Risk Management Techniques

Decisions must be made in risk management: whether to retain or insure a particular risk; what loss-control projects should be undertaken; what is the most cost-effective means of reducing risk. To decide intelligently, each risk must be identified and evaluated as to its frequency and severity. However, the frequency and severity of losses can only be estimated, which is why statistical methods are extensively used in risk management, including decision theory.

Decision Theory in Risk Management

There are 2 branches of decision theory. Descriptive decision theory uses surveys and experimentation to study how people actually arrive at decisions. On the other hand, prescriptive decision theory, which is used in insurance, uses quantitative statistical methods to find optimal solutions based on preferences of the decision-maker. An outcome has greater utility if it is more desirable by the decision-maker. Decision theory seeks to maximize expected utility based on the initial conditions relevant to the decision, preferences of the decision-maker, finite possible outcomes, and the probability of each outcome.

Possible outcomes are called states of nature. There are 3 states of nature: decision-making under certainty, decision-making under risk, and decision-making under uncertainty. Decision-making under certainty is based on inputs and outcome that are fairly certain. Decision-making under risk involves situations where the outcomes are certain but the probabilities are not. Decision-making under uncertainty occurs when neither outcomes or their probabilities are known. Using utility theory in deciding on how to manage risk depends on the individual's preferences (utility) for different states of uncertainty. An individual's preference for different states of uncertainty equals their utility function.

Methods of probability are used to calculate the probability of each outcome, resulting in the payoff matrix. The decision yielding the highest expected utility will be selected when maximization is desired; when minimization is desired, the lowest expected utility will be chosen. In insurance, the decision yielding the lowest expected loss of utility is selected.

Cost-Benefit Analysis

Cost-benefit analysis is used extensively by every business to ensure that an additional dollar spent will yield at least an additional dollar of benefit. In other words, the marginal cost should never exceed its marginal value. However, costs are often easier to determine than benefits, since the benefits must be projected. Here, decision theory estimates expected value, based on the payoff of each outcome multiplied by the probability that it will occur. Cost-benefit analysis is most useful when costs are known and benefits can be estimated reasonably well.

Expected Value

In insurance, expected value equals the amount of loss associated with an outcome multiplied by the probability of an outcome. So if there is a 1% chance of losing $1 million in 1 year, and the insurance premium to protect against that loss costs $8000 annually, then the decision as to whether it to insure the loss or to retain it Using expected value is calculated thus:

As can be seen in the above table, the expected value of retaining the risk is -$10,000, which is $2000 more than insuring the risk. Therefore, it would be more cost-effective to buy insurance.

The problem with using expected value in insurance decisions is that if expected value is accurately calculable, then the decision will always be to retain risk rather than transfer it to an insurance company. Why? Because the insurance company will also calculate the expected value, then add an additional cost for unexpected losses, profit, and to operate the company, so, theoretically at least, the insurance company will always charge more than the expected value. So why buy insurance?

Minimax Regret Strategy

A minimax regret strategy seeks to minimize the maximum, which, in insurance, is to minimize the maximum loss or regret. Hence, it can also be called a minimax loss strategy, since loss is usually regrettable. Pascal's Wager is a minimax strategy. Based on the beliefs of his day, Pascal reasoned that if the existence of God is unknown, then how should someone conduct their own life? If God does not exist, then it does not matter whether one is good or evil. On the other hand, if God does exist, then being evil can lead to eternal damnation, a fate so horrible, but no one should even take the small chance that it may be true. Pascal concluded that eternal damnation would be such a great punishment, that it would be better to avoid it no matter how low the probability. On the other hand, the same decision could be made on a maximin strategy, where it could be argued that the reward in heaven would be so great, that it would be better to lead the good life, and if God or heaven turned out not to exist, then little is lost by leading the good life. Indeed, many would argue that the good life would be a reward in itself, but that is a digression.

There is a maximum loss that anyone or business could endure and still survive. That is why people and businesses and other organizations buy insurance, because few entities can afford to retain all risk. Buying insurance is trading a certain small loss, the premium, for an uncertain large loss. By buying insurance, the maximum loss, up to the insured amount, is the premium paid, whereas the maximum loss without insurance is the amount insured. The minimax regret strategy can be summarized with the following payoff matrix, based on the same information used in the above table:

With a minimax strategy, the main concern is determining the maximum potential loss rather than finding the greatest expected value, which is better at determining whether insurance should be purchased for the risk or where the risk should be retained.

Rules of Risk Management

There are 3 general rules to determine how risk should be managed:

1. ensure that maximum losses are affordable
2. consider the likelihood of losses
3. ensure that the risk transferred is worth the premium paid

If the risk is transferable at an affordable price and the potential loss severe, then the risk should be transferred. If the risk cannot be transferred, then it should be avoided or the likelihood of the loss should be reduced as much as possible. Of course, some people cannot afford the premiums, so they retain the risk regardless of how great the possible loss. For instance, unaffordable premiums are the main reason why many people did not carry health insurance, even though it could result in catastrophic losses.

