Risk Assessment Road Map 062009

Document Sample
Risk Assessment Road Map 062009 Powered By Docstoc
					Risk Assessment
   Road Map
     06/2009
Has something gone wrong with a
       current activity?




   Or, are you considering a new
              activity?
The Incident Analysis
      Approach
          The Difference Between
  Incident Analysis and Risk Assessment
Incident Analysis:        Risk Assessment:
• Establishes a cause     • Focuses on
  for an incident that      identification of
  has already               potential exposures to
  happened.                 prevent incidents from
• Focuses on analyzing      happening.
  the reasons for the     • Breaks business
  incident and              decisions down into bite
  development of            sized pieces to enable
  strategies to prevent     pre-planning for loss
  future incidents.         control and mitigation
                            strategies.
If something has gone wrong with an
activity, you may want to analyze the
  incident (what went wrong) before
           moving forward.
    Why Analyze Incidents?
• To establish cause and
  prevents future incidents.
• To determine ALL causes
  and contributing factors to
  the incident.
• To identify corrective
  actions.
• To assess the risks of
  future activities.
    Identify Systems Failures/Causes
•   Rarely a Single Cause.
•   Be Objective, Consistent.
•   Avoid Blame Finding.
•   Systems/Causal Factors.
     – Management
     – Equipment
     – Environmental
     – People
Systems Contributing To An
         Incident


  Management    People


         INCIDENT

  Equipment    Environment
     Management
•Policies & Procedures
•Training & Other Resources
•Accountability Practices
     People
•Training
• Level of experience
• Moral or morale
• Competency
• Past incidents
       Equipment
•Maintenance Records
  –Repairs
  –Modifications
•Availability of Proper Equipment
Environment
•Distractions
•Visibility
•Conditions
•Hazards
•Terrain
•Other Users
Recommend Corrective Actions
• Based on specific systems
  failures/causes.
• Plan and recommend changes that will
  prevent further incidents of this nature.
• Analyze the risks associated with the
  changes.
• Follow up to ensure changes
  are instituted and maintained.
The Risk Assessment
 Road Map Process
      What is Risk Assessment?
A strategic approach to
planning, at all levels
and across all
functions of an
organization, that
identifies exposures of
activities and assists in
making risk adjusted
business decisions
every day.
                            GET RID OF SILOS
What is the
 specific
 activity?
  What is Your
Agency’s Appetite
   for Risk?
     What is a Risk Appetite?
• Risk appetite is the degree of
  uncertainty an agency is willing to
  accept to reach its goals.
• Risk appetite is a key factor in
  evaluating strategic options.
• Risk Assessment helps
  management consider risk
  appetite when setting goals that
  align with overall agency strategy,
  and managing risks related to that
  strategy.
Work with your agency’s management to
decide:
 • What is your agency’s risk
   tolerance?
• How much or what are you
  willing to risk to accomplish
  the mission or activity?
• How much can your agency
  afford to lose in any one
  occurrence or in the
  aggregate?
What Does Your
 Agency Do?
  (Mission, Goals,
    Objectives)
Does the activity
 fit the Agency
mission, goals,
   objectives?
If the answer =   No

 Take to management
   for consideration



Management decides yes =   Move on

Management decides no =     Stop
If the answer =   Yes
       What could go wrong?
      Who could be harmed?
     Make a list - write it down.
   These are your loss exposures.
       What could happen?
• Could there be bodily injury,
  property damage or other
  liability exposures caused
  by this service or activity?
• Is there any impact on
  workload? Could there
  be any damage to our
  systems?
              What is Risk?


