CHAPTER TWO

RISK MANAGEMENT

2.1. Definition of Risk Management

Risk Management refers to the identification, measurement and treatment of exposure
to potential accidental losses almost always in situations where the only possible
outcomes are losses or no change in the status. It is a general management function that
seeks to assess and address the causes and effects of uncertainty and risk on an
organization. The purpose of risk management is to enable an organization to progress
towards its goals and objectives in the most direct, efficient, and effective path. Risk
Management is the executive function of dealing with specified risks facing the business
enterprise. In general, the risk manager deals with pure, not speculative risk.

Generally, risk management is defined as a systematic process for the identification

and evaluationof pure loss exposures faced by an organization or individuals and for the
selection and implementation of the most appropriate techniques for treating such exposures.
Many risk managers use the term “loss exposure” to identify potential losses. Loss exposure
is a situation or circumstance in which a loss is possible, regardless of a loss occurs.
For example defective products that may result in lawsuits against the company.

2.2. Objectives of Risk Management

The objectives of risk management can be broadly classified into two:
1. Pre-loss Objectives
2. Post-loss Objectives

Pre-loss Objectives:
An organization has many risk management objectives prior to the occurrence of a loss. The
most important of such objectives are as follows;
a) The first objective is that the firm should prepare for potential losses in the
most economical way possible. This involves as analysis of safety program,
insurance premiums and the costs associated with the different techniques of
handling losses.
b) The second objective is the reduction of anxiety. In a firm, certain loss exposures can
cause greater worry and fear for the risk manager, key executives and unexpected
stockholders of that firm. For example, a threat of a lawsuit from a defective product
can cause greater anxiety than a possible small loss from a minor fire. However, the
risk manager wants to minimize the anxiety and fear associated with such loss
exposures.
c) The third pre-loss objective is to meet any externally imposed obligations. This
means that the firm must meet certain obligations imposed on it by the outsiders. For
example, government regulations may require a firm to install safety devices to
protect workers from harm. Similarly, a firm’s creditors may require that property
pledged as collateral for a loan must be insured. Thus, the risk manager is expected to
see that these externally imposed obligations are met properly.

1
Post-loss Objectives:
Post-loss objectives are those which operate after the occurrence of a loss. They are as
follows:
a) The first post-loss objective is survival of the firm. It means that after a loss occurs,
the firm can at least resume partial operation within some reasonable time period.
b) The second post-loss objective is to continue operating. For some firms, the
ability to operate after a severe loss is an extremely important objective.
Especially, for public utility firms such as banks, dairies, etc, they must continue to
provide service. Otherwise, they may lose their customers to competitors.
c) Stability of earnings is the third post-loss objective. The firm wants to maintain
its earnings per share after a loss occurs. This objective is closely related to the
objective of continued operations. Because, earnings per share can be maintained
only if the firm continues to operate. However, there may be substantial costs
involved in achieving this goal, and perfect stability of earnings may not be attained.
d) Another important post-loss objective is continued growth of the firm. A firm may
grow by developing new products and markets or by acquiring or merging with
other companies. Here, the risk manager must consider the impact that a loss will have
on the firm’s ability to grow.
e) The fifth and the final post-loss objective is the social responsibility to
minimize the impact that a loss has on other persons and on society. A severe loss can
adversely affect the employees, customers, suppliers, creditors and the community in
general. Thus, the risk manager’s role is to minimize the impact of loss on other
persons.

Thus, there are the pre-loss and post-loss objectives of risk management. A prudent risk
manager must keep these objectives in mind while handling and managing the risk.

2.3. Risk Management Process

Whether the concern is with a business or an individual situation, the same general steps can
be used to analyze systematically and deal with risk. This is known as risk management
process. The risk management process has five steps to be implemented by the risk manager:
 Risk identification
 Risk measurement
 Identifying the tools of risk management
 Selection of risk tools
 Risk implementation
1. Identifying the Potential Losses: (Risk Identification)
Risk identification is the process by which a business systematically and continually identifies
property, liability, and personnel exposures as soon as or before they emerge. The risk
manager tries to locate the areas where losses could happen due to a wide range of perils.
Unless the risk manager identifies all the potential losses confronting the firm, he or she will
not have any opportunity to determine the best way to handle the undiscovered risks.

