Risk Assessment Road Map

06/2009

Has something gone wrong with a current activity?

Or, are you considering a new activity?

The Incident Analysis Approach

The Difference BetweenIncident Analysis and Risk Assessment

Incident Analysis:• Establishes a cause

for an incident that has already happened.

• Focuses on analyzing the reasons for the incident and development of strategies to prevent future incidents.

Risk Assessment:• Focuses on

identification of potential exposures to prevent incidents from happening.

• Breaks business decisions down into bite sized pieces to enable pre-planning for loss control and mitigation strategies.

If something has gone wrong with an activity, you may want to analyze the

incident (what went wrong) before moving forward.

Why Analyze Incidents?

• To establish cause and prevents future incidents.

• To determine ALL causes and contributing factors to the incident.

• To identify corrective actions.

• To assess the risks of future activities.

Identify Systems Failures/Causes

• Rarely a Single Cause.

• Be Objective, Consistent.

• Avoid Blame Finding.

• Systems/Causal Factors.– Management– Equipment– Environmental – People

Management People

Equipment Environment

INCIDENT

Systems Contributing To An Incident

Management

•Policies & Procedures•Training & Other Resources•Accountability Practices

People•Training • Level of experience• Moral or morale• Competency• Past incidents

Equipment

•Maintenance Records–Repairs–Modifications

•Availability of Proper Equipment

Environment

•Distractions•Visibility•Conditions•Hazards•Terrain•Other Users

Recommend Corrective Actions

• Based on specific systems failures/causes.

• Plan and recommend changes that will prevent further incidents of this nature.

• Analyze the risks associated with the changes.

• Follow up to ensure changes are instituted and maintained.

The Risk Assessment Road Map Process

What is Risk Assessment?

A strategic approach to planning, at all levels and across all functions of an organization, that identifies exposures of activities and assists in making risk adjusted business decisions every day.

GET RID OF SILOS

What is the specific activity?

What is Your Agency’s Appetite

for Risk?

What is a Risk Appetite?• Risk appetite is the degree of

uncertainty an agency is willing to accept to reach its goals.

• Risk appetite is a key factor in evaluating strategic options.

• Risk Assessment helps management consider risk appetite when setting goals that align with overall agency strategy, and managing risks related to that strategy.

Work with your agency’s management to decide:• What is your agency’s risk

tolerance?

• How much or what are you willing to risk to accomplish the mission or activity?

• How much can your agency afford to lose in any one occurrence or in the aggregate?

What Does Your Agency Do?

(Mission, Goals, Objectives)

Does the activity fit the Agency

mission, goals, objectives?

NoIf the answer =

Take to management for consideration

Management decides yes =

Move on

Management decides no =

Stop

If the answer = Yes

What could go wrong? Who could be harmed?

Make a list - write it down. These are your loss exposures.

What could happen?

• Could there be bodily injury, property damage or other liability exposures caused by this service or activity?

• Is there any impact on workload? Could there be any damage to our systems?

What is Risk?

The danger or probability of loss.

Loss Exposure

Possibility of financial loss as the result of a particular peril

striking a thing of value.

Components of a Loss Exposure

The type of value exposed to loss.

The peril that causes the loss. The extent of the potential

financial consequences of that loss.

Values Exposed to Loss

• People

• Property

• Freedom from Liability

(Alleged Wrongdoing)

Perils Causing Loss

Natural Perils:

Human Perils:

Economic Perils:

Potential Financial Consequences

Make sure that you don’t give away the farm!

THINK ABOUT WHAT CAN GO

Wrong!

Why is this important?

An unrecognized loss exposure cannot, except by chance, be effectively managed.

Is this your agency?

Methods Of Identifying Exposures:

• Previous contracts of similar type and their outcomes.

• Standardized surveys/questionnaires• Financial statements• Records and files• Loss Reports/Claims• Flowcharts• Personal inspections• Experts

Rate the Risks of Loss and Weigh the Value of

Opportunities

Rate the severity of the risk of each potential loss exposure. How bad can each loss be?

What could it cost?