The danger or probability of loss.
     Loss Exposure
Possibility of financial loss as
the result of a particular peril
  striking a thing of value.
Components of a Loss Exposure
  The type of value exposed
   to loss.
  The peril that causes the loss.
  The extent of the potential
   financial consequences of that
   loss.
  Values Exposed to Loss
• People
• Property
• Freedom from Liability
  (Alleged Wrongdoing)
      Perils Causing Loss
Natural Perils:




Human Perils:



Economic Perils:
            Potential
     Financial Consequences




Make sure that you don’t give away the farm!
THINK ABOUT
WHAT CAN GO
  Wrong!
 Why is this important?
An unrecognized loss exposure
cannot, except by chance, be
effectively managed.
                 Is this your agency?
           Methods Of
     Identifying Exposures:
• Previous contracts of similar type and
  their outcomes.
• Standardized surveys/questionnaires
• Financial statements
• Records and files
• Loss Reports/Claims
• Flowcharts
• Personal inspections
• Experts
Rate the Risks of Loss and
    Weigh the Value of
       Opportunities
Rate the severity of the risk of
each potential loss exposure.
 How bad can each loss be?
     What could it cost?
Rating the Severity of Loss Exposures

 Rating     Severity                           Description (Risk)

   1      Insignificant   No injuries; low financial loss

   2      Minor           First aide treatment; minor financial loss

   3      Moderate        Injuries; loss of operations; moderate financial loss

   4      Major           Extensive injuries; loss of operations; major financial loss

   5      Critical        Death; major loss of operations; huge financial loss
 What is the likelihood that
each of these potential loss
  exposures will happen?
Rating the Likelihood of Occurrence
Rating Descriptor Likelihood              Description
                  (Probability)
  1    Rare        1 – 10%        May occur only in exceptional
                                  circumstances
  2    Unlikely    11 – 25%       Could occur at some time

  3    Possible    26 – 75%       Might occur at some time

  4    Likely      76 – 90%       Will probably occur in most
                                  circumstances
  5    Almost      91 – 100%      Is expected to occur in most
       Certain                    circumstances
             Determine the risk rating/level of risk
              for each potential loss exposure.
                                        Severity
                        INSIGNIFICANT   MINOR   MODERATE   MAJOR   CRITICAL

             ALMOST           M           H        E         E         E
Likelihood




             CERTAIN
             LIKELY           M           M        H         E         E

             POSSIBLE         L           M        H         E         E

             UNLIKELY         L            L       M         H         E

             RARE             L            L       M         H         H
 Risk Rating (RR) = Level Of Risk
• E = Extreme Risk - involve senior
  management immediately, emergency
  situation, consider not doing the activity.
• H = High Risk - management attention
  required for business and policy decisions,
  risk control, insurance types and limits, etc.
• M = Moderate Risk - management should be
  kept informed of risk control, insurance types
  and limits, etc.
• L = Low Risk - manage by routine
  procedures, insurance types and limits could
  be flexible.
Now That You Have Rated The
     Risks Of Loss.…
 Think About The Value Of
     OPPORTUNITIES
 EXPLOITING OPPORTUNITIES
• What opportunities will be missed if the
  activity is not done?
• What is the upside and downside of
  these opportunities?
• By considering the full range of potential
  events—rather than just risks—the risk
  assessment process ensures that
  management can identify and take
  advantage of positive events quickly
  and efficiently.
Weighing the Value of Opportunities
Rating      Value                 Description (Opportunity)

  1      Insignificant Minor budgetary, funding, or resource gain; Little
                       or no gain in public and/or client relations.

  2      Minor         Low budgetary, funding, or resource gain; Some
                       gain in public and/or client relations.

  3      Moderate      Moderate budgetary, funding, or resource gain;
                       Adequate public and/or client relations.

  4      Major         Major budgetary, funding, or resource gain; Good
                       public and/or client relations.

  5      Critical      Huge budgetary, funding, or resource gain;
                       Excellent public and/or client relations.
              If RR = E or H

                     If the Answer =    No
       Is the
      Activity
     Necessary          Management
          ?             Business Decision

                        No = Stop
Management Decides
                        Yes = Move On
    For Each Thing
That Could Go Wrong…

What Tools Are Available To
   Manage the Risks?
Statutory Immunities:
  Research Statutes

         Do any
       immunities
       apply to the
        activity?