2
To identify all the potential losses the risk manager needs first a checklist of all the losses that
could occur to any business. Second, he or she needs a systematic approach to discover which
of the potential losses included in the checklist are faced by his/her business. The risk
manager may personally conduct this two-step procedure or may rely upon the services of an
insurance agent, broker, or consultant.

Generally, a risk manager has several sources of information that can be used to identify
major and minor loss exposures. They are as follows:
(a) Physical inspection of company plant & machineries can identify major loss
exposures.
(b) Extensive risk analysis questionnaire can be used to discover hidden loss exposures
that are common to many firms.
(c) Flow charts that show production and delivery processes can reveal production
bottlenecks where a loss can have severe financial consequences to the firm.
(d) Financial statements can be used to identify the major assets that must be protected.
(e) Departmental & historical claims data can be invaluable in identifying major loss
exposures.

Risk managers must also be aware of new loss exposures that may be emerging. More
recently, misuse of the internet and e-mail transmissions by employees have exposed
employers to potential legal liability because of transmission of pornographic material and
theft of confidential information.

2. Evaluating Potential Losses (Risk Measurement)

The second step in the risk management process is to evaluate and measure the impact of
losses on the firm. This involves an estimation of the potential frequency and severity of loss.
Loss frequency refers to the probable number of losses that may occur during some given
period of time, while loss severity refers to the probable size of the losses that may occur.
Once the risk manager estimates the frequency and severity of loss for each type of loss
exposure, the various loss exposures can be ranked according to their relative importance.

Both loss frequency and loss severity data are needed to evaluate the relative importance of an
exposure to potential loss. However, the importance of an exposure depends mostly
upon the potential loss severity not the potential frequency. A potential loss with catastrophic
possibilities although infrequent, is far more serious than one expected to produce frequent
small losses and no large losses. On the other hand, loss frequency cannot be ignored. If two
exposures are characterized by the same loss severity, the exposure whose frequency is
greater should be ranked more important. There is no formula for ranking the losses in order
of importance, and different persons may develop different rankings. The rational
approach, however, is to place more emphasis on loss severity.

Risk Measurement and Probability Distribution

A more sophisticated way to measure potential losses involves probability distributions.
However, this method is more difficult to explain and the data needed to construct the
required probability distribution are commonly not available. Nevertheless, probability

3
distributions make possible more comprehensive risk measurements than other techniques;
and also, they are becoming a more common tool of modern management, and data sources
are improving. Furthermore, probability distributions improve one's understanding of the
more popular risk measurements and are extremely useful in determining which risk
management devices would be best in a given situation.

A probability distribution shows for each possible outcome, its probability of occurrence. It is
used to estimate numerically the potential loss from a risk. Using the probability distribution,
it is possible to measure the various aspects of a risk; such as:
1. The total losses per period
2. The number of occurrences per period
3. The total losses per occurrence
The probability distribution of the total dollar losses per year shows each of the total dollar
losses that the business may experience in the coming year and the probability that each of
these totals might occur. For example, assume that:
i) a business has five cars, each of which is valued at 10,000 Birr
ii) each car may be involved in more than one collision a year; and
iii) The physical damage may be partial or total.

Also assume prompt replacement of any car that goes out of service, thus reducing net income
losses to a minimal level. A hypothetical probability distribution that might apply in this
situation is shown below:
Total Dollar Losses per Year Probability
Birr 0 0.606
500 0.273
1000 0.100
2000 0.015
5000 0.003
10,000 0.002
20,000 0.001
1.000
If the risk manager can estimate accurately the probability distribution of the total dollar
losses per year, he or she can obtain useful information concerning:
1. the probability that the business will incur some dollar loss,
2. the probability that "severe (greater or equal to 5,000)"
losses will occur,
3. the average loss per year, and
4. The risk or variation in the possible results.

Given the above distribution, the probability that the business will suffer no dollar loss is
almost 0.61 (0.606). Because the business must suffer either no loss or some loss, the sum of
the probabilities of no loss and some loss must equal 1. Consequently, the probability of some
loss is equal to about 1 – 0.61 = 0.39. An alternative way to determine the probability of some

4
loss is to sum the probability for each of the possible total dollar losses: i.e., 0.273 + 0.100 +
0.015 + 0.003 + 0.002 + 0.001 = 0.394 (1 – 0.606 = 0.394).

