Risk Control

Risk control methods seek to alter an organization’s exposure to risk.

More specifically, risk control efforts help an organization avoid a risk, prevent loss,
lessen the amount of damage if it occurs, or reduce undesirable effects of risk on an
organization.
We can see risk control in everyday occurrences such as security systems to prevent
unauthorized access, sprinklers and fire control systems, employee safety training
programs, codes or regulations on conduct on architectural constructions, etc.

What is Risk Control and When is it Used?

Risk control includes techniques, tools, strategies and processes that seek to avoid,
prevent reduce, or otherwise control the frequency and/or magnitude of loss and other
undesirable effects of risk.
Risk control also includes methods that seek to improve understanding or awareness
within an organization of activities affecting exposures to risk.
Risk control can be applied to any area of activity on a key criterion: balancing costs
and benefits.
Sometimes the government might make certain risk control measures mandatory as
well. In an absence of such mandates, risk control is based on three considerations in
balancing costs and benefits:
1) The cost of risk financing is commonly greater than the cost of losses
Consider insurance. The cost of paying insurance premiums must generally be
equal to the benefits from the insurance cover, in case damage occurs.

2) Losses typically generate indirect or hidden costs that may not be revealed until
the distant future
These include time element losses.

3) Losses can have effects outside an organization

For instance, when an organization pollutes the environment, the community or
society usually suffers.

The Relationship of Risk Control to Risk Assessment

We previously identified that risk assessment involves a thorough and critical
understanding of the process through which gains, or losses are produced.

FIN4345: Risk Management and Insurance 61

The linkage between risk assessment and risk control becomes apparent when we
consider the “risk chain”, a concept that describes the process leading to loss as a
linked chain of events. The “links” in this chain are:
1) The hazard
2) The environment
3) The interaction
4) The outcome
5) The consequences
The hazard is the condition that might lead to a loss, such as an improperly maintained
piece of heavy machinery.
The environment is the context in which the hazard exists, such as the shop floor
where the improperly maintained piece of machinery is located.
The interaction is the process whereby the hazard interacts with the environment,
sometimes having no effect and sometimes resulting in loss. For instance, a worker
using this machine may suffer injuries if the machine breaks down.
The outcome is the immediate result of the interaction, such as an eye injury.
The consequences refer to the long-term consequences of the event such as worker’s
compensation claim, repair or replacement of the machine, legal penalties, etc.
Basically, the relationship between risk assessment and risk control can be observed
when a risk manager is doing an analysis of potential risks; at the same time, he/she
will be formulating methods they can follow to overcome the risks they identify. For
instance, in the above example, the manager may decide that machine maintenance
is the best risk control method to avoid consequences.

The Relationship of Risk Control to Risk Financing

Risk financing methods are used by organizations to provide resources for reimbursing
the cost of loss (ex: insurance).
Many organizations use some financing mechanism that transfers the risk to another
party, or they retain the risk and absorb the costs internally.
Risk control has significant influence on risk financing because the control of risks can
have a significant impact on the frequency and severity of losses that must be
“financed”.
The positive effects of effective risk control on an organization’s risk financing costs
are apparent no matter the type of risk financing used. If losses are instead retained
the benefit is obvious – losses do not occur, and loss financing is not needed.

FIN4345: Risk Management and Insurance 62

Risk Control and Speculative Risks
Risk control traditionally has been applied to methods to reduce possible losses rather
than gains.
However, risk control can be applied to both “pure” risks and “speculative” risks.
While it is true that risk control can only be done as long as the organization can control
the frequency and severity of risk, the organization may control its exposure to
uncontrollable risks such as these by avoiding it.
For example, the organization cannot predict the movements in a particular stock, but
they can avoid the risk by not investing in that stock.
So, risk control can be applied to all risks. For a business, profit is the difference
between revenues and costs, both of which are uncertain. Most actions of managers
affect both revenues and costs.
For example, a business might decide to expand into a foreign market. This is
obviously an exposure to risk, while on the other hand the entry to a new market
provides new skill, knowledge and contacts to foreign clients which mitigates this risk.

