Controls & Insurance Mitigation

Controls and insurance play a significant part in reducing the likelihood of a risk event or the amount of loss should one occur. They also have a material cost. One of the drivers of measuring risk is to support a more rational analysis of the costs and benefits of controls and insurance.

At the outset clear thinking is required. Is the "extreme loss" scenario and its economic impact and likelihood being estimated before or after the effects of controls. In most cases the scenario will be based on experience or loss data taht occurred with some level of control in place. In such cases it is important to avoid double counting by reducing the assessed impact further! But when there are new well-defined controls in place that haven't been assumed, it is equally important to ensure that the advantages of these controls are also captured as an offset to the assessed risk.

The mathematics of the mitigation offered by controls is not straightforward. A distinction needs to be made between those controls that reduce the likelihood of occurrence (such as segregation of duties) and those that minimise the impact should the event occur (such as business continuity planning). These need to be adjusted for separately. The precise mathematics varies with the underlying risk distributions.

Insurance is also clearly a mitigant. Here judgement is required to assess how much of the risk's economic impact is in fact covered under the insurance policy. Loss of future business through brand damage is rarely insurable.

The mathematics of the insurance mitigation is also not straightforward. As well as the effects of cover limits and deductibles/excesses, there is also the judgement of whether the assessed relevance of the insurance (say x%) means that insurance applies x% of the time or covers all the incidents but only to x% of the economic damage. This distinction changes the shape of the residual risk distribution.

The result after mitigation for controls and insurance becomes the final or residual risk distribution for the particular risk for the organisation.

To Segment risk distributions

Last updated:16/5/07

Jump to... Top | Risk Management Home | Austega Home