   No = Move on to Loss
     Prevention/Risk
    Control Measures
       Statutory Immunities

If the Answer is: Yes
                          Do you have a
   What are the            legal opinion
 limitations and/           on statutory
  or exclusions?            immunities?


 No = Management     Yes = Move on to Loss
 business decision   Prevention/Risk Control
  on legal opinion         Measures
   Loss Prevention/
Risk Control Measures
What are Loss Prevention/
 Risk Control Methods?
 Avoid the risk altogether.
 Prevent the frequency of loss.
 Reduce the severity or cost of loss.
 Segregate to prevent one event
  from causing loss to the whole.
 Contractually transfer the risk.
Avoid Exposure
       Entirely eliminates
       any possibility of
       loss. It is
       achieved either by
       abandoning or
       never undertaking
       an activity or an
       asset.
     Loss Prevention
Reduces the frequency or number of
              losses.
      Loss Reduction
Lowers the severity or cost of a loss.
     Segregate Your Losses
Arrange your agency’s activities and assets to
 prevent one event from causing loss to the
                  whole.

           - two methods -
          Separation
Separate activities and assets among
         several locations.
            Duplication
Provide a duplicate or stand by for use in
 case assets or activities suffer a loss.
Contractual Transfer of Risk
GOAL:
   To insure that a contractor is
   responsible for claims arising out
   of his or her acts, and has some
   way to pay for these losses.
   Develop Risk Control Measures
      Specific to the Situation
• Personal protective equipment.
• Housekeeping, repair, and maintenance.
• Inspections.
• Tools and equipment.
• Policies, procedures, and process.
• Supervision.
• Contract management and administration.
   Which
 measures
 best fit the
  mission,
activity, and
    RR?
How can the
measures be
implemented
  ? Who will
 implement?
Who will be
responsible
 for making
   sure the
  measures
      are
  followed?
Who will be
responsible
for ongoing
monitoring?
 Did you
 choose             Yes = Move on to select
 Contractual        appropriate Contractual
 Transfer?             Transfer Contract
                           Clauses

        No = Go to
State’s Self – Insurance or
  Commercial Insurance
      Contractual Transfer –
        Contract Clauses

• Independent Contractor
• Indemnity/Hold
  Harmless.
• Insurance and Bonds.
• Warranties.
 Will you          Will you          Will you
  use a             use a            require
contract?         template?         insuranc
                                       e or
                                     bonds?

 Yes = Move on to Contractual Transfer

  No = How will the state be protected?

      Re-evaluate the situation. Figure
     out how the state will be protected.
           Talk to management.
  Coverage Assessment




What kind and
 how much
insurance or
   bonds?
Your World has changed!
        9-11-01
Where Does Risk Assessment, Insurance,
 Bonding and Indemnification Fit in the
        Contracting Process?

 • At the inception of an idea, your agency
   should perform a risk assessment of the
   activity.
            Common Types of
           Insurance Coverage
•   Commercial General Liability
•   Automobile Liability Coverage
•   Professional Liability
•   Workers’ Compensation
•   Builder’s Risk Coverage
•   Excess Liability Coverage
•   Pollution Liability Coverage
•   Tail Coverage
       What Does
General Liability Insurance
     Really Cover?
     General Liability Insurance
               Myths
• Insurance covers ―the
  indemnification provided in the
  contract.‖
   – FALSE
• General Liability insurance will
  cover your entity if the contractor’s
  work is done ―negligently.‖
   – FALSE
• There is ―contractual liability‖
  coverage in a General Liability
  policy.
   – MOSTLY FALSE
Commercial General Liability
         (CGL)
Insurance covering ―Third Party‖:
 Bodily injury.
 Property damage.
 Limited Contractual liability.
 Products and completed operations.
 May also cover personal and
  advertising injury liability.
      CGL Policy Definitions
Bodily Injury: The injury of physical
 tissue by an outside force, bodily harm,
 sickness, or disease.
Personal Injury: Libel, slander, false
 arrest, and invasion of privacy.
   CGL Policy Definitions
              (Continued)

