the firm’s ability to grow.
- The fifth and the final post-loss objective is the social responsibility to minimize the impact that a loss has on other persons and on society. A severe loss can adversely affect the employees, customers, suppliers, creditors and the community in general. Thus, the risk manager’s role is to minimize the impact of loss on other persons.
Thus, there are the pre-loss and post-loss objectives of risk management. A prudent risk manager must keep these objectives in mind while handling and managing the risk.
2.3 Risk Management Process
Whether the concern is with a business or an individual situation, the same general steps can be used to analyze systematically and deal with risk. This is known as risk management process. The risk management process has five steps to be implemented by the risk manager:
- Risk identification
- Risk measurement
- Identifying the tools of risk management
- Selection of risk tools
- Risk implementation
1. Identifying the Potential Losses: (Risk Identification)
Risk identification is the process by which a business systematically and continually identifies property, liability, and personnel exposures as soon as or before they emerge. The risk manager tries to locate the areas where losses could happen due to a wide range of perils. Unless the risk manager identifies all the potential losses confronting the firm, he or she will not have any opportunity to determine the best way to handle the undiscovered risks.
To identify all the potential losses the risk manager needs first a checklist of all the losses that could occur to any business. Second, he or she needs a systematic approach to discover which of the potential losses included in the checklist are faced by his/her business. The risk manager may personally conduct this two-step procedure or may rely upon the services of an insurance agent, broker, or consultant.
Generally, a risk manager has several sources of information that can be used to identify major and minor loss exposures. They are as follows:
- Physical inspection of company plant & machineries can identify major loss exposures.
- Extensive risk analysis questionnaire can be used to discover hidden loss exposures that are common to many firms.
- Flow charts that show production and delivery processes can reveal production bottlenecks where a loss can have severe financial consequences to the firm.
- Financial statements can be used to identify the major assets that must be protected.
- Departmental & historical claims data can be invaluable in identifying major loss exposures.
Risk managers must also be aware of new loss exposures that may be emerging. More recently, misuse of the internet and e-mail transmissions by employees have exposed employers to potential legal liability because of transmission of pornographic material and theft of confidential information.
2. Evaluating Potential Losses (Risk Measurement)
The second step in the risk management process is to evaluate and measure the impact of losses on the firm. This involves an estimation of the potential frequency and severity of loss.
Loss frequency refers to the probable number of losses that may occur during some given period of time, while loss severity refers to the probable size of the losses that may occur. Once the risk manager estimates the frequency and severity of loss for each type of loss exposure, the various loss exposures can be ranked according to their relative importance.
Both loss frequency and loss severity data are needed to evaluate the relative importance of an exposure to potential loss. However, the importance of an exposure depends mostly upon the potential loss severity not the potential frequency. A potential loss with catastrophic possibilities although infrequent, is far more serious than one expected to produce frequent small losses and no large losses. On the other hand, loss frequency cannot be ignored. If two exposures are characterized by the same loss severity, the exposure whose frequency is greater should be ranked more important. There is no formula for ranking the losses in order of importance, and different persons may develop different rankings. The rational approach, however, is to place more emphasis on loss severity.
Risk Measurement and Probability Distribution
A more sophisticated way to measure potential losses involves probability distributions. However, this method is more difficult to explain and the data needed to construct the required probability distribution are commonly not available. Nevertheless, probability distributions make possible more comprehensive risk measurements than other techniques; and also, they are becoming a more common tool of modern management, and data sources are improving. Furthermore, probability distributions improve one's understanding of the more popular risk measurements and are extremely useful in determining which risk management devices would be best in a given situation.
A probability distribution shows for each possible outcome, its probability of occurrence. It is used to estimate numerically the potential loss from a risk. Using the probability distribution, it is possible to measure the various aspects of a risk; such as:
- The total losses per period
- The number of occurrences per period
- The total losses per occurrence
The probability distribution of the total dollar losses per year shows each of the total dollar losses that the business may experience in the coming year and the probability that each of these totals might occur. For example, assume that:
- a business has five cars, each of which is valued at 10,000 Birr
- each car may be involved in more than one collision a year; and
- The physical damage may be partial or total.
