Control of Risk: Risk Control, Crisis Planning, and Claims Management
Acting on the exposure
Risk control changes the exposure itself. Core techniques: avoidance (eliminate the activity), loss prevention (reduce frequency), loss reduction (reduce severity), separation (split assets or activities), duplication (backups), diversification, and non-insurance contractual transfer. Controls can be pre-loss (prevention, detection) or post-loss (salvage, continuity, recovery). The hierarchy of controls favors elimination, substitution, and engineering controls before administrative controls and protective equipment.
Crisis and disaster planning has layers: an emergency response plan protects life safety; business continuity planning (BCP) keeps critical functions running, driven by a business impact analysis that sets recovery time objectives (RTO - how fast a function must return) and recovery point objectives (RPO - how much data loss is tolerable). Disaster recovery focuses on IT and data. Plans must be exercised, not shelved.
Claims management covers prompt notice, coverage verification, investigation, reserving, payment, subrogation recovery, salvage disposal, fraud detection, and litigation management; many organizations use a third-party administrator. Disciplined handling controls both indemnity and expense leakage.
Traps
Prevention vs reduction is a frequency/severity question - sprinklers are usually reduction, a no-smoking policy is prevention. Separation is not duplication. RTO is not RPO. Contractual transfer of liability is risk control; insurance is risk financing. An untested continuity plan is not a control.
Rule of thumb: for each exposure ask whether you can stop it, shrink it, spread it, or shift it contractually before insuring it.
Worked example: a data center adds redundant power (duplication), mirrors data to a second site (separation), sets an RTO of 4 hours and RPO of 15 minutes, and buys cyber insurance as financing.