Five Steps to World Class Risk Management

Numbers are in vogue. Scanning recent bestseller lists, we see that numbers are popular in book titles. In fact, numbers and lists seem to dominate the charts. These include Ten Stupid Things that Women Do to Mess Up Their Lives, The Five People You Meet in Heaven, A Second Helping of Chicken Soup for the Soul, and The Seven Habits of Highly Effective People.

Just as there are highly effective people, there are highly effective companies. Some companies have built highly effective risk management systems that include ways to reduce financial risk or cushion its blow.

Let us look at five steps to building a world-class risk management department:

1. Learn from ClaimsIn departmentalized, compartmentalized companies, line personnel and risk managers may talk to each other infrequently. This is due to many factors: both are loaded down, busy with operational responsibilities and exacting accountabilities. When you are up to your neck in alligators, it's tough finding time to drain the swamp.

How can firms strengthen the tie between claim-handling and risk management?

Conduct claim autopsies Big claims should get a post-mortem from a risk management standpoint. In a sense, every risk manager is like Quincy, M.D. The aim is to learn: what went wrong, and what can we do to keep this from happening again?

Buy more than a release Large loss settlements require more than just signatures on releases. Do not consider a claim closed until you have isolated the reason for the loss, diagnosed the cause, and ensured that such causes do not recur.

Involve defense attorneys On high-ticket claims, have defense attorneys opine on such questions as: “How could this loss have been avoided?” and “What kernels of loss prevention wisdom have emerged from this situation?” This also develops outside counsels' abilities to practice preventive law, making their advice even more valuable.

Follow up with specific actions on specific problems After claim files close, circle back to divisions or product groups that had sizeable losses. Once you have identified the exposures, formulate action plans, i.e., concrete series of steps for resolving and monitoring problems.

Hold training sessions with safety themes This goes beyond telling war stories. It means reviewing and learning hard-earned lessons from claim files, open and closed. Ask claim people to address the operation folks about do's and don'ts, repeated loss patterns, what gets them into trouble, and what to avoid.

Claim people are on the front lines. They can be excellent sources of intelligence on what is really happening.

2. Go Beyond Legal ComplianceSee legal compliance as the start of risk management, not its pinnacle. Complying with the law is a necessary, but not sufficient, condition for sound risk management. Remember, however, that merely complying with legal requirements will not insulate anyone from claims or lawsuits. There still is a legal duty to exceed those requirements. With limited exceptions, mere compliance with legal standards will not be a defense for a liability claim. Companies must meet legal standards to cement good risk management programs, but they also must exceed them.

Although legal compliance does not shield companies from claims or suits, failure to comply with statutory standards could be used against them. It may not be fair, but it is reality. If you have recalls, safety violations, or sanctions from state or federal regulatory bodies, these can and will be used against you to support claims and to persuade juries that you are culpable. Strive for a “Caesar's wife” record in legal compliance.

3. Use a Diverse Toolbox We can view risk management as a process that involves identifying possible causes of loss, finding and selecting appropriate techniques to address those causes, implementing the techniques, and monitoring risk management programs for results. The risk management toolbox contains four classic risk management techniques, all of which apply in varying degrees to medical product liability:

oAvoidance — shying away from an activity or operation due to its potential for loss;

oControl — taking action to reduce the frequency and severity of losses;

oRetention — making a conscious decision to self-fund losses without transferring risk to insurers; and

oTransfer — shifting the financial consequence of loss to other entities.

The most obvious example of transfer is insurance. Insurance is a common risk management technique, but it works best when blended with avoidance, control, and retention. Highly effective risk managers mix and match these techniques.

4. Avoid Risk Management MythsUrban myths are fodder for tabloid fantasy. Risk management has its own lore and myth. Conventional wisdom sometimes is neither conventional nor wise, however, and some common risk management myths fail the test of experience.

