Alliance for Children and Families, January 15, 2003
Risk management is a way of preventing losses. Learn the definitions and applications of key terms and processes.
Risk Management for Nonprofit Organizations
S C E N A R I O : You’re reading the newspaper and notice a photo of a 15-passenger van that overturned on a nearby highway. Several children died and others are in the hospital with severe injuries.
You read: “Studies conducted by the National Highway Safety Transportation Administration (NHSTA) reveal that loaded 15-passenger vans have significantly higher risk of rollover than passenger cars and light trucks. Loading the vans raises the center of gravity and shifts it towards the rear greatly affecting the handling characteristics. When heavily loaded the steering characteristics and responsiveness are very different from light passenger vehicles, this can cause serious consequences in an emergency situation when an untrained driver expects the vehicle to respond like a car.”
Your mind turns to your agency’s fleet. You own seven of these vehicles and they’re on the road constantly with children, staff, and parents. You realize that you may well have a disaster waiting to happen, and you remember that your board recently asked you about your risk management program. You’re pretty sure that 15-passenger vans are where you’ll start.
What is risk management? In simple terms, it is a way of preventing losses. Property loss. Personnel loss. Income loss. Reputation loss. It’s also a way of keeping your insurance premiums low. We’ll get to insurance in the next issue of the magazine. Right now we need to get ourselves oriented to the language of risk management and how it works.
Most of us discover risk management without knowing it. It’s not rocket science, nor is it a flavor-of-the-month management program. Risk management comes out of the insurance industry, where they analyze risk, apply the analysis to a customer’s needs, and then place their bet on the policy written and premiums charged. If they’re right, premium income covers all losses with a bit left over for company shareholders. If they’re wrong, they lose.
I’d like to bring a number of risk management concepts into your operations so that you can become savvy risk managers.
Risk Management Is Part of Everything You Do
For internal purposes, risk management within a social service agency is any process that helps minimize losses within programs, staff, and facilities. In the boardroom, risk management is carried out within strategic planning, budgeting, and policy formation. In program areas, it is new staff orientation, in-service training, incident reviews, and case management. With your facilities, it is preventive maintenance and rapid response to physical damage. In short, risk management is any systematic process that helps you analyze things that go wrong and take steps so they won’t inflict harm to your agency.
For external purposes, risk management processes are great data generators to assure customers, regulators, donors, and the public that your agency is stable, proactive, and credible. Good risk management makes you a credible partner for organizations that want to contract, subcontract, or engage in joint ventures.
In other words, in its fullest sense, risk management is nothing less than the way you do business.
Five Steps in the Risk Management Process
Because risk management came out of the insurance industry, it is geared to a single goal: loss prevention. The following five-step process is taken from materials provided by the Insurance Institute of America.
STEP 1: IDENTIFY AND ANALYZE LOSS EXPOSURES. In Step 1, you determine the value of each piece of property or each potential hazard and seek out the potential causes of loss that might occur. Digging further, you calculate the financial consequences if the property is lost or if the hazard results in liability to your agency.
You can identify loss exposures in your agency in a number of ways: by conducting standardized surveys/questionnaires, by tallying up loss histories, by looking at your financial statements and written records, by developing flowcharts, by personal inspection, and even by bringing in experts. Your insurance broker can help you with some of these.
When possible losses have been identified, you must prioritize them. How important are they to accomplish your exempt purpose? To achieve program growth and success? To maintain stable revenues? To ensure continuous operations? To conform with licensure requirements? Risk management is all about placing your money where it will do the most good, that is, where it can be used most strategically. You can’t choose among options unless you know what your priorities are.
STEP 2: EXAMINE FEASIBILITY OF ALTERNATIVE RISK MANAGEMENT TECHNIQUES. There are only four ways you can control your risks: avoidance, control (i.e. lessening its frequency or severity), retention, or transfer. After you know what your risks are, you have to decide which method is most useful in dealing with them. Here are your choices:
Avoidance is your most complete and sometimes the most practical form of risk management. You simply choose not to engage in an activity or to hold some asset that gives rise to the possibility of loss. This might mean closing a facility that is so outdated that it is unsafe for use, or eliminating a program or service that has been causing numerous claims due to employee turnover, dangerous incidents, etc.
Control by Loss Prevention seeks to reduce the frequency of loss. You might prevent incidents by increasing staff training, addressing retention and turnover issues, or fixing a physical plant problem that has caused repeated injuries.
Control by Loss Reduction seeks to reduce the severity of loss. You might provide fire extinguishers at more frequent intervals so they are easier to get to, use computer backups to reduce the amount of lost data in the event of a power outage.
Control by Segregation provides two methods for controlling loss. Separation puts space between people, property, or processes in order to lessen the impact of a failure by one of them. Accounting controls rely on separation of bookkeeping functions (such as authorizing expenditures and signing checks) in order to reduce the likelihood of errors, mismanagement, or fraud. Duplication provides backups, spares, and cross training programs to get tasks done when there is a failure in one area. Having adequate on call or back-up staff and spare tires in cars are two examples of duplication.
Retention means that you accept the risk and pay for it out of your own resources. There are several ways to internally finance a risk. You expense lost or damaged property, bad debt, or occupancy swings within your annual budget. You create reserves or borrow from the bank to cover losses. You might even self insure by creating a captive insurer under state law (for example, you may self insure for auto coverage in Illinois if you have 25 or more cars and certain specified asset levels).
Transfer means contractually transferring both the legal and financial responsibility for a loss. If you work with another agency, you might execute hold harmless agreements so that you will not bear the loss if there is an incident. Insurance is the ultimate form of contractual transfer, as the insurance company legally agrees to underwrite the risk of your activities by executing a detailed contract to that effect.
STEP 3: SELECT APPARENT BEST TECHNIQUES. You select from the above alternatives by establishing selection criteria and decision rules. Your goal is to either avoid the losses or finance them when and if they occur. Obviously, this step is possible only if Steps 1 and 2 have been properly done. When losses are identified well and alternative techniques have been thoroughly explored, the process of selecting the best techniques to control or transfer losses will often become apparent. If Step 3 gets bogged down, it might be appropriate to go back and re-evaluate Steps 1 and 2.
STEP 4: IMPLEMENT THE CHOSEN TECHNIQUES. You implement your chosen risk management techniques in two ways. Technical activities are carried out by those that have expertise within that area. Purchasing insurance, staff training and developing a boiler repair and maintenance plan are examples of technical activities. Managerial activities are those that require cross-organizational coordination or cooperation. These must be managed by a person having authority to engage departments or divisions.
STEP 5: MONITOR AND EVALUATE THE RISK MANAGEMENT PROGRAM. As with any process, monitoring and evaluating your risk management program results in continuous process improvement. Someone within the organization must be given the job of detecting errors and omissions and adapting the program to changes that come along.
You need both detail people and “big picture” people involved in risk management in order to make it a success. The former develops tight systems that generate data and make it possible to correctly analyze your risks. The latter can intuitively sense when decisions are right or wrong for your agency. If you make sure that all involved speak the same language, they can become an effective risk management team.