The potential severity of the total dollar losses can be measured by stating the probability that
the total losses will exceed various values. For example, the risk manager may be interested in
the probability that the dollar losses will equal or exceed 5,000 Birr. These probabilities can
be calculated for each of the values in which the risk manager is interested and for all higher
values. For example, the probability that the dollar losses will equal or exceed Birr 5000 is
equal to 0.003 + 0.002 + 0.001 = 0.006.

Another extremely useful measure that reflects both loss frequency and loss severity is the
expected total dollar loss or the average annual dollar loss in the long run. Because the
probabilities above represent the proportion of times each dollar loss is expected to occur in
the long run, the expected loss can be obtained by summing the products formed by
multiplying each possible outcome by the probability of its occurrence; i.e., 0(0.606) +
500(0.273) + 1000(0.100) + 2000(0.015) + 5000(0.003) + 10,000(0.002) + 20,000 (0.001) =
321 Birr. This measure indicates the average annual dollar loss the business will sustain in the
long run if it retains this exposure.

Up to this point, no yardstick has been suggested for measuring risk but its relationship to the
variation in the probability distribution has been noted. Statisticians measure this variation in
several ways. One of the most popular yardsticks for measuring the dispersion around the
expected values is the standard deviation. The standard deviation is obtained by subtracting
the average value from each possible value of the variable, squaring the difference,
multiplying each squared difference by probability that the variable will assume the value
involved, summing the resulting products, and taking the square root of the sum.

The standard deviation for the example given above is calculated as follows:
(1) (2) (3) (4) 3x4
2
Value Value-average (Value-average) Probability
2
$0 0 – 321 $ (-321) 0.606 62,443
2
500 500 – 321 (179) 0.273 8,747
2
1000 1000 – 321 (679) 0.100 46,104
2
2000 2000 – 321 (1679) 0.015 42,286
2
5000 5000 – 321 (4679) 0.003 65,679
2
10,000 10,000 – 321 (9679) 0.002 187,366
2
20,000 20,000 – 321 (19679) 0.001 387,263
799,888

Then the standard deviation is 799,888 = $894.

√
When there is much doubt about what will happen because there are many outcomes with
some reasonable chance of occurrence, the standard deviation will be large; when there is
little doubt about what will happen because one of the few possible outcomes is almost certain
to occur, the standard deviation will be small.

5
Similarly, the number of accidents expected to occur per physical period (year) can be
measured. If each occurrence produces the same dollar loss, the distribution of the number of
occurrences per year can be transformed into a distribution of the total dollar losses per year
by multiplying each possible number of occurrences by the uniform loss per occurrence. If the
dollar loss per occurrence varies within a small range, the distribution of the total dollar losses
per year can be approximated by multiplying each possible number of occurrences by the
average dollar losses per occurrence. If the dollar losses per occurrence vary widely, one
needs the probability distributions of the dollar losses per occurrence and the number of
occurrences per year to develop information about the total dollar losses per year.

Researchers have also some success describing the probability distribution of the dollar losses
per occurrence. This distribution would state the probabilities that the dollar losses in an
occurrence would assume various values. Generally dollar loss per occurrence refers to the
average monetary loss expected per accident (occurrence).

In addition, there are various methods used to measure the different aspects of a risk. Some of
these methods are:
a) Poisson distribution method
b) Binomial distribution method, and
c) Normal distribution method
Reading assignment: Refere back to Statistics fo finance and read this points

3. Tools of Risk Management

The third step is to identify the available tools of risk management. The major tools of risk
management are the following:
I) Avoidance IV) Non-insurance transfers
II) Loss control V) Insurance
III) Retention

Avoidance and Loss control are called risk control techniques, because they attempt to reduce
the frequency and severity of accidental losses to the firm. On the other hand, retention, non-
insurance transfers and insurance are called risk financing techniques, because they provide
for the funding of accidental losses after they occur.