Also assume prompt replacement of any car that goes out of service, thus reducing net income losses to a minimal level. A hypothetical probability distribution that might apply in this situation is shown below:
If the risk manager can estimate accurately the probability distribution of the total dollar losses per year, he or she can obtain useful information concerning:
- the probability that the business will incur some dollar loss,
- the probability that "severe (greater or equal to 5,000)" losses will occur,
- the average loss per year, and
- The risk or variation in the possible results.
Given the above distribution, the probability that the business will suffer no dollar loss is almost 0.61 (0.606). Because the business must suffer either no loss or some loss, the sum of the probabilities of no loss and some loss must equal 1. Consequently, the probability of some loss is equal to about 1 – 0.61 = 0.39. An alternative way to determine the probability of some loss is to sum the probability for each of the possible total dollar losses: i.e., 0.273 + 0.100 + 0.015 + 0.003 + 0.002 + 0.001 = 0.394 (1 – 0.606 = 0.394).
The potential severity of the total dollar losses can be measured by stating the probability that the total losses will exceed various values. For example, the risk manager may be interested in the probability that the dollar losses will equal or exceed 5,000 Birr. These probabilities can be calculated for each of the values in which the risk manager is interested and for all higher values. For example, the probability that the dollar losses will equal or exceed Birr 5000 is equal to 0.003 + 0.002 + 0.001 = 0.006.
Another extremely useful measure that reflects both loss frequency and loss severity is the expected total dollar loss or the average annual dollar loss in the long run. Because the probabilities above represent the proportion of times each dollar loss is expected to occur in the long run, the expected loss can be obtained by summing the products formed by multiplying each possible outcome by the probability of its occurrence; i.e., 0(0.606) + 500(0.273) + 1000(0.100) + 2000(0.015) + 5000(0.003) + 10,000(0.002) + 20,000 (0.001) = 321 Birr. This measure indicates the average annual dollar loss the business will sustain in the long run if it retains this exposure.
Up to this point, no yardstick has been suggested for measuring risk but its relationship to the variation in the probability distribution has been noted. Statisticians measure this variation in several ways. One of the most popular yardsticks for measuring the dispersion around the expected values is the standard deviation. The standard deviation is obtained by subtracting the average value from each possible value of the variable, squaring the difference, multiplying each squared difference by probability that the variable will assume the value involved, summing the resulting products, and taking the square root of the sum.
When there is much doubt about what will happen because there are many outcomes with some reasonable chance of occurrence, the standard deviation will be large; when there is little doubt about what will happen because one of the few possible outcomes is almost certain to occur, the standard deviation will be small.
Similarly, the number of accidents expected to occur per physical period (year) can be measured. If each occurrence produces the same dollar loss, the distribution of the number of occurrences per year can be transformed into a distribution of the total dollar losses per year by multiplying each possible number of occurrences by the uniform loss per occurrence. If the dollar loss per occurrence varies within a small range, the distribution of the total dollar losses per year can be approximated by multiplying each possible number of occurrences by the average dollar losses per occurrence. If the dollar losses per occurrence vary widely, one needs the probability distributions of the dollar losses per occurrence and the number of occurrences per year to develop information about the total dollar losses per year.
Researchers have also some success describing the probability distribution of the dollar losses per occurrence. This distribution would state the probabilities that the dollar losses in an occurrence would assume various values. Generally dollar loss per occurrence refers to the average monetary loss expected per accident (occurrence).
In addition, there are various methods used to measure the different aspects of a risk. Some of these methods are:
- Poisson distribution method
- Binomial distribution method, and
- Normal distribution method
Reading assignment: Refere back to Statistics fo finance and read this points
3. Tools of Risk Management
The third step is to identify the available tools of risk management. The major tools of risk management are the following:
- Loss control
- Non-insurance transfers
Avoidance and Loss control are called risk control techniques, because they attempt to reduce the frequency and severity of accidental losses to the firm. On the other hand, retention, non-insurance transfers and insurance are called risk financing techniques, because they provide for the funding of accidental losses after they occur.