Risk Control Tools and Techniques

Risk control is an art since it requires an element of creativity.
What works as risk control for one organization may not work for another. This is
mainly as each organization’s risk appetite varies.
The risk control tools and techniques can be categorized as:
1) Risk avoidance
2) Loss prevention
3) Loss reduction
4) Information management
5) Risk transfers

Risk Avoidance
One way to control a particular risk is to avoid the property, person, or activity giving
rise to possible loss.
This can be done by:
1) Proactive avoidance: refusing to take on risk even for a moment
For example: a chemical company was expecting to conduct a few experiments
in a small rural village. It was identified that serious damage to property may
result from these experiments and so the company sought insurance cover.
However, only few insurers were willing to provide insurance for this and those

FIN4345: Risk Management and Insurance 63

 who did charged significant premiums. Therefore, the company decided not to
conduct the experiments. The company effectively avoided risk.

2) Abandonment: abandoning an exposure to loss assumed at a previous time

For example: a pharmaceutical firm may choose to discontinue the production
of a drug once serious side-effects start appearing.
While avoiding risk is quite effective, it also makes the organization lose the benefits
that may have come from the risk.
Thus, risk avoidance is not an option for many organizations. If they avoided risk, some
organizations would cease to exist. For instance if a mining business wanted to avoid
the risk of the mine collapsing, they will have to leave the mining industry completely.
Risks that are defined too broadly also cannot be avoided. For instance, “property risk”
cannot be avoided unless the organization sells off all its property, plant, and
equipment.
Furthermore, governments may impose certain laws that cannot be avoided.
We must also keep in mind that the decision to avoid a risk might actually create a
new risk somewhere else. For instance, a city once had two bridges and one bridge
needed serious repairs. The government decided to close that bridge and direct traffic
onto the second bridge without fixing the first. This caused the second bridge to take
on extra load, and it collapsed in a few months.

Loss Prevention and Loss Reduction

Loss prevention and reduction measures attack risk by reducing the number of losses
that occur (loss frequency reduced) or by mitigating the amount of damage when a
loss does occur (loss severity reduced).
From a societal standpoint, loss prevention and reduction has the benefit of preventing
or reducing losses to both the organization and to society, while allowing the
organization to commence activities.
Loss prevention. Loss prevention is focused on reducing the number of events or
eliminating them entirely. Loss prevention activities seek to intervene in the first three
links in the risk chain: the hazard, the environment, and the interaction of hazard and
environment.
Loss prevention is focused on:
1) Altering or modifying the hazard
2) Altering or modifying the environment in which the hazard exists
3) Intervening in the process whereby hazard and environment interact
We will now look at some examples of each three focus points:

FIN4345: Risk Management and Insurance 64

Loss prevention activities that focus on the hazard.
1) Hazard: careless housekeeping
Loss prevention activity: training and monitoring programs

2) Hazard: flooding
Loss prevention activity: dams, water resource management

3) Hazard: smoking
Loss prevention activity: ban on smoking, confiscation of smoking materials

4) Hazard: pollution
Loss prevention activity: handling protocols for use and disposal of polluting
substances

5) Hazard: icy sidewalks

Loss prevention activity: shoveling, salting, heated walkways

6) Hazard: radioactive materials

Loss prevention activity: construction of appropriate barriers and containers

7) Hazard: drunk driving

Loss prevention activity: prohibition, banning drunk driving, prison sentence

8) Hazard: lack of information regarding some activity

Loss prevention activity: research
Loss prevention activities that focus on the environment
1) The environment: a shop floor that could become slippery from oil spillage
Loss prevention activity: installation of absorbent, non-skid materials

2) The environment: interstate highways

Loss prevention activity: barrier construction, lighting, signs, and road markings

3) The environment: improperly trained workforce

Loss prevention activity: training

4) The environment: consuming public

Loss prevention activity: adequate product instructions and warnings

5) The environment: the drug-addicted population

Loss prevention activity: counselling, treatment, detention

6) The environment: structures susceptible to fire

Loss prevention activity: fire resistive construction

FIN4345: Risk Management and Insurance 65

 7) The environment: unlighted central city parking facility
Loss prevention activity: lighting, escort, and security service

