Risk Management
Risk management process
Risk management identifies, assesses, mitigates, monitors, and finances risk. Know the main exposures: property, liability, employment, fair housing, environmental, cyber, business interruption, contractual, and reputational. Mitigation includes avoidance, reduction, transfer through insurance and contracts, and retention. Verify certificates of insurance, use clear indemnification and waiver language where appropriate, train staff, inspect, document incidents, and maintain business continuity and disaster plans.
Traps
A common trap is assuming insurance covers every loss. Policies have exclusions, deductibles, limits, and notice requirements. Another trap is relying on a waiver without checking enforceability or local law. Questions may test unverified vendor insurance, missing incident reports, oral contracts, or treating risk management as only a safety program. Risk transfer does not eliminate the need to manage the underlying exposure. A claim can fail because notice was late or documentation was missing.
Worked example
A vendor’s work creates a water leak. If the vendor’s certificate of insurance is expired and the contract lacks clear indemnity, the owner may absorb costs that could have been transferred. A risk matrix scoring likelihood and impact helps prioritize: high-likelihood, high-impact exposures get immediate action. Rule of thumb: identify the exposure, choose avoid/reduce/transfer/retain, assign an owner, and document the follow-up.