Rating Severity Description (Risk)

1 Insignificant No injuries; low financial loss

2 Minor First aide treatment; minor financial loss

3 Moderate Injuries; loss of operations; moderate financial loss

4 Major Extensive injuries; loss of operations; major financial loss

5 Critical Death; major loss of operations; huge financial loss

Rating the Severity of Loss Exposures

What is the likelihood that each of these potential loss

exposures will happen?

Rating the Likelihood of Occurrence

Rating Descriptor Likelihood

(Probability)

Description

1 Rare 1 – 10% May occur only in exceptional circumstances

2 Unlikely 11 – 25% Could occur at some time

3 Possible 26 – 75% Might occur at some time

4 Likely 76 – 90% Will probably occur in most circumstances

5 Almost Certain

91 – 100% Is expected to occur in most circumstances

INSIGNIFICANT MINOR MODERATE MAJOR CRITICAL

ALMOST CERTAIN

M H E E E

LIKELY M M H E E

POSSIBLE L M H E E

UNLIKELY L L M H E

RARE L L M H H

Determine the risk rating/level of risk for each potential loss exposure.

Severity

Likelih

oo

d

Risk Rating (RR) = Level Of Risk

• E = Extreme Risk - involve senior management immediately, emergency situation, consider not doing the activity.

• H = High Risk - management attention required for business and policy decisions, risk control, insurance types and limits, etc.

• M = Moderate Risk - management should be kept informed of risk control, insurance types and limits, etc.

• L = Low Risk - manage by routine procedures, insurance types and limits could be flexible.

Now That You Have Rated The Risks Of Loss.…

Think About The Value Of OPPORTUNITIES

EXPLOITING OPPORTUNITIES

• What opportunities will be missed if the activity is not done?

• What is the upside and downside of these opportunities?

• By considering the full range of potential events—rather than just risks—the risk assessment process ensures that management can identify and take advantage of positive events quickly and efficiently.

Weighing the Value of OpportunitiesRating Value Description (Opportunity)

1 Insignificant Minor budgetary, funding, or resource gain; Little or no gain in public and/or client relations.

2 Minor Low budgetary, funding, or resource gain; Some gain in public and/or client relations.

3 Moderate Moderate budgetary, funding, or resource gain; Adequate public and/or client relations.

4 Major Major budgetary, funding, or resource gain; Good public and/or client relations.

5 Critical Huge budgetary, funding, or resource gain; Excellent public and/or client relations.

If RR = E or H

Is the Activity

Necessary?

If the Answer = No

Management Business Decision

No = StopManagement Decides Yes = Move On

For Each Thing That Could Go Wrong…

What Tools Are Available To Manage the Risks?

Statutory Immunities:Research Statutes

No = Move on to Loss Prevention/Risk

Control Measures

Do any immunities apply to the

activity?

Statutory Immunities

If the Answer is: Yes

What are the limitations and/ or exclusions?

Do you have a legal opinion on statutory immunities?

No = Management business decision on legal opinion

Yes = Move on to Loss Prevention/Risk Control

Measures

Loss Prevention/Risk Control Measures

Avoid the risk altogether. Prevent the frequency of loss. Reduce the severity or cost of loss. Segregate to prevent one event

from causing loss to the whole. Contractually transfer the risk.

What are Loss Prevention/Risk Control Methods?

Avoid Exposure

Entirely eliminates any possibility of loss. It is achieved either by abandoning or never undertaking an activity or an asset.

Loss PreventionReduces the frequency or number of

losses.

Loss ReductionLowers the severity or cost of a loss.

Segregate Your Losses

Arrange your agency’s activities and assets to prevent one event from causing loss to the

whole.

- two methods -

SeparationSeparate activities and assets among

several locations.

DuplicationProvide a duplicate or stand by for use in

case assets or activities suffer a loss.

Contractual Transfer of Risk

GOAL:

To insure that a contractor is responsible for claims arising

out of his or her acts, and has some way to pay for these losses.

Develop Risk Control Measures Specific to the Situation

• Personal protective equipment.

• Housekeeping, repair, and maintenance.

• Inspections.

• Tools and equipment.

• Policies, procedures, and process.

• Supervision.

• Contract management and administration.

Which measures best fit the mission,

activity, and RR?

How can the measures be implemented

? Who will implement?