8) The environment: employees driving a fleet of delivery vehicles

Loss prevention activity: driver’s education training
Loss prevention activities that focus on interactions of hazard and environment
1) The interaction: a heating process that may overheat surrounding equipment
Loss prevention activity: a water-cooling system

2) The interaction: improper lifting of heavy crates by employees

Loss prevention activity: lumbar support belts

3) The interaction: vehicle skidding on slippery roads

Loss prevention activity: antilock brakes

4) The interaction: telephone line repair workers working in cold environments

Loss prevention activity: proper clothing, cold-weather protocols

5) The interaction: consumer use of a hazardous product

Loss prevention activity: safety features, customer assistance

6) The interaction: a city council deciding on important matters

Loss prevention activity: documenting decision making, legal counsel review

7) The interaction: an underground storage tank leaking fuel

Loss prevention activity: double-seal tanks

8) The interaction: moving a production facility to an undeveloped country

Loss prevention activity: host-government regulation activities, research

Loss reduction
Loss reduction programs are designed to reduce the potential severity of loss. These
do not reduce the probability of loss occurring.
For instance, a fire sprinkler system will reduce the damage from a fire, but it won’t
reduce fires from happening.
Loss reduction activities are post-loss measures. Although such measures may be
planned prior to loss, their main function or purpose is to minimize the impact of losses
that occur.
Loss reduction focuses primarily on the third link in the risk chain (sometimes) and the
fourth and fifth links (more commonly): the interaction link, the outcome link, and the
consequences link.

FIN4345: Risk Management and Insurance 66

A loss reduction effort may address the interaction link only when the loss reduction
can stop risk that is already in progress. An example is our fire sprinkler discussed
above. While the fire is going on, the sprinkler comes online to douse the fire.
The fourth and fifth links are addressed after a loss has occurred and the risk manager
must minimize the outcome and consequences of the loss.
For example, a worker suffers serious burns to his arms and legs. Making sure this
worker is immediately sent for treatment is a form of loss reduction.
Another loss reduction measure is salvage. This is where the lost property is not
destroyed 100% and the risk manager recovers the remaining portion of the asset. For
example, a car that was destroyed in an accident can be sold for parts.
Contingency or contingency plans are an integrated approach to loss reduction. A
catastrophe plan is an organization-wide effort to identify possible crises or
catastrophes and develop plans for responding to such events.
Catastrophe planning usually is a lengthy process of research and evaluation that
ultimately yields a contingency plan for possible use in the event of a catastrophe.
Parts of a catastrophe plan may include:
1) Cross-training employees
2) Back-up, off-site storage of computerized records
3) Updating fire suppressant systems
4) Securing of credit from lending institutions
5) Training of employees on emergency safety procedures
6) Disaster training / planning with fire department
7) Cold- or hot-site backup computer facility
8) Construction modification, such as installation of firewalls
9) Development of community relations strategy
10) Creation of an emergency response team or committee
A special case of loss reduction is duplication of an existing asset that is not used
unless something happens to the original asset. Spare parts or duplicate machinery
are examples.
Duplication is used when an indirect loss arises from direct damage to the asset.
Duplication reduces the amount of damage if a loss occurs by reducing or eliminating
the indirect loss. An example is backing up computer hard drives.
Separation is another technique of loss reduction in which an organization attempts to
isolate its exposures to loss from each other instead of allowing them to be vulnerable
to a single event.
Examples of separation include:
- Installing fireproof partitions among departments in a factory
- Cashiers moving cash collected at the counter to a safe in the back office
- Storing vehicles at different locations

FIN4345: Risk Management and Insurance 67

Separation does not necessarily reduce the chance of loss to a single exposure, but it
does reduce the chance of a catastrophic loss.

Information Management
Reducing uncertainty has economic value and information can help in reducing
uncertainty.
Information from the risk management department must be communicated to
stakeholders such as employees, regulators, and insurers to get the maximum benefit
out of risk management programs.
Loss occurs as a result of natural forces and the actions of humans, and uncertainty
can arise from imperfect knowledge on both these factors.
If stakeholders do not have sufficient information on the organization, they will be
uncertain about giving the organization their services and may charge higher prices
for it. For instance, if an organization does not disclose its strategies well, the
shareholders/bondholders may demand high return on their investment which drives
down share/bond price.
Another area where information can reduce uncertainty is where individuals are aware
of the loss causing process. Knowledge of the process (risk chain) can, for example,
encourage employees to take safety precautions.