Consider, for example, the adage that the past is a prologue when it comes to loss activity. Those who adhere to this belief will tell you, “I've never had an accident before,” “I've never had a claim,” or “All our past claims were small.”

It is tempting to review past loss patterns in gauging the probability of future losses. While that is a starting point, it may or may not be a reliable indicator of the odds of future losses or their severity.

Maybe you have had a run of good fortune. Maybe your operations have grown so that you are more likely to have a mishap. Perhaps the legal environment has changed (“Hey, let's sue for mold.”) due to new laws or court decisions.

The past does not necessarily predict future loss patterns, the need for insurance, or the amount of financial protection that is prudent.

Another popular myth is that outsourcing solves all risk management problems. Some firms think that outsourcing relieves them of legal liability or the need for insurance. This can be a costly error. Courts and juries still can find a principal liable for an independent contractor's failings, such as when the general contractor did not exercise reasonable care in picking the subcontractor. Another case might involve the independent contractor's practice of maintaining no or low insurance limits.

Many also believe that safety is an expense. Instead, view safety as an investment. Safety represents up-front costs, such as upgraded software, process controls, and legal reviews of proposed labels and warnings. These are either direct or opportunity costs.

Bean counters may be tempted to view them as expenses, which, of course, they are in a way. The up-front costs of these measures are quantifiable. The savings in terms of accidents that did not happen are real, but tougher to document. Unfortunately, we cannot point to the accident that did not occur due to improved design, new quality software, or legal counsels' reviews of marketing materials.

The moral is that risk managers should be frugal in expenditures, but view safety as an investment more than an expense.

5. See Risk Management as a ProcessIs risk management a job? Yes and no. A firm may not have a full-time risk manager. Often, companies must grow to a certain size and pay a certain amount in insurance premiums to justify the luxury of a full-time risk manager. Risk management, like other financial roles, is largely a staff, not line, position within a firm's hierarchy.

Smaller companies may combine the risk management function with the CFO, controller, or vice president of finance. The role of risk management, reducing the causes and financial impact of uncertainty, should be a priority for everyone within the organization, however.

Management should encourage and empower employees to seek ways to do things more safely. The good thing about having a risk manager is that it brings a new level of full-time attention toward, and engagement with, risk issues. The disadvantage is that it can unwittingly allow other employees to think that safety and risk reduction are someone else's job, not something with which they need be concerned.

Risk management is more than a job; it is a mind set, a mind set that must permeate the organization. Risk management is an ongoing process. You do not implement risk management policies, cross them off a checklist, and then move on. Risk management principles, along with a focus on safety, must be woven into the very fabric of a firm's culture. This is possible through upper management attention, rewarding people who provide safety suggestions, tracing adverse outcomes, and publicizing success stories of quality in operations.

Risk management is both a process and a destination. It is not something to consider only after there is a recall, a big jury award, or a class action lawsuit. It requires a sustained, ongoing commitment, not a flavor-of-the-month approach. Those who embrace this credo can build world-class risk management programs.

Claim Pros Can Be World Class, Too

Adjusters contribute to a learning organization. They can share what they learn adjusting claims with insureds, underwriters, brokers, and loss prevention managers. What have we learned that could help promote safety and prevent future claims?

Look at the legal compliance aspect, but don't assume liability is a slam-dunk. Neophyte adjusters often think that getting a traffic ticket means automatic liability on the civil case. Maybe, maybe not.

Invest in training. View claim staff training not as an expense but as an investment, part of the company's necessary research and development.

Avoid the myth that claims is a cost center. Every department represents costs. Good claim service can cement client retention and customer acquisition, which goes straight to the bottom line.

Claims is not just a job, it is a profession. Or can be, or should be. Hold yourself and your claim staff to high standards of professionalism in expertise, communication, appearance, and ethics.

Kevin Quinley is senior vice president of Medmarc Insurance Group in Chantilly, Va. Reach him at kquinley@kevinquinley.com or www.kevinquinley.com.