RISK IDENTIFICATION

Risks are events that could cause losses. After establishing the objectives of risk management and
defining the risk management policies, the next step in the process of managing risks, is to identify
risks. It becomes necessary to dig into the operations of the company and discover the risks to
which it is exposed.

Risk identification requires a thorough knowledge of the organization and its operations. The risk
manager needs a general knowledge of the goals, policies and functions of the organization. What it
does and where it does it. This knowledge can be gained through inspections, interviews with
appropriate persons within and without the organization, and by examination of internal records and
documents.

If potentially dangerous gaps in one’s knowledge are to be avoided, the first part of the risk
identification process must aim to discover every possible risk factor that may be associated with:
(a) The organizations own activities, including:
(i) The nature of the activities. That is what sort of business it is in. These activities may themselves
be risky or relatively safe. They may be the source of the risk.
(ii) The manner in which the organization undertakes its activities such as, the production methods
it employs, whether any work is subcontracted, who its suppliers and customers are, and so forth.
Sometimes the activity is itself relatively safe but the way it is being carried out could be very risky.
A loss can occur because of the way a relatively safe activity is carried out.
(iii) Where it carries out its activities, for example, servicing work done at customer’s premises, and
the final destination of its products. The location in which the activity is being carried out can itself
be a source of risk. Risk can emanate from the physical characteristics of the place in which the
activity is being carried out.

(b) The physical, legal, and political environment in which it operates. Here one is for example,
concerned with legal provisions relating to responsibilities for injuries arising from defective
products, the speed of the judicial processes, exposure to political risks, natural catastrophes, and so
forth.

It is not possible to generalize about the risks that a given organization will face. This is due to:-
(l) The differences in the kind operations in which the different organizations engage.
(ii) The different conditions and circumstances in which the organizations operate that give rise to
different risks.

The task of risk identification breaks down into two sub parts, namely:
(a) The perception of risk. That is the ability to perceive that there is an exposure.
(b) The identification of the operative cause or perils, coupled to the likely result.

Before considering the various techniques that may be employed in this risk identification process,
three points must be made.
(i) No single method is likely to reveal all the risks to which an organization is exposed, so that
several techniques must be employed.
(ii) Because of budget constraints and the fact that increasing effort is likely to yield diminishing
returns, a risk manager must select those methods which in his situation promise the best results.
(iii) Risk identification must be an on going process: organizations are dynamic not static beings,
and even the most stable and conservative organizations exist in a changing world.

The task of identifying risks can either start with the source of losses, or with the problems that can
cause losses.
APPROACHES IN RISK IDENTIFICATION
The following approaches can be used in risk identification.
a) Source analysis. Risk sources may be internal or external to the system that is the target of
risk management. Examples of risk sources are: stakeholders of a project, employees of a
company.
b) Problem analysis. Risks are related to threats. For example: the threat of losing money. The
threats may exist with various entities, most important with shareholders, customers and
legislative bodies such as the government.
c) Reports. A scan of various reports such as auditor’s reports, safety audit reports, loss
assessor’s reports at the time of claims for insurance, etc. will reveal the potential areas of
events that can result in financial loss to the business.
d) Inspections. A physical inspection by risk inspectors can also reveal potential losses and the
risks associated with them.
e) Financial statements. A careful study of the various items in the financial statements can
reveal potential risks. The main financial statements are the balance sheet and the income
statement. All the critical items in the financial statements are assessed for risks.

Common risk identification methods arc:

i. Objectives-based risk identification. Organizations and project teams have objectives. Any
event that may endanger achieving an objective partly or completely is identified as risk.
ii. Scenario-based risk identification. Different scenarios are created which may be the
alternative ways to achieve an objective, or an analysis of the interaction of forces in, for
example, a market or battle. Any event that triggers an undesired scenario alternative is
identified as risk.
iii. Taxonomy-based risk identification. In taxonomy-based risk identification is a breakdown
of possible risk sources. Based on the taxonomy and knowledge of best practices, a
questionnaire is compiled. The answers to the questions reveal risks.
iv. Common-risk Checking. In several industries, lists with known risks are available. Each
risk in the list can be checked for application to a particular situation.
v. Risk Charting. This method combines the above approaches by listing Resources of risk,
threats to those resources, modifying factors which may increase or reduce the risk and
Consequences it is wished to avoid.