Products & Completed Operations:
Insurance covering the contractor for
damage or injury to third parties
resulting from something the contractor
made, repaired, or installed. The
damage to third parties resulting from
the service would be covered not the
contractors actual product.
     CGL Policy Definitions
               (Continued)

Contractual Liability: A portion of
Commercial General Liability coverage that
allows limited coverage for liability
assumed under the contract. The coverage
allowed by Contractual Liability includes:
 Liability assumed under an ―insured
   contract‖.
 Liability that the insured would have in
   the absence of the contract or
   agreement.
  What is an “Insured Contract”?
Per the CGL Policy Definitions, an ―Insured
Contract means:
• A contract for a lease of premises.
• A sidetrack agreement (a railroad term).
• Easements.
• Agreements required by municipalities as a
result of ordinances (not for work done for
municipalities.)
• Elevator maintenance agreements.
• Liabilities that ―would be imposed by law in
the absence of any contract or agreement.‖
               Current Case Law
 • Id. at 479. A tort claim, where there is a
   contract between parties, may only proceed
   where there is some kind of obligation owed
   by one party to the other beyond the duties
   that the contract imposes.
 • Id. at 477. Examples of such relationships
   are those between lawyers and clients,
   doctors and patients, or trustees and
   beneficiaries. The court has called these
   ―special relationships.‖

Jones v. Emerald Pacific Homes, 188 Or App 471, id at 477 & 479
      Special Relationships
Only Exist When:
• One party has relinquished control over
  the subject matter of the relationship to
  the other party; and
• Has placed its potential monetary
  liability in the other’s hands.
Will you require
Additional
Insured and           No
other clauses?

     Re-evaluate the situation. Figure
    out how the state will be protected.
          Talk to management.
How Much Insurance Should
      Be Required?
                Use the risk rating to set
             insurance and bonding limits.
                                        Severity
                        INSIGNIFICANT   MINOR   MODERATE   MAJOR   CRITICAL

             ALMOST           M           H        E         E         E
Likelihood




             CERTAIN
             LIKELY           M           M        H         E         E

             POSSIBLE         L           M        H         E         E

             UNLIKELY         L            L       M         H         E

             RARE             L            L       M         H         H
E = Extreme Risk:

• First, consider not doing the activity.
• If you must, you will need to decide
  how much a potential loss could
  cost?
• In general, risks at this level warrant
  more than $1.5 million per person
  and $3 million per occurrence in
  coverage for Bodily Injury (BI) and
  Death. In addition, if property
  damage is an exposure, add
  $100,000 per single limit and
  $500,000 per occurrence.
H = High Risk:
• Could a potential loss cost in excess of
  $1.5 million per person and $3 million per
  occurrence in coverage for Bodily Injury
  (BI) and Death? Ask for more coverage.
  In addition, if property damage is an
  exposure, add $100,000 per single limit
  and $500,000 per occurrence.
• Make sure your assessment considers all
  costs of potential losses.
• Risk Management would not recommend
  limits of less than $1.5 million per person
  and $3 million per occurrence in
  coverage for Bodily Injury (BI) and Death.
  In addition, if property damage is an
  exposure, add $100,000 per single limit
  and $500,000 per occurrence.
M = Moderate Risk:
• Standard limit of insurance is $1.5 million
  per person and $3 million per occurrence
  in coverage for Bodily Injury (BI) and
  Death. In addition, if property damage is
  an exposure, add $100,000 per single
  limit and $500,000 per occurrence.
• Assessment should consider all costs of
  potential losses.
• If assessment reveals potential loss in
  excess of $1.5 million per person and
  $3 million per occurrence in coverage for
  Bodily Injury (BI) and Death and in
  addition, if property damage is an
  exposure, add $100,000 per single limit
  and $500,000 per occurrence, your risk
  may actually be high (see H for High
  Risk.)
L = Low Risk:
• If risk is minimal, this is the area where coverage and
  limits may potentially be flexible.
• Standard limit is still $1.5 million per person and
  $3 million per occurrence in coverage for Bodily Injury
  (BI) and Death. In addition, if property damage is an
  exposure, add $100,000 per single limit and $500,000
  per occurrence.
• In the case of minimal risks, the agency could make a
  business decision to lower the limits of coverage.
• Risk Management would not generally recommend
  insurance limits of less than $1.5 million per person
  and $3 million per occurrence in coverage for Bodily
  Injury (BI) and Death. In addition, if property damage is
  an exposure, add $100,000 per single limit and
  $500,000 per occurrence.
• If the risk assessment reveals only minute risk, agency
  could make a business decision to waive coverage.
        Always Remember
• Don’t rely on insurance or bonds to
  cover all of the risks associated with
  your contract.
• Many times outcome based statements
  of work, contract administration, and
  supervision are far better risk control
  measures to protect the state’s
  interests than insurance or bonds.
• Insurance and bonds should be thought
  of as the safety net that catches us
  when everything else goes wrong.
    For More Details on
Insurance Types and Limits