Avoidance means that a certain loss exposure is never acquired (refusal), or an existing loss exposure is abandoned. For example, a firm can avoid earthquake loss by not building a plant in an earthquake prone area. An existing loss exposure may also be abandoned. For example, a pharmaceutical firm that produces a drug with dangerous side effects may stop manufacturing that drug.The major advantage of avoidance is that the chance of loss is reduced to zero, if the loss exposure is not acquired. In addition, if an existing loss exposure is abandoned, the possibility of loss is either eliminated or reduced because the activity that could produce a loss has been abandoned.
However, avoidance has two disadvantages. First, it may not be possible to avoid all losses. For example, a company cannot avoid the pre-mature death of a key executive. Second, it may not be practical or feasible to avoid the loss exposure. In the above said example, the pharmaceutical company can avoid losses arising from the production of a particular drug. However, without any drug production, the firm will not be in business.
(II) Loss Control:
It is another method of handling loss in a risk management program. Loss control measures attack risk by lowering the chance a loss will occur (loss frequencies) or by reducing the amount of damage when the loss does occur (loss severity). Loss control tools can be classified as: loss prevention and loss reduction measures.
The following are the examples that illustrate how loss control measures reduce the frequency and severity of losses.
Measures that prevent loss frequency are quality control checks, driver examination, strict enforcement of safety rules and improvement in product design.
Measures that reduce loss severity are the installation of an automatic sprinkler or burglar alarm system, employing fire extinguishers, early treatment of injuries and rehabilitation of injured workers.
Retention means that the firm retains part or all of the losses that result from a given loss exposure. It can be effectively used when three conditions exist.
First, no other method of treatment is available. Insurers may be unwilling to write certain type of coverage. Non-insurance transfers may not be available. In addition, although loss control can reduce the frequency of loss, all losses cannot be eliminated. In these cases, retention is a residual method. If the loss exposure cannot be insured or transferred, then it must be retained.
Second, the worst possible loss is not serious. For example, physical damage losses to automobiles in a large firm’s fleet will not bankrupt the firm.
Finally, losses are highly predictable. Retention can be effectively used for workers compensation claims, physical damage losses to automobiles, etc. Based on past experience, the risk manager can estimate a probable range of frequency and severity of actual losses.
Determining Retention Levels:
If retention is used, the risk manager must determine the firm’s retention level, which is the Dollar / Birr amount of losses that the firm will retain. A financially strong firm can have a higher retention level than one whose financial position is weak.
Though there are many methods of determining retention level, the following two methods are very important.
First, a Corporation can determine the maximum uninsured loss it can absorb without adversely affecting the company’s earnings can dividend policy. One rough rule is that the maximum retention can be set at 5% of the company’s annual earnings before taxes from current operations.
Second approach is to determine the maximum retention as a percentage of the firm’s net working capital, such as between 1% and 5%. Although this method does not reflect the firm’s overall financial position for absorbing a loss, it measures the firm’s ability to fund a loss.
If retention is used, the risk manager must have some method for paying losses. Normally, a firm can pay losses by one of the following three methods:
- The firm can pay losses out of its current net income, with the losses treated as expenses for that year. However, a large number of losses could exceed current net income. Then, other assets may have to be liquidated to pay losses.
- Another method is to borrow the necessary funds from a bank. A line of credit is established and used to pay losses as they occur. However, interest must be paid on the loan and loan repayments can aggravate cash flow problems the firm may have.
- Another method for paying losses is an unfunded or funded reserve. An unfounded reserve is a book keeping account that is charged with the actual or expected losses from a given risk exposure. A funded reserve is the setting aside of liquid funds to pay losses. Private employers does not use funded reserve, in their risk management programs, because the funds may yield higher return if it is used in the business.
Advantages of Retention:
- The firm can save money in the long run if its actual losses are less than the loss allowance in the insurer’s premium.
- The services provided by the insurer may be provided by the firm at a lower cost. Some expenses may be reduced, including loss-adjustment expenses, general administrative expenses, commissions and brokerage, etc.
- Since the risk exposure is retained, there may be greater care for loss prevention.
