Question

If you were the risk manager for a company, how would you go about attempting to identify all of the risks facing a business? How would you decide which risks should be insured and which should not? (typing please,thank you)

Answer 1

There are various ways of identifying risk. One way of identifying the risks could be using a top-down approach. The risk manager should start by identifying the broader areas of risk and list the most obvious things that could go wrong with the company. These could be the company strategy, various company policies, day to day activities, etc.

You could also start by identifying the various categories of risks, example - industry risk, financial risk, legal risk, technological risk, operational risk, reputation risk, political risk, etc. The next step would be to classify the business activities in each of these categories of risk. You can then dig deeper into each of the categories of risk. For example, when analyzing industry risk, you could use the Porter's five forces model to identify the threat of competitors, threat of new entrants, threat of substitutes, threat of bargaining power of customers and threat of bargaining power of suppliers. This will give you a fairly clear idea of all the risks faced by the business.

To identify which risks should be insured and which not, it is important to understand the probability/frequency of that risk and the severity of the risk. Probability of risk refers to how frequently are you subject to loss from that risk. Severity refers to the amount of loss caused by the risk, if it were to occur. There are four possibilities here:

• Low Probability, Low Severity - Use risk retention. It is better to retain such risks as these are not frequent and have minimal impact on your business.
• Low Probability, High Severity - Use risk transfer (Insurance). These are the cases where you would want to use insurance to transfer the risk to the insurance company by paying a small premium.
• High Probability, Low Severity - Use risk reduction and prevention. It is better to use safety precautions and help prevent such risks from occurring. For example, increasing quality checks can help reduce the number of defect products.
• High Probability, High Severity - Use risk avoidance. You should try as much as possible to avoid these risks using a combination of risk reduction, risk prevention and risk transfer. For example, avoiding dangerous activities like sky diving is ideal as the frequency of risk is high and the severity is also high.

Insurance should be used when the probability of the risk is low while the severity of the risk is high. This combinations gives the most optimal use of insurances. If the severity is low, there would not be much difference in the cost of premium and the loss suffered and hence, an insurance would not be ideal. Also, premiums include the operating costs of the insurance company, so the business might end up paying more than what they might get in return as claims.