              See Smart Contracting
            Toolkit on our Web site at:
           http://www.oregon.gov/DAS/
           SSD/Risk/SmartContractingT
                    oolkit.shtml
The State’s Self-Insurance or
   Commercial Insurance
                              Does management
   Does self-                 want Risk Mgmt to buy
   insurance
                     No       commercial insurance
    cover the
     activity
                              for the activity?
      and/or
     people?
                       No = How will the
                       agency pay for losses
                       resulting from the
                       activity?
Yes = Move on to evaluate Self-
  Insurance or Commercial
     Insurance Coverage
 Evaluation of State Self-Insurance or
   Commercial Insurance Coverage

          Which kind                 What are the
          of coverage                 exclusions
           and what                      and
             are the                  coverage
             limits?      Does the requirements For
  For Self-                               ?
                        agency meet            Commercia
  Insurance
Coverage, see
                        the coverage           l Insurance,
 the State of           requirements              Contact
Oregon Self-                  ?                   Andrea
  Insurance                                     Peters in
  Handbook                                     Risk Mgmt
If Your Agency:
• Has no statutory immunity for the activity.
• Has not decided to use loss prevention/risk
  control measures to minimize or mitigate
  the risks.
• Has not contractually transferred the
  liabilities associated with the activity to
  another party.
• Does not have self-insurance coverage for
  the activity.
• Has not purchased commercial insurance
  coverage for the activity.
  How will the agency pay for losses resulting
                from the activity?
              The Point?
• Knowing the risks associated with
  your agency’s operations that should
  be keeping you awake at night.
• This insight provides your agency
  with the ability to plan for proactive
  loss prevention actions rather than
  just reactive loss reduction reactions.
     Risk Assessment is Not
         Rocket Science
At times, people tell us
that the Risk Assessment
Road Map process is too
simple…..

Our Answer . . .
If Risk Assessment is so
simple, why aren’t you
doing them?
             One More Tool
• Risk Assessment is just one more tool
  to enhance your agency’s business
  decision-making tool box.
• This tool also gives your agency
  a method of documenting the
  rationale for your business
  decisions.
• Risk Assessment Roadmap Toolkit:
  http://www.oregon.gov/DAS/SSD/Risk/RiskAsse
  ssmentRoadmapToolkit.shtml
  Contractual Risk
Assessment Example
 Bybee Bridge Project
     What is the scope of the
      contractual activity?
What is the overall activity?
Replacement of the Bybee Bridge

What are the activity components?
•   Demolish existing structure
•   Remove debris
•   Design of new structure
•   Construction of new structure
When and where does the activity take
  place(s)?
•   Bybee and McLoughlin Blvds,
       Portland, Oregon
•   1/26/04 through 11/30/04