- Cash flow may be increased since the firm can use the funds that normally would be held by the insurer.
Disadvantages of Retention:
- The losses retained by the firm may be greater than the loss allowance in the insurance premium that is saved by not purchasing the insurance.
- Actually, expenses may be higher as the firm may have to hire outside experts such as safety engineers. Thus, insurers may be able to provide loss control services less expensively.
- Income taxes may also be higher. The premiums paid to an insurer are income-tax deductible. However, if retention is used, only the amounts actually paid out for losses are deductible. Contributions to a funded reserve are not income-tax deductible.
(IV) Non-Insurance Transfers:
Non-insurance Transfers is another method of handling losses. Non-insurance transfers are methods other than insurance by which a pure risk and its potential financial consequences are transferred to another party. Examples of non-insurance transfers include contracts, leases and hold-harmless agreements. For example, a company’s contract with a construction firm to build a new plant can specify that the construction firm is responsible for any damage to the plant which it is being built.
A firm’s computer lease can specify that maintenance, repairs and any physical damage loss to the computer are the responsibility of the computer firm. Otherwise, a firm may insert a hold-harmless clause in a contract, by which one party assumes legal liability on behalf of another party. Thus, a publishing firm may insert a hold-harmless clause in a contract, by which the author and not the publisher is held legally liable if anybody sued the publisher.
Advantages of Non-Insurance Transfers:
- The risk manager can transfer some potential losses that are not commercially insurable.
- Non-Insurance transfers often cost less than insurance.
- The potential loss may be shifted to someone who is in a better position to exercise loss control.
Disadvantages of Non-Insurance Transfers:
- The transfer of potential loss would become impossible, if the contract language is ambiguous.
- If the party to whom the potential loss is transferred is unable to pay the loss, the firm is still responsible for the claim.
- Non-Insurance Transfers may not always reduce insurance costs since an insurer may not give credit for the transfers.
Insurance is also used in a risk management program. Insurance is appropriate for loss exposures that have a low probability of loss but the severity of loss is high. If the risk manager uses insurance to treat certain loss exposures, five key areas must be emphasized. They are as follows;
- Selection of insurance coverages
- Selection of an insurer
- Negotiation of terms
- Dissemination of information concerning insurance coverages
- Periodic review of the insurance program
(i) Selection of insurance coverages:
The risk manager must select the insurance coverages needed. Since there may not be enough money in the risk management budget to insure all possible losses, the need for insurance can be divided into three categories;
- Essential Insurance
- Desirable Insurance
- Available Insurance
Essential Insurance includes those coverages required by law or by contract, such as workers compensation insurance. It also includes those coverages that will protect the firm against a loss that threatens the firm’s survival. Desirable insurance is protection against losses that may cause the firm financial difficulty, but not bankruptcy. Available insurance is coverage for slight losses that would merely inconvenience the firm.
(ii) Selection of an Insurer:
The next step is that the risk manager must select an insurer or several insurers. Here, several important factors are to be considered by the risk manager. These include the financial strength of the insurer, risk management services provided by the insurer and the cost and terms of protection. The insurers financial strength is determined by the size of policy owner’s surplus, underwriting & investment results, adequacy of reserves for outstanding liabilities, etc. The risk manager can identify the financial strength of the insurer by referring the rating given to that insurance company. For example in America, A.M.Best Company is one of the famous rating company that publishes the rating of insurers based on their relative financial strength. Besides, the financial strength, the risk manager must also consider the risk management services by the insurer and the cost & terms of protection.
(iii) Negotiation of terms:
After the insurer is selected, the terms of the insurance contract must be negotiated. If printed policies, endorsements and forms all used, the risk manager and insurer must agree on the documents that will form the basis of the contract. If a specially tailored manuscript policy is written for the firm, the language and meaning of the contractual provisions must be clear to both parties. If the firm is large, the premiums are negotiable between the firm and insurer.
(iv) Dissemination of information concerning insurance coverages:
Information concerning insurance coverages must be given to others in the firm. The firm’s employees must be informed about the insurance coverages, the records that must be kept, the risk management services that the insurer will provide, etc.
