CISR Risk Management cheat sheet

Risk is uncertainty about outcomes; in insurance terms it is the chance of loss, defined as deviation from expected results, not the loss event itself.

Pure risk offers only loss or no-loss outcomes and is insurable; speculative risk includes gain or loss (investment, new product launch) and is generally not insurable.

Hazard is a condition that increases the frequency or severity of loss (icy sidewalk, worn wiring); peril is the actual cause of loss (fire, windstorm, theft).

Risk management process: identify exposures, analyze and measure, select techniques (control and financing), implement, then monitor and revise.

Frequency is how often losses occur; severity is how large each loss is. High-frequency/low-severity exposures favor retention plus loss control; low-frequency/high-severity favor transfer.

Risk control reduces frequency or severity; risk financing funds losses after they occur (retention, insurance, noninsurance transfer).

Enterprise risk management treats risk in silos (hazard, financial, operational, strategic) as a portfolio rather than handling each exposure independently.

Cost of risk = insurance premiums + retained losses + loss control spending + administrative costs + cost of risk transfer, less recoveries.

Identification answers what can go wrong and how; analysis answers how often and how much. Skipping identification leaves unmeasured, unfunded exposures.

Standard identification tools: exposure checklists and surveys, financial statement analysis, flowcharts of operations, physical inspections, and loss-history review.

Financial statement analysis looks for unreported values (property, business income, key person, liability exposures) and for assets or obligations that create liability.

Flowcharts trace a process step by step to find bottlenecks and single points of failure; checklists catch common exposures but miss unusual ones.

Four classes of business exposure: property (real, personal, intangible), net income/business income, liability, and personnel (death, disability, retirement, unemployment).

Loss histories reveal frequency and severity patterns; near-miss and incident logs catch exposures that have not yet produced paid claims.

Liability exposures arise from premises, operations, products/completed operations, auto, and professional acts; identify by contract, not just by intuition.

Business income exposure includes extra expense and contingent business income from a supplier or customer outage, not only the insured's own damage.

Probability is the long-run relative frequency of an event; the law of large numbers makes observed frequency converge on true probability as the number of similar exposure units grows.

Expected loss (loss cost) = frequency x average severity; for example 0.05 claims per unit x $20,000 average severity = $1,000 expected loss per unit.

Maximum possible loss is the worst case if all defenses fail; probable maximum loss (PML) is the worst credible loss given working protections.

Standard deviation measures dispersion around expected loss; higher dispersion means greater uncertainty and a stronger case for transfer.

Risk matrix plots likelihood against impact into low/medium/high tiers; it is qualitative and useful for ranking, not for pricing.

Retention decision rule: retain when expected loss plus risk-bearing cost is below the loaded premium and worst-case loss fits the firm's financial capacity.

Coefficient of variation (standard deviation / mean) compares relative risk across exposures with different expected loss sizes.

Risk mapping and scenario analysis test low-probability, high-severity events that historical loss data alone will not reveal.

Loss prevention reduces frequency (safety training, inspections, quality control); loss reduction reduces severity (sprinklers, backup generators, contract limits).

Avoidance eliminates the exposure entirely but also eliminates the activity's benefit; it is impractical for core operations and can create new exposures.

Separation spreads exposures across locations or time so one event cannot hit all units; duplication keeps spare capacity (backup data, spare equipment).

Transfer by contract (hold-harmless, indemnity, waiver of subrogation) shifts liability; verify the other party's financial ability to honor it.

Risk control technique selection: use avoidance for unacceptable severity, prevention/reduction for high frequency, and separation/duplication for concentrated values.

Safety programs succeed when management commits, hazards are identified, controls are engineered where possible, and results are measured and audited.

Residual risk remains after controls are applied; it must be financed and documented, not assumed away.

Business continuity planning (backup sites, data recovery, supplier alternatives) is loss reduction for catastrophic interruption exposures.

Retention is funding losses internally; it can be planned (deductibles, self-insurance, captives) or unplanned (unfunded losses absorbed from operating cash).

Insurance transfers risk for a premium; the insured still retains the deductible, coinsurance share, exclusions, and any limits shortfall.

Insurable risk criteria: pure risk, large number of similar exposure units, accidental and measurable loss, definite time and place, and affordable premium.

Captive insurer is a subsidiary formed to insure the parent's risks; it retains risk formally and must meet capital, regulatory, and reinsurance needs.

Noninsurance transfers (leases, hold-harmless agreements, surety bonds) shift financial responsibility without an insurance policy.

Retention levels are set by financial capacity: worst-case retained loss should not threaten solvency, earnings targets, or loan covenants.

Risk financing mix weighs cost of transfer (premium plus loadings) against cost of retention (expected losses plus administration plus capital at risk).

Reinsurance protects the insurer; facultative covers a single risk, treaty covers a class of risks automatically under agreed terms.

Implementation assigns each chosen technique an owner, a budget, a timetable, and a measurable standard so execution can be audited.

Monitoring compares actual results against standards, tracks claims and near misses, and revises the program when exposures, values, or operations change.

Policy administration covers limits, deductibles, endorsements, certificates of insurance, and timely premium and audit reporting.

Claims administration: notify promptly, document the loss, preserve evidence, mitigate further damage, and cooperate with the adjuster.

Recordkeeping retains exposure inventories, loss runs, policies, and inspection reports; loss runs support renewal negotiation and retention decisions.

Program review is continuous, not annual only; trigger review on acquisitions, new products, new locations, major claims, or coverage changes.

Risk manager accountability includes communicating exposures to senior management and confirming that control and financing decisions stay aligned.

Benchmarking cost of risk against peers and prior years shows whether the program is improving or drifting.