Creating a matrix under these headings enables a variety of approaches. One can begin with
resources and consider the threats they are exposed to and the consequences of each. Alternatively
one can start with the threats and examine which resources they would affect, or one can begin with
the consequences and determine which combination of threats and resources would be involved to
bring them about.

RISK IDENTIFICATION TOOLS

To reduce the possibility of failure to discover important risks facing the firm, most risk managers
use some systematic approach to the problem of risk identification. Some of the more important
tools used in risk identification include the following:-

Financial Statements
Analysis of financial statements may be a useful tool in helping the risk manager to identify
systematically various company risks and to ensure that important items are not omitted.
(a) The Balance Sheet. This financial statement provides a summary of all the assets of a given
organization. These assets are subject to loss through particular risks. A detailed examination of
each asset item in the balance sheet can reveal information relating to the risks that could cause loss
or damage to the asset. Every liability item in the balance sheet could also expose the organization
to a particular risk. Examples of such an analysis include the following:

1. Cash. Management of company cash may involve risks of physical loss while cash is being taken
to the bank for deposit. The perils of forgery, theft, bank failure, employee infidelity, as well as
physical destruction represent sources of possible loss of cash. The management of petty cash as
well as bank deposits should be reviewed. Adequacy of safes and internal control procedures should
be examined. In one case a bookkeeper stole a large sum of money from a stamp fund over a period
of twenty years. The thefts were not detected by normal auditing procedures because each
individual theft was small.
2. Securities. Securities may be lost in much the same manner as cash. Some firms keep securities
on their premises instead of in banks. The risk manager should institute procedures to reduce the
risk of loss of securities after a thorough review of management systems over these assets. In one
case the risk manager arranged to have brokers deliver newly purchased securities directly to the
bank so as to avoid any risk of loss from internal corporate handling.
3. Accounts receivable. Company assets represented by accounts receivable are subject to loss by
many perils other than the obvious bad debt losses. Above-normal loss may stem from destruction
of the debtor's plant due to uninsured perils, death or disability of the debtor, dishonesty or business
incompetence of the debtor. Accounts may be uncollectible because the debtor has a legal complaint
against the seller stemming from misrepresentation of the goods, false advertising, or failure to
honor warranties. Finally, accounts may be concentrated among a small number of customers, thus
increasing the relative risk of loss due to any of the above perils which happen to any one account.
4. Inventories. The risk manager needs to examine detailed information on the types of inventories
used, where they are located when they are scheduled to be used, the ease and speed with which
alternative source of supply may be arranges, how hazardous inventories are used and stored, who
is responsible for the safety of each type of inventory, and the particular hazards that may
characterize each class of inventory—e.g., explosive or inflammable items.
5. Buildings and equipment. In risk management audits it is common to find that many building
and equipment exposures are either overlooked completely or carry duplicate insurance coverage. A
formal review of all such items carried as assets is necessary for sound risk management. Many of
the questions noted above for inventories should be asked for buildings and equipment as well. In
addition, buildings in the process of construction, leased equipment and buildings, elevators,
generators, boilers, and fuel tanks carry special hazards that usually require the attention of the risk
manager. Thus, the firm may wish to insure the builder’s risk and to ascertain the continued
maintenance of liability and workers’ compensation coverage by the builder. Obligations under
contracts may expose the firm to certain losses, for example, a lease or purchase agreement may
require assumption of liabilities for negligence of others.
6. Automobiles. Although autos and trucks are not usually identified separately on the balance
sheet, most firms have a large exposure to loss from this source which requires sound risk
management procedures. Questions are raised as-to who drives each car or truck, how distant the
operation is from headquarters, the extent to which employee-owned or hired cars are used in
company business, extent of liens, replacement costs, and so forth.
7.Miscellaneous assets. The risk manager must exercise considerable alertness to detect unusual
asset exposures. In one case the risk manager of a large farmers' cooperative realized that the firm
had an exposure of loss to catfish grown in farmers’ ponds under special contracts. He negotiated
insurance coverages against loss by water pollution, forest fire, and other perils. In another case the
risk manager of an electrical utility recognized that wafer behind a dam was in fact an asset subject
to loss, since dam breakage would result in loss of revenues from water- powered electric
generators. A decision was reached to insure the water against such loss.
8.Accounts or notes payable. An investigation of payables may reveal exposures to loss of concern
to the risk manager. For example, if payments must be made in foreign currency, a risk of loss exists
from increases in the market price of this currency at the time of payment of the account. As another
example, an investigation of a note payable or bonds may reveal that the creditor requires the firm
to maintain certain insurance on property purchased with the loan proceeds. Obviously, the risk
manager must investigate these matters and see that his firm is in compliance.
9. Financial solvency. The risk manager should be concerned with the ways in which the general
financial position of the firm affects pure risk management. Obviously, when there is a weak
statement (e.g., large liabilities in relation to assets), the firm’s credit at the time of a fire or other
catastrophe will be less than it might otherwise be. In some cases, the risk manager may work with
the treasurer to arrange standby bank credit as a substitute for insurance.