I) Avoidance:
Avoidance means that a certain loss exposure is never acquired (refusal), or an existing loss
exposure is abandoned. For example, a firm can avoid earthquake loss by not building a plant
in an earthquake prone area. An existing loss exposure may also be abandoned. For example,
a pharmaceutical firm that produces a drug with dangerous side effects may stop
manufacturing that drug.The major advantage of avoidance is that the chance of loss is
reduced to zero, if the loss exposure is not acquired. In addition, if an existing loss exposure is
abandoned, the possibility of loss is either eliminated or reduced because the activity that
could produce a loss has been abandoned.
However, avoidance has two disadvantages. First, it may not be possible to avoid all losses.
For example, a company cannot avoid the pre-mature death of a key executive. Second, it

6
may not be practical or feasible to avoid the loss exposure. In the above said example, the
pharmaceutical company can avoid losses arising from the production of a particular drug.
However, without any drug production, the firm will not be in business.

(II) Loss Control:

It is another method of handling loss in a risk management program. Loss control measures
attack risk by lowering the chance a loss will occur (loss frequencies) or by reducing the
amount of damage when the loss does occur (loss severity). Loss control tools can be
classified as: loss prevention and loss reduction measures.

The following are the examples that illustrate how loss control measures reduce the frequency
and severity of losses.

Measures that prevent loss frequency are quality control checks, driver examination, strict
enforcement of safety rules and improvement in product design.

Measures that reduce loss severity are the installation of an automatic sprinkler or burglar
alarm system, employing fire extinguishers, early treatment of injuries and rehabilitation of
injured workers.

(III) Retention:
Retention means that the firm retains part or all of the losses that result from a given loss
exposure. It can be effectively used when three conditions exist.
First, no other method of treatment is available. Insurers may be unwilling to write certain
type of coverage. Non-insurance transfers may not be available. In addition, although loss
control can reduce the frequency of loss, all losses cannot be eliminated. In these cases,
retention is a residual method. If the loss exposure cannot be insured or transferred, then it
must be retained.

Second, the worst possible loss is not serious. For example, physical damage losses to
automobiles in a large firm’s fleet will not bankrupt the firm.

Finally, losses are highly predictable. Retention can be effectively used for workers
compensation claims, physical damage losses to automobiles, etc. Based on past experience,
the risk manager can estimate a probable range of frequency and severity of actual losses.

Determining Retention Levels:

If retention is used, the risk manager must determine the firm’s retention level, which is the
Dollar / Birr amount of losses that the firm will retain. A financially strong firm can have a
higher retention level than one whose financial position is weak.

Though there are many methods of determining retention level, the following two methods
are very important.

First, a Corporation can determine the maximum uninsured loss it can absorb without
adversely affecting the company’s earnings can dividend policy. One rough rule is that the

7
maximum retention can be set at 5% of the company’s annual earnings before taxes from
current operations.

Second approach is to determine the maximum retention as a percentage of the firm’s net
working capital, such as between 1% and 5%. Although this method does not reflect the
firm’s overall financial position for absorbing a loss, it measures the firm’s ability to fund a
loss.

Paying losses:
If retention is used, the risk manager must have some method for paying losses. Normally, a
firm can pay losses by one of the following three methods:

(a) The firm can pay losses out of its current net income, with the losses treated as
expenses for that year. However, a large number of losses could exceed current net
income. Then, other assets may have to be liquidated to pay losses.
(b) Another method is to borrow the necessary funds from a bank. A line of credit is
established and used to pay losses as they occur. However, interest must be paid on
the loan and loan repayments can aggravate cash flow problems the firm may have.
(c) Another method for paying losses is an unfunded or funded reserve. An unfounded
reserve is a book keeping account that is charged with the actual or expected losses
from a given risk exposure. A funded reserve is the setting aside of liquid funds to
pay losses. Private employers does not use funded reserve, in their risk management
programs, because the funds may yield higher return if it is used in the business.

Advantages of Retention:
(a) The firm can save money in the long run if its actual losses are less than the loss
allowance in the insurer’s premium.
(b) The services provided by the insurer may be provided by the firm at a lower cost.
Some expenses may be reduced, including loss-adjustment expenses, general
administrative expenses, commissions and brokerage, etc.
(c) Since the risk exposure is retained, there may be greater care for loss prevention.
(d) Cash flow may be increased since the firm can use the funds that normally would be
held by the insurer.