Who will be responsible for making

sure the measures

are followed?

Who will be responsible for ongoing monitoring?

Did you choose Contractual Transfer?

Yes = Move on to select appropriate Contractual

Transfer Contract Clauses

No = Go to State’s Self – Insurance or

Commercial Insurance

Contractual Transfer – Contract Clauses

• Independent Contractor

• Indemnity/Hold Harmless.

• Insurance and Bonds.

• Warranties.

Will you use a

contract?

Will you use a

template?

Will you require

insurance or

bonds?

No = How will the state be protected?

Re-evaluate the situation. Figure out how the state will be

protected. Talk to management.

Yes = Move on to Contractual Transfer

Coverage Assessment

What kind and how much

insurance or bonds?

Your World has changed!9-11-01

Where Does Risk Assessment, Insurance, Bonding and Indemnification Fit in the

Contracting Process?

• At the inception of an idea, your agency should perform a risk assessment of the activity.

Common Types of Insurance Coverage

• Commercial General Liability• Automobile Liability Coverage• Professional Liability• Workers’ Compensation• Builder’s Risk Coverage• Excess Liability Coverage• Pollution Liability Coverage• Tail Coverage

What Does General Liability Insurance

Really Cover?

General Liability Insurance Myths

• Insurance covers “the indemnification provided in the contract.” – FALSE

• General Liability insurance will cover your entity if the contractor’s work is done “negligently.” – FALSE

• There is “contractual liability” coverage in a General Liability policy.– MOSTLY FALSE

Commercial General Liability (CGL)

Insurance covering “Third Party”:Bodily injury. Property damage.Limited Contractual liability.Products and completed operations. May also cover personal and

advertising injury liability.

CGL Policy Definitions

Bodily Injury: The injury of physical tissue by an outside force, bodily harm, sickness, or disease.

Personal Injury: Libel, slander, false arrest, and invasion of privacy.

CGL Policy Definitions(Continued)

Products & Completed Operations: Insurance covering the contractor for damage or injury to third parties resulting from something the contractor made, repaired, or installed. The damage to third parties resulting from the service would be covered not the contractors actual product.

CGL Policy Definitions(Continued)

Contractual Liability: A portion of Commercial General Liability coverage that allows limited coverage for liability assumed under the contract. The coverage allowed by Contractual Liability includes: Liability assumed under an “insured

contract”. Liability that the insured would have in

the absence of the contract or agreement.

What is an “Insured Contract”?

Per the CGL Policy Definitions, an “Insured Contract means:

• A contract for a lease of premises.

• A sidetrack agreement (a railroad term).

• Easements.

• Agreements required by municipalities as a result of ordinances (not for work done for municipalities.)

• Elevator maintenance agreements.

• Liabilities that “would be imposed by law in the absence of any contract or agreement.”

Current Case Law

• Id. at 479. A tort claim, where there is a contract between parties, may only proceed where there is some kind of obligation owed by one party to the other beyond the duties that the contract imposes.

• Id. at 477. Examples of such relationships are those between lawyers and clients, doctors and patients, or trustees and beneficiaries. The court has called these “special relationships.”

Jones v. Emerald Pacific Homes, 188 Or App 471, id at 477 & 479

Special Relationships

Only Exist When:

• One party has relinquished control over the subject matter of the relationship to the other party; and

• Has placed its potential monetary liability in the other’s hands.

Will you require Additional Insured and other clauses?

No

Re-evaluate the situation. Figure out how the state will be

protected. Talk to management.

How Much Insurance Should Be Required?

Use the risk rating to set insurance and bonding limits.

INSIGNIFICANT MINOR MODERATE MAJOR CRITICAL

ALMOST CERTAIN

M H E E E

LIKELY M M H E E

POSSIBLE L M H E E

UNLIKELY L L M H E

RARE L L M H H

Likelih

oo

d

Severity

E = Extreme Risk:

• First, consider not doing the activity.• If you must, you will need to decide

how much a potential loss could cost?

• In general, risks at this level warrant more than $1.5 million per person and $3 million per occurrence in coverage for Bodily Injury (BI) and Death. In addition, if property damage is an exposure, add $100,000 per single limit and $500,000 per occurrence.

