1
Proactive Risk Management – Managing
Risks Starts at the Top
2
Introduction
What the heck is Risk Management?
As used in this workshop, “risk” refers to possible loss or an other adverse event that has the potential to interfere with a city or town’s financial stability, or the ability to deliver services to your citizens. It is a symple 5-step process which cities and towns can use to cities and towns can protect their financial stability, critical assets and improve services.
1. Identifying potential risks 2. Assessing various strategies
3. Selecting the appropriate tool or tools 4. Implementing an action plan to address 5. Monitor and revise
Risk Management is a process. It is systems based. It applies to everything we do every day. But to make educated and appropriate decisions, you need to identify, assess, implement and monitor the process. By ensuring that risk management considerations are thoroughly integrated into every level of the organizations’s culture and operations you will move well down the path to minimizing the risks and impact of losses on your municipality. From the Mayor and Councilmembers to the newest employee and your volunteers, everyone should understand the city’s risks, and his or her role in preventing and controlling potential losses.
We call this “Proactive Risk Management” and it starts at the top of the organization. And no, this is not just adding one more thing to your plate. It is a way of thinking about existing activities, programs and processes; providing ideas and tools for saving
3
Benefits of Proactive Risk Management
1. Enhanced long-term management
Better choices of what you want your city to accomplish Greater ability to achieve realistic goals
2. Streamline day-to-day management
Better delivery of city services Less time dealing with the consequences of risks
Better control as a result of risk identification, analysis, control and monitoring.
More systematic approach to addressing legislative and regulatory mandates
Improved contracts
Improved health and safety, condition of buildings and equipment
3. Improved financial management
Better informed decision making
Better financial controls as a result of risk identification, analysis, control and monitoring.
Reduction in direct costs of risk pooling
4. Consistent Services
Less disruption to customers Positive city image
4
Risk Identification
Cities and towns are vulnerable to many hazards beyond the common, insurable risks associated with accidental losses such as property damage from fires, floods, wind storms, auto accidents, and workers’ compensation when an employee is injured on the job. For too long cities have infrequently thought about risk management. And
traditionally, when they do it is when there has been after a loss, when they have to pay their insurance premium, or on a single department basis. Proactive Risk Management looks a the city as a whole, not individual departments, and also at non-traditional risks. Some of the non-tradtional risks are:
Loss of tax revenue
Responding to Public Records Requests Reduction in Bond Rating
Major employer leaving your municipality Aging work force
Replacement of specialized vehicles Changes in weather and climate Increased rail and truck traffic
Violation of the Open Public Meetings Act Changes in statutes, and regulations
Most cities and towns can’t afford a full-time risk manager. This is why the responsibility falls on the council, mayor, and top managers. You are not alone, RMSA is your
outsourced “Risk Manager”. We are here help for you. Risk Identification is based upon an evaluation of:
1. Environment in which risks are generated.
2. The perils and opportunities that arise within those environments. 3. The city’s exposure to those risks.
5
1.
IDENTIFYING RISKS
External Risks -
You have little control but they impact your city 1. Physical environment Floods ________________________ _______________________ ________________________ 2. Economic environment Monetary Policy ________________________ _______________________ ________________________ 3. Political environmentLegislative Olympia, Washington D.C.___________________ _______________________ ________________________ 4. Social environment Aging Population ________________________ _______________________ ________________________ 5. Legal environment Court Decisions ________________________ _______________________ ________________________
6
Internal Risks -
You have lots of control over these risks.1. Operational Risks (day-to-day)
Professional (such as: Building Code Enforcement, Law Enforcement, Employment Practices, Drinking Water Quality) Financial (such as: monetary policy, poor investments,
embezzlement)
Legal (such as: violation of Open Public Meetings, harassment, employment/termination, discrimination)
Physical (such as vehicle accidents, building fires)
Contractual (such as construction contracts, interlocal agreements, professional services)
Technological (such as information technology, sabotage, data breach)
Environmental (such as EPA rules, Health Department Rules, underground pollution, air quality)
2. Cognitive Risks (lack of information, and attitudes toward decision making).
7
3.
PERILS AND OPPORTUNITIES: Causes of Losses and Gains
Every city is exposed to certain hazards, which raise the probability of loss or increase the potential impact. Hazards are items or events that raise the
probability of a loss or increase its impact. A hazard by itself does not produce a loss. It is the peril which is the cause of loss.
Although Risk Managers often focus on negatives, the same approach can also identify opportunities.
Here is one example, add your own
HAZARD PERIL OPPORTUNITY
Hot and Dry Summer Forest fires Agriculture new crops
Lack of domestic water Heat Stress
8
4.
