CRM Risk cheat sheet

Peril is the cause of loss (fire, windstorm, collision); hazard is a condition that increases the frequency or severity of loss (icy walkway, faulty wiring, careless driving record).

Static risks arise from randomness in a stable economy and are generally insurable; dynamic risks arise from economic, social, political or technological change and are usually uninsurable.

Insurable risk tests: the loss must be pure (no gain possible), accidental, measurable and definite, spread over many similar exposure units, and not catastrophic to society as a whole.

Four exposure categories to audit in every organization: asset (property), net income (business interruption, extra expense), liability (legal obligation to third parties), and personnel (death, disability, key-person loss).

Exposure identification tools: exposure checklists and questionnaires, flowcharts of operations, financial statement analysis, physical inspections, historical loss runs, contract and lease review, and organization charts.

ERM treats risk as a portfolio: it aggregates exposures across silos, aligns risk taking with strategy and risk appetite, and reports a consolidated view to the board.

Risk appetite is the amount and type of risk the organization is willing to accept; risk tolerance is the acceptable variation around a specific objective; risk capacity is the maximum loss absorbable before financial distress.

COSO ERM (2017) components: governance and culture; strategy and objective-setting; performance; review and revision; information, communication and reporting.

Fundamental risks affect many or all members of a society (war, inflation) and are typically handled publicly; particular risks affect individuals or single firms and are typically handled privately.

Expected loss = loss frequency (probability of loss per period) × average severity; it is the basis for comparing exposures and sizing retentions.

Coefficient of variation = standard deviation ÷ mean; it expresses relative risk per unit of expected outcome and allows comparison of exposures with different scales.

Two-asset portfolio standard deviation = √(w₁²σ₁² + w₂²σ₂² + 2w₁w₂ρσ₁σ₂); when ρ < 1 the portfolio deviation falls below the weighted average of the parts.

Value at Risk (VaR): the loss not expected to be exceeded at a stated confidence level over a stated horizon; it says nothing about the size of losses beyond that threshold.

Risk matrix limits: likelihood × impact grids are ordinal, compress ranges, depend on subjective scales, and cannot be summed or compared to capital, so they screen rather than quantify.

Forecasting methods: moving averages (smoothing), exponential smoothing (a higher alpha weights recent data more heavily), regression/trend fitting, and Monte Carlo simulation for probability distributions of aggregate loss.

Decision rule by frequency and severity: high frequency/low severity favours retention plus loss prevention; low frequency/high severity favours transfer to insurance or capital markets.

Long-tail claims require discounting: present value = future value ÷ (1 + r)^n, which materially reduces the stated cost of liabilities settled years later.

Credibility weighting blends an organization's own loss experience with industry or actuarial data, weighting each by sample size and reliability when internal data are thin.

Risk control techniques: avoidance (eliminate the activity), loss prevention (lower frequency), loss reduction (lower severity), separation, duplication, diversification, and non-insurance transfer by contract.

Prevention attacks frequency, reduction attacks severity, and avoidance removes the exposure entirely but may forgo the associated opportunity or create a new exposure.

Adopt a control measure when the marginal reduction in expected losses plus indirect benefit savings exceeds the full cost of the measure, including operating disruption.

Business continuity sequence: business impact analysis → maximum tolerable downtime → recovery time objective (speed of restoration) and recovery point objective (tolerable data loss).

Recovery strategies: hot site (live systems), warm site (partly equipped), cold site (shell space), and reciprocal or mutual aid agreements with other organizations.

Crisis and disaster management phases: mitigation, preparedness, response and recovery; elements include a crisis team, pre-approved communications, drills and plan testing with post-incident revision.

Claims management duties: prompt notice to insurers, documenting and proving the loss, mitigating further damage (sue and labour), cooperating with the adjuster, setting reserves, salvage and subrogation recovery.

Straight deductible: insured pays the stated amount and the insurer pays the excess; franchise deductible: once the loss exceeds the threshold the insurer pays the entire loss from the first dollar.

Common post-loss insured duties: protect property from further damage, keep accurate records, submit a sworn proof of loss, and refrain from voluntary payments or admissions of liability.