Risk Transfer
Risk transfer is a risk control tool that causes some entity other than the one
experiencing the loss to bear the burden of the loss.
Transfer differs from avoidance through abandonment because a transferred risk
results in exposure for some other entity. An abandoned risk is passed to no one.
Transfer can be accomplished in two ways:
1) The property or activity responsible for the risk may be transferred to some
other person or group of persons.
For example, an organization that sells buildings transfers the risk of property
ownership to another person who buys the building.

2) The risk, not the property or activity, may be transferred – usually by a

contractual agreement.
For example, a lease may make the landlord responsible to damages caused
by a tenant.
These contracts are called “exculpatory contracts”.
The transferee (the party accepting the risk) excuses the transferor (the party
transferring the risk) from liability. The transferor’s risk exposure is eliminated.

FIN4345: Risk Management and Insurance 68

However, a promise by the transferee to reimburse the transferor for damages is not
a risk control transfer, as the transferor still faces the risk. This is a risk “financing
transfer” which we discuss later.
Although the difference between risk control and risk financing transfer appears to be
vague, it can have economic consequences when the transferee is unable to pay for
the damage as they promised.
Risk control transfers involve only the transferor and the transferee; risk financing
transfer, however, may involve others. A transferee cannot excuse a transferor from
liabilities they incur towards a third party as the third party is not part of the agreement.
The transferee can, however, agree to finance any losses that are financed by the
transferor.
Under a risk control transfer, the transferor is completely protected from loss as the
burden of risk falls entirely on the risk transferee. In a risk financing transfer, however,
if the transferee fails to provide the promised funds, the transferor bears the loss.
Risk control transfer is not costless for the transferor. For instance, consider a futures
contract where you agree to buy a share at Rs. 100 in 2 months’ time. If the price in 2
months is Rs. 120 you are at an advantage, but if it falls to Rs. 80 you are at a
disadvantage since you have to buy the share at a higher price than the market. Thus,
risk control transfers are done only when the transferee has a potential advantage.
Otherwise, it is too costly.

Risk Control, Government and Society

The government is involved in loss control through:
1) Enacting legislation as a concern for public interest
2) Providing services such as
a. Fire brigades
b. Variety of educational programs and seminars such as those on road
safety
3) Inspection to enforce statutes and codes
4) Police and fire departments
5) Assembling and disseminating statistical data
6) Conducting and encouraging research

Occupational Safety and Health Administration (OSHA)

OSHA is a legislation that applies to private employers of one or more persons. Self-
employed persons and state-sector organizations are exempted from this law.
OSHA includes such standards such as:
1) All places of employment, passageways, storerooms, and service rooms shall
be kept clean and orderly and in a sanitary condition.

FIN4345: Risk Management and Insurance 69

 2) Portable wooden ladders longer than 20 feet shall not be supplied to workers
(the standard on portable wooden ladders alone fills around 15 pages!)

3) In the absence of an infirmary, clinic, or hospital in near proximity to the

workplace which is used for the treatment of all injured employees, a person or
persons shall be adequately trained to render first aid.

To check compliance with OSHA, federal inspectors have the right to enter any
workplace without notice, but at reasonable times.
If an inspector discovers a violation that is more than de minimus, the inspector is
directed to issue a written citation describing the violation. De minimus refers to no
direct or immediate relationship to job safety and health, for example: having no toilet
partitions. The citation must be posted near the location of the violation and the
employer must remove the hazard within reasonable time.
If death or serious physical harm could have resulted from the violation, the citation
means a mandatory penalty up to USD1,000 in the United States. If the employer fails
to correct the violation within the stated time, they may be penalized up to USD1,000
per day until the violation is resolved.
If an employee dies due to the violation, the employer is either fined USD10,000 or
faces up to six months of imprisonment.

FIN4345: Risk Management and Insurance 70