Disadvantages of Retention:
(a) The losses retained by the firm may be greater than the loss allowance in the
insurance premium that is saved by not purchasing the insurance.
(b) Actually, expenses may be higher as the firm may have to hire outside experts such as
safety engineers. Thus, insurers may be able to provide loss control services less
expensively.
(c) Income taxes may also be higher. The premiums paid to an insurer are income-tax
deductible. However, if retention is used, only the amounts actually paid out for losses
are deductible. Contributions to a funded reserve are not income-tax deductible.

(IV) Non-Insurance Transfers:

8
Non-insurance Transfers is another method of handling losses. Non-insurance transfers are
methods other than insurance by which a pure risk and its potential financial consequences are
transferred to another party. Examples of non-insurance transfers include contracts, leases and
hold-harmless agreements. For example, a company’s contract with a construction firm to
build a new plant can specify that the construction firm is responsible for any damage to the
plant which it is being built.
A firm’s computer lease can specify that maintenance, repairs and any physical damage loss
to the computer are the responsibility of the computer firm. Otherwise, a firm may insert a
hold-harmless clause in a contract, by which one party assumes legal liability on behalf of
another party. Thus, a publishing firm may insert a hold-harmless clause in a contract, by
which the author and not the publisher is held legally liable if anybody sued the publisher.

Advantages of Non-Insurance Transfers:

(a) The risk manager can transfer some potential losses that are not commercially
insurable.
(b) Non-Insurance transfers often cost less than insurance.
(c) The potential loss may be shifted to someone who is in a better position to exercise
loss control.
Disadvantages of Non-Insurance Transfers:
(a) The transfer of potential loss would become impossible, if the contract language is
ambiguous.
(b) If the party to whom the potential loss is transferred is unable to pay the loss, the firm
is still responsible for the claim.
(c) Non-Insurance Transfers may not always reduce insurance costs since an insurer may
not give credit for the transfers.

(V) Insurance:
Insurance is also used in a risk management program. Insurance is appropriate for loss
exposures that have a low probability of loss but the severity of loss is high. If the risk
manager uses insurance to treat certain loss exposures, five key areas must be emphasized.
They are as follows;
(i) Selection of insurance coverages
(ii) Selection of an insurer
(iii) Negotiation of terms
(iv) Dissemination of information concerning insurance coverages
(v) Periodic review of the insurance program

(i) Selection of insurance coverages:

The risk manager must select the insurance coverages needed. Since there may not be enough
money in the risk management budget to insure all possible losses, the need for insurance can
be divided into three categories;
(a) Essential Insurance
(b) Desirable Insurance
(c) Available Insurance

9
Essential Insurance includes those coverages required by law or by contract, such as workers
compensation insurance. It also includes those coverages that will protect the firm against a
loss that threatens the firm’s survival. Desirable insurance is protection against losses that
may cause the firm financial difficulty, but not bankruptcy. Available insurance is coverage
for slight losses that would merely inconvenience the firm.

(ii) Selection of an Insurer:

The next step is that the risk manager must select an insurer or several insurers. Here, several
important factors are to be considered by the risk manager. These include the financial
strength of the insurer, risk management services provided by the insurer and the cost and
terms of protection. The insurers financial strength is determined by the size of policy owner’s
surplus, underwriting & investment results, adequacy of reserves for outstanding liabilities,
etc. The risk manager can identify the financial strength of the insurer by referring the rating
given to that insurance company. For example in America, A.M.Best Company is one of the
famous rating company that publishes the rating of insurers based on their relative financial
strength. Besides, the financial strength, the risk manager must also consider the risk
management services by the insurer and the cost & terms of protection.

(iii) Negotiation of terms:

After the insurer is selected, the terms of the insurance contract must be negotiated. If printed
policies, endorsements and forms all used, the risk manager and insurer must agree on the
documents that will form the basis of the contract. If a specially tailored manuscript policy is
written for the firm, the language and meaning of the contractual provisions must be clear to
both parties. If the firm is large, the premiums are negotiable between the firm and insurer.
(iv) Dissemination of information concerning insurance coverages:
Information concerning insurance coverages must be given to others in the firm. The firm’s
employees must be informed about the insurance coverages, the records that must be kept, the
risk management services that the insurer will provide, etc.