Retention can be planned or unplanned, and funded (a reserve or captive) or unfunded (absorbed from cash flow); the cost of a retention equals expected losses plus a risk/volatility margin plus administration.

Commercial premium components: expected losses, insurer expenses, a risk charge for volatility and capital, profit margin and taxes, less expected investment income on reserves.

Selection rule: retain when the loading in commercial premium plus frictional cost exceeds the cost of holding capital for the retained volatility; transfer when severity threatens solvency.

Deductible structures: straight (per-occurrence or per-claim), aggregate stop (caps total retained loss in a period), and franchise (threshold, then full payment).

Captive forms: pure single-parent, group or association captive, rent-a-captive, and protected cell company; a captive is generally viable when external premiums exceed expected losses plus capital cost, administration and reinsurance.

Captive advantages: control of claims and coverage terms, retention of underwriting profit and investment income, direct access to reinsurance, and filling coverage gaps in commercial markets.

Alternative risk transfer instruments: catastrophe bonds, insurance-linked warrants, sidecars, industry loss warranties, finite or structured risk programs, and contingent capital facilities.

Insurance-linked triggers: indemnity (actual insured loss), industry loss index, parametric (physical measurement such as wind speed or magnitude), and modelled loss; basis risk rises as the trigger moves away from indemnity.

Retrospective rating adjusts the premium after the policy period to actual losses, subject to a minimum and maximum premium, sharing loss experience between insured and insurer.

Total cost of risk = insurance premiums + retained losses + administration and claims handling + risk control spending + fees and taxes; usually benchmarked per unit of revenue or per employee.

Three lines of defence: operating management owns and manages risk; a risk/compliance function sets frameworks and monitors; internal audit gives independent assurance to the board and audit committee.

Organizational placement: the chief risk officer reports to the CEO with direct access to the board risk committee, preserving independence from business-unit revenue pressure.

Risk manager scope: exposure identification, analysis, control program design, insurance buying, claims oversight, contract and lease review, safety liaison, and risk reporting to executives.

Board risk committee duties: approve risk appetite, oversee the ERM framework, review top and emerging risks, and challenge management on concentration and mitigation.

Global insurance program structure: locally admitted policies where required by law, a master policy abroad, and difference in conditions/difference in limits (DIC/DIL) coverage to fill gaps between them.

International exposures: currency and exchange controls, political and expropriation risk, terrorism and political violence, kidnapping and ransom, differing liability regimes, sanctions screening and data privacy rules.

Executive and professional exposures: directors and officers liability, employment practices liability, fiduciary liability, crime/fidelity, cyber liability and kidnap and ransom cover.

Governing insurance contract principles: insurable interest, indemnity, utmost good faith (full disclosure), proximate cause, and subrogation of the insurer against the responsible third party.

Total cost of risk = insurance premiums + retained losses + administration and claims handling + risk control spending + fees and taxes; usually benchmarked per unit of revenue or per employee.

Three lines of defence: operating management owns and manages risk; a risk/compliance function sets frameworks and monitors; internal audit gives independent assurance to the board and audit committee.

Organizational placement: the chief risk officer reports to the CEO with direct access to the board risk committee, preserving independence from business-unit revenue pressure.

Risk manager scope: exposure identification, analysis, control program design, insurance buying, claims oversight, contract and lease review, safety liaison, and risk reporting to executives.

Board risk committee duties: approve risk appetite, oversee the ERM framework, review top and emerging risks, and challenge management on concentration and mitigation.

Global insurance program structure: locally admitted policies where required by law, a master policy abroad, and difference in conditions / difference in limits (DIC/DIL) coverage to fill gaps between them.

Executive and professional exposures: directors and officers liability, employment practices liability, fiduciary liability, crime/fidelity, cyber liability and kidnap and ransom cover.

International exposures: currency and exchange controls, political and expropriation risk, terrorism and political violence, differing liability regimes, sanctions screening and data-privacy rules.

Governing insurance contract principles: insurable interest, indemnity, utmost good faith (full disclosure), proximate cause, and subrogation of the insurer against the responsible third party.