The probability of losses also determines whether risk should be retained or transferred, or even if it could be transferred. Insurance is generally used to protect against large losses that are unlikely to happen. Frequent losses usually must be retained, mitigated, or avoided, because insurance companies generally will not ensure likely losses, because it violates the basic insurance principle that the infrequent large losses of the few are covered by the small premiums of the many. Additionally, insurance companies would have to charge higher premiums because they would not be able to earn money from investments if they are continually paying for frequent losses. So even if an insurance company to cover a frequent loss, the premiums charged per unit of time would nearly equal the total losses during that period.

Which leads to the 3^rd principle of risk management: do not pay premiums if their total cost is as nearly as much or even exceeding the maximum loss. A common example of this is when people continue to pay for collision and comprehensive coverage on their auto insurance, even after the value of the covered vehicle has declined substantially, to where they are paying hundreds of dollars annually to receive a few thousand dollars if their vehicles totaled, since the maximum payout from their insurance would equal the maximum value of the vehicle minus the deductible.

Manage Risk Based on Frequency and Severity

The above discussion shows various methods that can be used to decide how a particular risk should be managed. A simplified procedure of risk management can be illustrated by using a simple payoff matrix. The 2 inputs of any risk that are usually used to determine how that risk will be managed are its frequency and severity. A simple risk management matrix can be designed by only considering the high and low of each variable, which will then determine how the risk will be managed, as shown in the following table:

Of course, a large organization would use much more detailed information and different types of algorithms to find the optimal risk management solution, using computers to store the information and the algorithms.

Financial Analysis in Risk Management Decision-Making

The above discussion detailed strategies that can be used in risk management if the severity and frequency of potential losses is known or can be estimated. Additionally, it costs money to institute loss controls or other methods of limiting losses. However, because money has time value, it is more accurate to use the present value either of potential losses or of the cost of projects to arrive at better decisions. The present value is calculated by discounting a future value by the appropriate interest rate, which may be the interest rate that the company pays for loans, or some other relevant rate. Present value can most easily be illustrated with a simple bank deposit. If $100 is placed in an account earning 5% interest, then at the end of one year, the account will have $105, which is its future value. The present value of that $105 discounted by 5% = the initial deposit of $100. Present value can be used to analyze which insurance coverage to purchase, based on the size of the deductible, coverage amount and the expected number and size of losses for the insured. By accounting for these variables, the insured can minimize the present value of its cash outflows.

Capital budgeting is to determine which capital investment projects a company should pursue. In risk management, capital budgeting is used to decide on loss control investments. A common method in capital budgeting is to use the net present value of the project, equal to the sum of the present values of the future cash inflows minus the cost of cash outflows, including the cost of the project. If the net present value is positive, meaning that the future cash flows to the company exceed the future cash outflows, and the project is desirable; if net present value is negative, and the project should be avoided. For instance, should a warehouse use surveillance equipment or guards to reduce losses? If the net present value of using surveillance equipment is positive — meaning that the cost, maintenance, and operation of the equipment is less than the amount saved through the reduction of projected losses — and exceeds the net present value of using guards, then the surveillance equipment will be the cost-effective solution.

Another technique of financial analysis commonly used in financial risk management is value at risk (VaR), which is the worst probable loss likely to occur in a specified duration, such as 1 day, 1 month, or 1 year, under regular market conditions at some level of statistical confidence, usually 95% or higher. The main disadvantage of VaR is that the results highly depend on the model chosen and may not account for extreme circumstances that could lead to larger than expected losses.

Risk Management Information Systems

A risk management information system (RMIS) is a computerized database storing accurate and accessible risk management data and algorithms that will allow the risk manager to easily calculate various methods to reduce losses, to calculate the cost of projects, calculate value at risk, etc. An RMIS can store the properties of a corporation and the characteristics of those properties, including location, occupancy, construction, loss exposure, and protection, property insurance policies, coverage terms, log records, fleet vehicles logs, including purchase dates, claims history, and maintenance records. The database can also store claims, with current records on the individual status of the claims, such as whether they are pending, filed, in litigation, being appealed, or closed, historic claims, exposure basis, such as payroll, number of fleet vehicles, and the number of employees, and liability insurance coverages and coverage terms. Workers compensation claims can also be stored and analyzed, including the number of claims by geographic region, type of injury or body part, job classification, and employee identification number. A higher number of claims in one geographic area may indicate that safety is not being diligently practiced or that the safety guidelines are inadequate at those corporate locations. If many of the claims are attributed to a few employees, then that may indicate fraud or if they work similar jobs, it may indicate that greater safety measures need to be taken. Many large businesses self-insure for workers compensation, but if the business would decide to buy insurance, then insurance companies will want to see past performance, which an RIMS will accurately show.

Risk management procedures can also be stored on an intranet that managers and employees can access for specific information in their area. The website can also store forms needed to be signed in the course of business.