(v) Periodic review of the insurance program:

The entire process of obtaining insurance must be evaluated periodically. This involves an
analysis of agent and broker relationships, coverages needed, cost of insurance, quality of
loss-control services provided, whether claims are paid promptly, etc.
Advantages of Insurance:
(a) The firm will be indemnified after a loss occurs. Thus, the firm can continue to
operate.
(b) Uncertainty is reduced. Thus, worry and fear are reduced for the managers and
employees, which should improve their productivity.
(c) Insurers can provide valuable risk management services, such as loss-control services,
claims adjusting,etc.
(d) Insurance premiums are income-tax deductible as a business expense.

Disadvantages of Insurance:
10
 (a) The payment pf premiums is a major cost. Under the retention technique, the
premiums could be invested in the business until needed to pay claims, but if
insurance is used, premiums must be paid in advance.
(b) Considerable time and effort must be spent in negotiating the insurance coverages.
(c) The risk manager may take less care to loss-control program since he has insured. But,
such a lax attitude toward loss control could increase th number of non-insured losses
as well.

4. Selection of Risk Management Tools:

Risk Management Matrix
Type of Loss Loss Frequency Loss Severity Appropriate Risk Management
Technique
1 Low Low Retention
2 High Low Loss Control & Retention
3 Low High Insurance
4 High High Avoidance

In determining the appropriate method or methods of handling losses, the above matrix can be
used. It classifies the various loss exposures according to frequency and severity.
The first loss exposure is characterized by both low frequency and low severity of loss. One
example of this type of exposure would be the potential theft of a secretary’s Note pad. This
type of exposure can be best handled by retention, since the loss occurs infrequently and when
it occurs it does not cause financial harm.

The second type of exposure is more serious. Losses occur frequently, but severity is
relatively low. Examples of this type of exposure include physical damage losses to
automobiles, shoplifting and food spoilage. Loss control should be used here to reduce the
frequency of losses. In addition, since losses occur regularly and are predictable, the retention
technique can also be used.

The third type of exposure can be met by insurance. Insurance is best suited for low
frequency, high severity losses. High severity means that a catastrophic potential is present,
while a low probability of loss indicates that the purchase of insurance is economically
feasible. Examples include fires, explosion and other natural disasters. Here, the risk manager
could also use a combination of retention and insurance to eal with these exposures.

The fourth and most serious type of exposure is characterized by both high frequency and
high severity. This type of risk exposure is best handled by avoidance. For example, if a
person has drunken and if he attempts to drive home in that drunken stage, the chance of
meeting with an accident is more. This loss exposure can be avoided by not driving at the
drunken stage or by having a driver to drive his car.

5. Risk Administration:
The next and the final step in the risk management process is implementation and
administration of the risk management program. It involves three important components;
(i) Risk management policy statement

11
 (ii) Co-operation with other departments
(iii) Periodic review and evaluation

(i) Risk management policy statement:

A risk management policy statement is necessary in order to have an effective risk
management program. This statement outlines the risk management objectives of the firm, as
well as company policy with respect to the treatment of loss exposures. It also educates top
level executives in regard to the risk management process and gives the risk manager greater
authority in the firm. In addition, a risk management manual may be developed and used in
the program. The manual describes the risk management program of the firm and can be a
very useful tool for training new employees who will be participating in the program.

(ii) Co-operation with other departments:

The risk manager has to work in co-operation with other functional departments in the firm. It
will facilitate to identify pure loss exposures and methods of treating these exposures. The
Accounting Department can adopt Internal Accounting Controls to reduce employees fraud
and theft of cash. The Finance Department can provide information showing how losses can
disrupt profits and cash flow. The Marketing Department can prevent liability suits by
ensuring accurate packaging. Besides, safe distribution procedures can prevent accidents. The
Production Department has to ensure quality control and effective safety programs in the plant
can reduce injuries and accidents. The Personnel Department may be responsible for
employee benefit program, pension program and safety program.

(iii) Periodic review & evaluation:

The risk management program must be periodically reviewed and evaluated to see whether
the objectives are being attained or not. Especially, risk management costs, safety programs
and loss preventive programs must be carefully monitored. Loss records must also be
examined to detect any changes in frequency and severity. Finally, the risk manager must
determine whether the firm’s overall risk management policies are being carried out, and
whether the risk manager is receiving the total co-operation of the other departments in
carrying out the risk management functions.

12