EXPOSURE TO RISK
There are basically two types of risk exposures Assets and Liability The three general categories of asset risk exposure are:
Physical Financial Human
List some of your physical assets:
_______________________ __________________ ________________ Estimate the total value of your city’s physical assets: _____________________ List some of your financial assets:
_______________________ __________________ ________________ List some of your human assets:
_______________________ __________________ ________________
In round numbers what is the city’s total budget? _________________________ How much of the total budget is in the general fund? _________________ How many utility funds do you have? _________________
What is the budget for sewer utility? _________________ What is the budget for water utility? _________________ What is the budget for other utilities? _________________ The two areas of liability risk exposure are: Legal and Moral
Legal Liability are:
Vehicle Liability (city vehicle hitting a pedestrian)
Employment Liability (Hiring, promotion, discipline, termination) Product or Service Liability (sewer back-up)
Law Enforcement Liability (Excessive use of force) Land Use Liability (continuous moratoriums)
Premises Liability (slips, trips and falls)
Contractual Liability (Inter-Local Agreements)
Environmental Impairment Liability (pesticide/herbicide application) Professional Liability (Building Code enforcement)
Workers’ Compensation ( injuries, time loss costs)
Other: _________________________________________
Moral Liability = general responsibility to the citizens that is not defined only
9
Risk Management Strategies
1 Risk Avoidance
Risk avoidance may be the most complete technique to manage certain risks. But in cities, it is not always feasible due to laws and regulations. In fact, the inability to avoid many keys risks is what distinguishes public sector risk management from the private sector.
List areas where your city is avoiding risk: _________________________________
_______________________________ _________________________________
2 Risk Reduction (also called Loss Prevention)
Adopting polices and implementing procedures to prevent, or at least reduce the likelihood of losses.
List three policies or procedures where your city is reducing potential risk:
__________________________________________________________________ __________________________________________________________________ __________________________________________________________________
3 Risk Control (also called Loss Control)
Loss control methods do not prevent losses from occurring. They do minimize the losses that do occur.
List three methods your city uses to control losses:
__________________________________________________________________ __________________________________________________________________ __________________________________________________________________
4 Risk Transfer
Risk transfer (or contractual risk) strategies turn over the responsibility of
performing risky activity to another party, such as an independent contractor and assign responsibility for any losses to that other party.
List at least one area where your city has transferred the risk to another entity or private sector business.
__________________________________________________________________ __________________________________________________________________
10
Insurance and Indemnity BAD example
Circle or underline what you consider as poor risk management language
INSURANCE AND INDEMNITY: City PD shall secure comprehensive
general liability insurance (Form CG-001) for property damage and bodily injury at the premises in an amount of not less than $1 million per occurrence and $2 million aggregate. In addition, City PD shall keep and maintain in full force and effect during the term of this agreement fire and extended coverage insurance on all fixed improvements located or situated on or in the Premises to the full insurable value thereof. Proceeds from such insurance shall be used to restore the Premises. City PD shall provide Race Track who will then provide to the Port of Evergreen Trees a certificate of insurance. Certificates of insurance must be received by Race Track no less than 45 days prior to the scheduled event naming Race Track and the Port of Evergreen Trees/Evergreen Trees National Airport as an additional insured’s (CG 2010 [form B]) and the premises (Evergreen Trees National Airport inactive runway 16/34) shall be listed as a covered site on all coverage. City PD agrees to hold Race Track and the Port of Evergreen Trees/Evergreen Trees National Airport, its employees, agents and invitees harmless from any liability and/or suits for such injuries or property damage as any person might receive or believe he has received from the acts or omissions of the City PD, their agents, or employees, or any other person(s) using the premises under the terms of this agreement while operating at the Port of Evergreen Trees/Evergreen Trees National Airport, including the expenses of litigation. No occupancy or use permitted under the terms of this agreement shall commence until such evidence of insurance is presented to and approved by Race Track and the Port of Evergreen Trees/Evergreen Trees National Airport. City PD agrees to assume full responsibility for the conduct of all persons involved in the said use of the premises.
11
Indemnify and Hold Harmless GOOD example
The Contractor shall indemnify, hold harmless and defend the City, its elected officials, officers, employees, volunteers, interns, agents and representatives, from and against any and all claims, actions, suits, liability, loss, costs, expenses, and damages of any nature whatsoever, including costs and reasonable attorney’s fees in defense thereof, or injuries, sickness or death to persons, or damage to property (collectively, “Losses”) to the extent arising out of or resulting from the negligent or willful acts, errors or
omissions of the Contractor in performance of this Contract, except to the extent such Losses caused by or result from the solenegligent or willful acts, errors or omissions of the City. Should a court of competent jurisdiction determine that this Contract is subject to RCW 4.24.115, then, in the event of liability for damages arising out of bodily injury to persons or damages to property caused by or resulting from the concurrent negligence of the Contractor and the City, its officers, officials employees, volunteers and interns the Contractor’s liability hereunder shall be only to the extent of the Contractor’s negligence.