(v) Periodic review of the insurance program:
The entire process of obtaining insurance must be evaluated periodically. This involves an analysis of agent and broker relationships, coverages needed, cost of insurance, quality of loss-control services provided, whether claims are paid promptly, etc.
Advantages of Insurance:
- The firm will be indemnified after a loss occurs. Thus, the firm can continue to operate.
- Uncertainty is reduced. Thus, worry and fear are reduced for the managers and employees, which should improve their productivity.
- Insurers can provide valuable risk management services, such as loss-control services, claims adjusting,etc.
- Insurance premiums are income-tax deductible as a business expense.
Disadvantages of Insurance:
- The payment pf premiums is a major cost. Under the retention technique, the premiums could be invested in the business until needed to pay claims, but if insurance is used, premiums must be paid in advance.
- Considerable time and effort must be spent in negotiating the insurance coverages.
- The risk manager may take less care to loss-control program since he has insured. But, such a lax attitude toward loss control could increase th number of non-insured losses as well.
4. Selection of Risk Management Tools:
Risk Management Matrix
Type of Loss
Appropriate Risk Management Technique
Loss Control & Retention
In determining the appropriate method or methods of handling losses, the above matrix can be used. It classifies the various loss exposures according to frequency and severity.
The first loss exposure is characterized by both low frequency and low severity of loss. One example of this type of exposure would be the potential theft of a secretary’s Note pad. This type of exposure can be best handled by retention, since the loss occurs infrequently and when it occurs it does not cause financial harm.
The second type of exposure is more serious. Losses occur frequently, but severity is relatively low. Examples of this type of exposure include physical damage losses to automobiles, shoplifting and food spoilage. Loss control should be used here to reduce the frequency of losses. In addition, since losses occur regularly and are predictable, the retention technique can also be used.
The third type of exposure can be met by insurance. Insurance is best suited for low frequency, high severity losses. High severity means that a catastrophic potential is present, while a low probability of loss indicates that the purchase of insurance is economically feasible. Examples include fires, explosion and other natural disasters. Here, the risk manager could also use a combination of retention and insurance to eal with these exposures.
The fourth and most serious type of exposure is characterized by both high frequency and high severity. This type of risk exposure is best handled by avoidance. For example, if a person has drunken and if he attempts to drive home in that drunken stage, the chance of meeting with an accident is more. This loss exposure can be avoided by not driving at the drunken stage or by having a driver to drive his car.
5. Risk Administration:
The next and the final step in the risk management process is implementation and administration of the risk management program. It involves three important components;
- Risk management policy statement
- Co-operation with other departments
- Periodic review and evaluation
(i) Risk management policy statement:
A risk management policy statement is necessary in order to have an effective risk management program. This statement outlines the risk management objectives of the firm, as well as company policy with respect to the treatment of loss exposures. It also educates top level executives in regard to the risk management process and gives the risk manager greater authority in the firm. In addition, a risk management manual may be developed and used in the program. The manual describes the risk management program of the firm and can be a very useful tool for training new employees who will be participating in the program.
(ii) Co-operation with other departments:
The risk manager has to work in co-operation with other functional departments in the firm. It will facilitate to identify pure loss exposures and methods of treating these exposures. The Accounting Department can adopt Internal Accounting Controls to reduce employees fraud and theft of cash. The Finance Department can provide information showing how losses can disrupt profits and cash flow. The Marketing Department can prevent liability suits by ensuring accurate packaging. Besides, safe distribution procedures can prevent accidents. The Production Department has to ensure quality control and effective safety programs in the plant can reduce injuries and accidents. The Personnel Department may be responsible for employee benefit program, pension program and safety program.
(iii) Periodic review & evaluation:
The risk management program must be periodically reviewed and evaluated to see whether the objectives are being attained or not. Especially, risk management costs, safety programs and loss preventive programs must be carefully monitored. Loss records must also be examined to detect any changes in frequency and severity. Finally, the risk manager must determine whether the firm’s overall risk management policies are being carried out, and whether the risk manager is receiving the total co-operation of the other departments in carrying out the risk management functions.