H = High Risk:• Could a potential loss cost in excess of $1.5

million per person and $3 million per occurrence in coverage for Bodily Injury (BI) and Death? Ask for more coverage. In addition, if property damage is an exposure, add $100,000 per single limit and $500,000 per occurrence.

• Make sure your assessment considers all costs of potential losses.

• Risk Management would not recommend limits of less than $1.5 million per person and $3 million per occurrence in coverage for Bodily Injury (BI) and Death. In addition, if property damage is an exposure, add $100,000 per single limit and $500,000 per occurrence.

M = Moderate Risk:• Standard limit of insurance is $1.5 million

per person and $3 million per occurrence in coverage for Bodily Injury (BI) and Death. In addition, if property damage is an exposure, add $100,000 per single limit and $500,000 per occurrence.

• Assessment should consider all costs of potential losses.

• If assessment reveals potential loss in excess of $1.5 million per person and $3 million per occurrence in coverage for Bodily Injury (BI) and Death and in addition, if property damage is an exposure, add $100,000 per single limit and $500,000 per occurrence, your risk may actually be high (see H for High Risk.)

L = Low Risk:• If risk is minimal, this is the area where coverage and

limits may potentially be flexible.• Standard limit is still $1.5 million per person and

$3 million per occurrence in coverage for Bodily Injury (BI) and Death. In addition, if property damage is an exposure, add $100,000 per single limit and $500,000 per occurrence.

• In the case of minimal risks, the agency could make a business decision to lower the limits of coverage.

• Risk Management would not generally recommend insurance limits of less than $1.5 million per person and $3 million per occurrence in coverage for Bodily Injury (BI) and Death. In addition, if property damage is an exposure, add $100,000 per single limit and $500,000 per occurrence.

• If the risk assessment reveals only minute risk, agency could make a business decision to waive coverage.

Always Remember• Don’t rely on insurance or bonds to

cover all of the risks associated with your contract.

• Many times outcome based statements of work, contract administration, and supervision are far better risk control measures to protect the state’s interests than insurance or bonds.

• Insurance and bonds should be thought of as the safety net that catches us when everything else goes wrong.

For More Details on Insurance Types and Limits

See Smart Contracting Toolkit on our Web site at:

http://www.oregon.gov/DAS/SSD/Risk/SmartContractingToolkit.shtml

The State’s Self-Insurance orCommercial Insurance

Does self-insurance cover the activity and/or

people?

Does management want Risk Mgmt to buy commercial insurance for the activity?

No

No = How will the agency pay for losses resulting from the activity?

Yes = Move on to evaluate Self-Insurance or Commercial

Insurance Coverage

Evaluation of State Self-Insurance or Commercial Insurance Coverage

Which kind of coverage

and what are the limits?

What are the exclusions

and coverage requirements

?Does the agency meet the coverage requirements

?

For Self-Insurance

Coverage, see the State of

Oregon Self-Insurance Handbook

For Commercial Insurance,

Contact Andrea

Peters in Risk Mgmt

If Your Agency:• Has no statutory immunity for the activity.• Has not decided to use loss prevention/risk

control measures to minimize or mitigate the risks.

• Has not contractually transferred the liabilities associated with the activity to another party.

• Does not have self-insurance coverage for the activity.

• Has not purchased commercial insurance coverage for the activity.

How will the agency pay for losses resulting from the activity?

The Point?• Knowing the risks associated with

your agency’s operations that should be keeping you awake at night.

• This insight provides your agency with the ability to plan for proactive loss prevention actions rather than just reactive loss reduction reactions.

Risk Assessment is Not Rocket Science

At times, people tell us that the Risk Assessment Road Map process is too simple…..

Our Answer . . .If Risk Assessment is so simple, why aren’t you doing them?

One More Tool• Risk Assessment is just one more tool

to enhance your agency’s business decision-making tool box.

• This tool also gives your agency a method of documenting the rationale for your business decisions.

• Risk Assessment Roadmap Toolkit: http://www.oregon.gov/DAS/SSD/Risk/RiskAssessmentRoadmapToolkit.shtml

Contractual Risk Assessment Example

Bybee Bridge Project

What is the scope of the contractual activity?

