Know your own appetite

All businesses take risks. Successful businesses take calculated risks. Good risk management has a central part to play in ensuring that your business does not take on more risk than it can cope with or so little that it misses out on opportunities. There is a common misconception that risk management centres around negatives – preventing bad things from happening and making investments that are hard to justify. It is true that it is hard to prove the value of risk management designed to protect your business if there are no problems.

For example, should you have installed an expensive sprinkler system if you have never had a fire? But good risk management is actually just about good management in general. If you manage risks well, you can make informed decisions, secure in the knowledge that your business is protected. You can defend those decisions if stakeholders question them, you can put up a robust defence against allegations from employees or members of the public that you have been negligent, and you will not be caught out if an unforeseen event disrupts deliveries from a major supplier.

Essentially, you are working from a better business base than you would be if risk management were absent. Good risk management can also produce some concrete financial savings. For example, absence management can substantially reduce the costs to your business arising from employees’ sickness. Your insurance premiums will be lower if you can demonstrate efficient controls and systems.

Where insurance fits in

Good risk management is not just a matter of buying insurance. But insurance is an important part of your risk management toolkit, particularly for a middle market corporate, as it protects your company against business-threatening risks. Therefore, understanding what to insure and how much to insure it for is crucial. An insurance broker’s help is valuable when making these decisions. While you may just consider one business and one set of risks, brokers deal with a large number of companies. They can provide constructive risk management advice based on their breadth of experience and will know the markets that can give you the best cover at the most competitive price.

To make appropriate risk management decisions,
you need to consider not just the board’s attitude,
but also that of your investors and customers

Your broker should act on your behalf and obtain competitive quotations from a number of insurers. Your broker should also be able to indicate how your risk management and performance compares with that of peer companies, enabling you to benchmark your progress. In order to work most eff ectively with your broker and achieve the optimum result from your insurance-buying strategies, you need to evaluate your risks and understand your company’s appetite for risk. Just as some people are prudent and others are gamblers, companies’ attitudes towards risk vary.

Evaluating your risks

A structured approach to risk management requires you to evaluate and prioritise your risks. There are many ways in which you can do this, but perhaps the simplest is by drawing up a risk chart or map. This should include all the risks that your company might face, graded according to likelihood and severity of impact. Input from all parts of the company is valuable here. What some departments perceive to be high risk, boards might not consider major threats. There may be common risks that your business units face, the impact of which individually might not be severe, but could pose a major problem cumulatively.

For example, individual units may be using the services of a single organisation, perhaps in connection with IT or plant maintenance. Each may have limited exposure should that organisation fail, but the cumulative effect could be major disruption for your business. Mapping your risks allows you to categorise them. You can identify the high-frequency, low-impact, low-cost risks that you should consider self insuring. Transferring them to an insurer may not be worthwhile. The premium you pay will take account not only of the steady stream of claims payments that the insurer will have to make, but also its administrative costs and profit margin. It may be more cost effective to fund these in-house and employ appropriate risk management strategies to diminish them as much as possible.

Your risk map will also highlight unlikely but very high-impact risks, over which you may have little or no control – for example, an aircra_ crashing into your head office. These may be worth insuring against, as the premium charged should below, reflecting the remoteness of the event. In the middle, the medium-severity/ medium-likelihood range will include a range of risks. You need to consider how applying risk management can affect their rating and make a decision as to whether or not to insure them.

How much do you take on?

Risk appetite – how much risk your business feels comfortable in taking – is not just a matter of your company’s financial circumstances. In order to make appropriate risk management decisions, you need to consider not just the board’s attitude, but also that of your investors and customers. Risky strategies can save money in the short term, but can be expensive if things go wrong. For example, if you are producing or storing goods, it may be cost-effective to focus this on a single site. But, if those premises are destroyed, say by fire, would you have a lengthy period of business interruption, during which customers would be lost?

Similarly, you may have a ‘just in time’ delivery strategy from your suppliers. Again, this can save costs. But, if a disaster hits an important supplier, do you have any back-up producers that you can turn to or sufficient supplies to meet demand while that supplier recovers? Would your customers be happy to continue buying from you with the potential threat of disrupted deliveries?

Establishing your company’s risk appetite is important. It will govern how much insurance you buy and factors such as the size of your chosen deductibles – the first amount that your company pays towards any claim – in insurance policies, The Institute of Risk Management published its Risk Appetite and Toleranceguidance paper in September 2011 to provide an indication of what boards need to consider when evaluating their risk appetite. See box, right, for a rundown of its key points