Notice to Contractor; Defense
In the event an action is brought against the City for which indemnity may be sought against the Contractor, the City shall promptly notify the Contractor in writing. The Contractor shall have the right to assume the investigation and defense, including the employment of counsel and the payment of all expenses. On demand of the City, the Contractor shall at its own cost and expense defend, and provide qualified attorneys acceptable to the City under service contracts acceptable to the City to defend, the City, its officers, employees, agents and servants against any claim in any way connected with the events described in Section 6.6.1. The City shall fully cooperate with the Contractor in its defense of the City, including consenting to all reasonable affirmative defenses and counterclaims asserted on behalf of the City. The City may employ separate counsel and participate in the investigation and defense, but the City shall pay the fees and costs of that counsel unless the Contractor has agreed otherwise. The Contractor shall control the defense of claims (including the assertion of counterclaims) against which it is providing indemnity under this Section, and if the City employs separate counsel, the City shall assert all defenses and counterclaims reasonably available to it.
Industrial Insurance Immunity Waiver
With respect to the obligations to hold harmless, indemnify and defend provided for herein, as they relate to claims against the City, its elected officials, officers, employees, volunteers, interns, agents and representatives, the Contractor expressly agrees to waive the Contractor’s immunity under industrial insurance, Title 51 RCW, for any injury, sickness or death suffered by the Contractor’s employees to the extent arising out of or resulting from the negligent or willful acts, errors or omissions of the Contractor in performance of this Contract. This waiver is mutually agreed to by the parties.
12
Risk Assessment
There are several tools which can be used either independently or together. They include a Risk Matrix, Risk Analytical Framework, and Frequency/Severity Worksheets. Each has its advantages, and none is perfect.
Risk Matrix
The simplest method of assessing risk is to complete the Risk Matrix. Although there are variations with some matrices very complicated. The Matrix presented is an
excellent tool to identify the types of activities and exposures which can cause you the most damage or loss. The Risk Matrix must be completed to be able to fully use the Frequency and Severity Worksheets. Some agencies also use the matrix to evaluate personnel policies.
13
Risk Matrix
Low Risk
/
Low Frequency
= rarely losses occur and when they do, they are of minor importance.Low Risk
/ High Frequency
= often produce losses but each loss tends to be minor.High Risk /
Low Frequency
= rarely produce losses but when losses do occur theyare significant or catastrophic.
High Risk / High Frequency
= losses occur often and are seriousHigh Risk
/
Low Frequency
High Risk
/
High Frequency
14
Emergency Management Self-Assessment
This is an informal five-minute quiz you can take as a confidential personal assessment of you and your community's emergency management risk. The questions reflect some of the survival capabilities that past experience has associated with effective CEO participation in emergency management.
Following the set of questions is a scoring section. The scoring section is designed to help you decide whether action is needed to reduce your risk.
1. Have you personally reviewed your community's emergency management plan within
the past 12 months? Yes _____ No_____
2. Do you have a clear understanding of your authority and
responsibilities in disaster situations? Yes _____ No_____
3. Have your elected officials participated within the last two years in either a comprehensive review of your emergency management
system or a disaster exercise? Yes _____ No_____
4. Is a single news media point of contact (e.g., public information officer) provided in your community's emergency management plan? Yes _____ No_____ 5. Were representatives of the news media involved in developing and testing the
community's emergency management plan? Yes _____ No_____
6. Does your community have adequate accounting and disaster records-keeping procedures to document your community's requests for reimbursement under state and
federal emergency assistance programs? Yes _____ No_____
7. Does your community's plan insure that the information needed to defend itself in a disaster-related lawsuit is maintained during an incident? Yes _____ No_____ 8. Is the disaster organizational structure an extension and expansion of the day-to-day
emergency structure? Yes _____ No_____
9. Have you spent more than one hour during the past year in face-to-face discussion with your emergency management program manager about how to improve
disaster management? Yes _____ No_____
10. Are your emergency management procedures brief and organized in a manner that enables your community to respond smoothly to the range of incidents that may
15 11. Are your mutual/automatic aid systems with other communities effective for both
normal and disaster situations? Yes _____ No_____
12. Are all your emergency units equipped and your personnel trained so that they can begin to set up an incident command system? Yes _____ No_____ 13. Do you understand state and local emergency management law, particularly as it relates to the CEO's powers during an emergency? Yes _____ No_____ 14. Does the emergency operations plan contain lines of succession (at least three back-ups) for key officials and has the authority to act in their stead been
pre-delegated? Yes _____ No_____
Self-Assessment Scoring
Obviously, the correct answer for all questions is yes. To give you a yardstick for how well you are doing, give yourself one point for each "yes" answer. Total your score. Grade your risk as follows:
13–14 Yes answers. Your risk is apparently well managed; now make it perfect.
Look back at your "no" answers and decide what you can do to close this area of exposure.
11-12 Yes answers. You are making good progress, but there are a number of
actions you can take to reduce your risk. You may wish to focus your attention on areas indicated by the "no" answers. Based on the results of reviews in these areas, you can decide what further steps are indicated.
8-10 Yes answers. You and your community may be at risk, but it is not too late.
Scores in this range suggest your emergency management responsibilities are being partially met, but there is room for improvement. Start today to develop a comprehensive emergency management program.
Fewer than 8 Yes answers. You are at risk! Prompt action is indicated. You need to take immediate action to improve your ability to respond effectively to a major disaster. A complete review of emergency management organization and your role is warranted to reduce your risk
