Risk Management Matters. But Are We Starting in the Right Place?

Organizations face risk everywhere: in operations, people, technology, contracts, supply chains, vehicles, property, growth plans, acquisitions and the decisions leaders make under uncertainty. That is why risk management has to be broader than purchasing insurance.

Insurance matters. It is one of the most effective ways to transfer or finance certain losses. But a policy responds after the organization has already made decisions about how it operates. Strategic risk management starts earlier.

Start with the business objective, not the policy.

ISO 31000 defines risk around the effect of uncertainty on objectives. That framing is useful because it forces the conversation back to what the organization is trying to accomplish. Growth creates risk. New technology creates risk. Hiring creates risk. Entering a new market creates risk. So does doing nothing.

Once the objectives are clear, the organization can identify the uncertainties that matter most and decide how those risks should be treated.

Not every risk belongs with the insurance carrier.

A strong risk strategy asks a series of deliberate questions:

• What should we avoid? Some activities create more downside than strategic value.
• What should we reduce? Controls, training, process design and accountability can lower frequency or severity.
• What should we retain? Some losses are predictable enough for the business to absorb efficiently.
• What should we transfer? Contracts and insurance can move portions of financial risk to other parties.
• What should we finance differently? Deductibles, retentions, captives and other structures may fit the organization's risk appetite and cash flow better than a traditional approach.

The point is not to make risk management complicated. It is to make the choices intentional.

Organize the risk so the business can act on it.

One practical way to structure the discussion is to separate risks into categories such as operational, strategic and hazard or insurable risk. Operational risks affect how the business executes. Strategic risks can influence enterprise value and the ability to achieve longer-term objectives. Hazard risks include exposures such as injury, property damage and liability.

The categories are less important than the discipline they create. When risks are organized, leadership can assign ownership, prioritize resources and understand which issues should be controlled operationally versus financed through insurance.

Risk management should create and protect value.

Modern risk-management frameworks increasingly connect risk decisions to value creation, business objectives and strategic decision-making. That is the conversation I want organizations to have with their advisors.

A capable risk consultant should help the business think through exposures before renewal, connect loss data to operations, identify control opportunities, challenge assumptions, and help determine which risks should be retained, reduced, transferred or financed.

The result is a more useful insurance conversation because the policy is now being built around a better understanding of the business.

The right team should make the organization better at risk.

Businesses should expect more than placement from the professionals around them. The right advisory team should improve the organization's ability to see risk earlier, make informed trade-offs and measure whether the strategy is working.

That may mean better claims outcomes. It may mean more stable budgeting, stronger carrier positioning, more resilient operations or greater confidence entering a new opportunity. The exact outcome will vary by business.

But the principle remains the same: manage the risk first. Then determine the most intelligent way to finance what remains.

Further reading: ISO 31000:2018 — Risk Management Guidelines and RIMS — Strategic & Enterprise Risk Management.