Who will be performing the activity?
•   Capital Concrete Construction, Inc.
•   Various sub-contractors
Will the contractor interact with
  others, i.e., public, staff, etc.?
•   Yes, there will be interaction with various
    ODOT and City of Portland employees,
    the public and sub-contractors.
Will there be any hazardous
  materials involved?
•   Yes – oil, gasoline, paint, chemicals,
    debris, construction site runoff, etc.
  What are the potential
    loss exposures
  associated with this
        activity?
• Bodily injury
• Property damage
• Environmental damage
• Design flaw
     What could go wrong? / Who
         could be harmed?
- Bodily injury and/or illness to third party.
- Damage to third party property.
- Pollution from refueling or maintenance
  operations.
- Structure destroyed due to vandalism
- Runoff contamination.
- Demolition improperly performed.
- Faulty construction due to improper
  design or materials.
- Collapse of structure due to faulty design.
 Is there any impact on workload or
  damage to our systems?
- Delay in bridge completion due to faulty
  construction or design
- Environmental cleanup
- Additional costs for repair or re-design
  of bridge
     Rate the Severity of Each
     Potential Loss Exposure.
        (How bad can each loss be?
             What could it cost?)
 Bodily Injury: Insignificant to Minor (1-2),
  Hundreds to Thousands
 Property Damage: Insignificant to Moderate
  (1-3), Hundreds to Thousands
 Environment: Minor to Critical (2-5),
  Thousands to millions
 Design Flaw: Minor to Moderate (2-3),
  Thousands to millions
What is the Likelihood That
 Each of These Potential
  Losses Will Happen?
Bodily Injury - Unlikely (2)

Property Damage - Possible (3)

Environmental Damage – Likely (4)

Design Flaw – Unlikely (2)
    Determine the Risk Rating
    or Level of Risk for Each
         Loss Exposure.
   Bodily Injury: Low Risk
   Property Damage: Low to High Risk
   Environment: Moderate to Extreme Risk
   Design Flaw: Low to Moderate Risk
Weighing the Value of Opportunities
Rating       Value                   Description (Opportunity)

  1      Insignificant   Minor budgetary, funding, or resource gain; Little or
                         no gain in public and/or client relations.

  2      Minor           Low budgetary, funding, or resource gain; Some
                         gain in public and/or client relations.

  3      Moderate        Moderate budgetary, funding, or resource gain;
                         Adequate public and/or client relations.

  4      Major           Major budgetary, funding, or resource gain; Good
                         public and/or client relations.

  5      Critical        Huge budgetary, funding, or resource gain;
                         Excellent public and/or client relations.
   What Could Be The Opportunities
          On This Project?
• Possible funding from other entities i.e.
  federal government, cities, counties, etc.
• Good public perception for widening and/or
  fixing a deteriorating bridge.
• The opportunity of avoiding liability that could
  arise from the collapse or failure of the
  deteriorating bridge.
• Economic stimulation, and the opportunity to
  utilize minority, women, or emerging small
  business
        Determine Non-Insurance
         Risk Control Measures
• Involve the community at the earliest stage to
 determine concerns. Address concerns,
 examples include: detours, closures, access to
 emergency services when the bridge is closed,
 ways the environment will be protected, etc.
• Communicate to the public through various
  methods, to include the web, TV and radio
  stations, newspapers, neighborhood meeting, etc.
• Identify potential pollution sources from materials
  and wastes that will be used, stored or disposed
  of on the job.
• Use best business practices to address
  pollution issues, such as using one area for
  vehicle parking, refueling and routine
  maintenance. Insure that wastes will be
  disposed of properly. Require recycling of
  wastes when possible.
• Close access to the work site for phases of
  the construction that pose hazard to the
  public, such as demolition.
• Verify that all of the contractor’s employees
  are properly trained and/or certified as
  required for the scope of work.
• Require the contractor to maintain
  on-site MSDS sheets.
    Assignment of Insurance
     and Bonding Coverage
   Bodily Injury: Low Risk - CGL/Automobile
    Liability
   Property Damage: Low to High Risk -
    CGL/Automobile Liability
   Environment: Moderate to Extreme Risk -
    Pollution Liability
   Design Flaw: Low to Moderate Risk –
    Professional Liability