What is the overall activity? Replacement of the Bybee Bridge

What are the activity components?• Demolish existing structure

• Remove debris

• Design of new structure

• Construction of new structure

When and where does the activity take place(s)?

• Bybee and McLoughlin Blvds, Portland, Oregon• 1/26/04 through 11/30/04

Who will be performing the activity?• Capital Concrete Construction, Inc.• Various sub-contractors

Will the contractor interact with others, i.e., public, staff, etc.?

• Yes, there will be interaction with various ODOT and City of Portland employees, the public and sub-contractors.

Will there be any hazardous materials involved?

• Yes – oil, gasoline, paint, chemicals, debris, construction site runoff, etc.

What are the potential loss exposures

associated with this activity?

• Bodily injury

• Property damage

• Environmental damage

• Design flaw

What could go wrong? / Who could be harmed?

- Bodily injury and/or illness to third party.- Damage to third party property.- Pollution from refueling or maintenance

operations.- Structure destroyed due to vandalism- Runoff contamination.- Demolition improperly performed.- Faulty construction due to improper

design or materials.- Collapse of structure due to faulty design.

Is there any impact on workload or damage to our systems?

- Delay in bridge completion due to faulty construction or design

- Environmental cleanup - Additional costs for repair or re-design

of bridge

Rate the Severity of Each Potential Loss Exposure.

(How bad can each loss be?

What could it cost?) Bodily Injury: Insignificant to Minor (1-2),

Hundreds to Thousands Property Damage: Insignificant to Moderate

(1-3), Hundreds to Thousands Environment: Minor to Critical (2-5),

Thousands to millions Design Flaw: Minor to Moderate (2-3),

Thousands to millions

What is the Likelihood That Each of These Potential

Losses Will Happen?

Bodily Injury - Unlikely (2)

Property Damage - Possible (3)

Environmental Damage – Likely (4)

Design Flaw – Unlikely (2)

Determine the Risk Rating or Level of Risk for Each

Loss Exposure. Bodily Injury: Low Risk Property Damage: Low to High Risk Environment: Moderate to Extreme Risk

Design Flaw: Low to Moderate Risk

Weighing the Value of OpportunitiesRating Value Description (Opportunity)

1 Insignificant Minor budgetary, funding, or resource gain; Little or no gain in public and/or client relations.

2 Minor Low budgetary, funding, or resource gain; Some gain in public and/or client relations.

3 Moderate Moderate budgetary, funding, or resource gain; Adequate public and/or client relations.

4 Major Major budgetary, funding, or resource gain; Good public and/or client relations.

5 Critical Huge budgetary, funding, or resource gain; Excellent public and/or client relations.

What Could Be The Opportunities On This Project?

• Possible funding from other entities i.e. federal government, cities, counties, etc.

• Good public perception for widening and/or fixing a deteriorating bridge.

• The opportunity of avoiding liability that could arise from the collapse or failure of the deteriorating bridge.

• Economic stimulation, and the opportunity to utilize minority, women, or emerging small business

Determine Non-Insurance

Risk Control Measures • Involve the community at the earliest stage to

determine concerns. Address concerns, examples include: detours, closures, access to emergency services when the bridge is closed, ways the environment will be protected, etc.

• Communicate to the public through various methods, to include the web, TV and radio stations, newspapers, neighborhood meeting, etc.

• Identify potential pollution sources from materials and wastes that will be used, stored or disposed of on the job.

• Use best business practices to address pollution issues, such as using one area for vehicle parking, refueling and routine maintenance. Insure that wastes will be disposed of properly. Require recycling of wastes when possible.

• Close access to the work site for phases of the construction that pose hazard to the public, such as demolition.

• Verify that all of the contractor’s employees are properly trained and/or certified as required for the scope of work.

• Require the contractor to maintain on-site MSDS sheets.

Assignment of Insurance and Bonding Coverage

Bodily Injury: Low Risk - CGL/Automobile Liability

Property Damage: Low to High Risk -CGL/Automobile Liability

Environment: Moderate to Extreme Risk - Pollution Liability

Design Flaw: Low to Moderate Risk –Professional Liability