The Income Statement: Analysis of the income statement can also be of great help in the process
of risk identification. The following items are illustrative:
1. Sales. Analysis of the composition and type of sales revenues may answer questions about risks
of loss from foreign sales, sales on credit, dependence on a few customers, sales dependent on
franchises or licenses which could be lost by failure to meet certain requirements, product liability,
seasonality of sales, terms of sale, and so forth.
The risk manager should ask questions such as these: Do terms of sale require the firm to carry
transportation insurance? To what extent will sales be hurt if the manufacturing plant is shut down
wholly or partially by fire? How will sales be affected by a shutdown at a supplier’s or customer’s
plant?
To what extent will interruption of the business result in permanent loss of customers, and what
steps should be taken to minimize this loss?
2. Miscellaneous income. In some cases examination of miscellaneous sources of income may lead
to-discovery of certain risks. For example, the existence of rental income may point to real estate
the firm owns. Is this real estate properly protected? Income from a franchise might point to a
liability risk resulting from acts of the franchisee which could cause loss to the risk manager’s firm.
3. Expenses. An analysis of expense items can often reveal a host of potential risks. Direct labor
expense reflects the industrial accident exposure. Wage agreements will usually contain obligations
for insurance coverage on employees and other employee benefits.
Analysis of travel expenses can reveal the location and type of travel, including use of employee
cars and hired cars, employment of temporary help by salesmen, or use of watercraft or aircraft.
Rental expense can pinpoint the existence of risks in connection with leased property. Research and
development expense may reveal risks in areas outside the normal operations of the firm and should
be examined carefully by the risk manager. Finally, the risk manager can determine the extent of
fixed expenses, those which must be met even if the business is shut down by some fortuitous
event. In many cases the business interruption loss is greater than direct loss from perils such as
fire, explosion, or windstorm.

Insurance policy checklists.

Because insurance management is the older field, the technique of identifying insurable exposures
was already highly developed when the risk management movement began. Insurance companies
created insurance policy checklists, which identify the various risks for which they offered
insurance coverage.

They also developed extensive application forms for various types of insurance that elicited
information about hazards that need to be reflected in rating and underwriting decisions. Although
these tools naturally focused on the perils and hazards against which insurers offered protection,
they provided a base on which risk identification methods could be constructed.

Many of the tools that had been used by insurance agents and insurance managers to identify
insurable exposures were expanded and adapted to aid in the identification of other risks for which
the risk manager is responsible.
The simplest and most often used method is by the completion of a checklist of perils/hazards. The
checklist is used as an aide memoir where each peril or hazard is considered in relationship to the
business operations. For example, the peril of flood would lead to a consideration of the location of
the prime operations and the potential for inundation from the sea, flashfloods, storm-water
drainage backing up, burst river banks, etc. Similarly, in analysing fire and explosion risks,
consideration in respect of each of the buildings and sites owned and/or occupied would need to be
given to: potential sources of ignition or explosion from both inside and outside the premises, such
as electrical, chemical, heating and process hazards; the security of the premises against arson; the
occupation of adjoining and adjacent sites and premises: and those features which influence the
spread and so size of any loss, notably the type of construction - materials, number of storeys, fire
breaks, etc; - whether sprinklers, drenchers or other fire extinguishing or alarm equipment are
installed; the nature of the contents; distance from the nearest public fire brigade.

The form which a check list takes is largely a matter of personal preference, but it will need to
cover: all types of assets which arc owned or used by the organisation or for which it may lie
responsible. The list should cover not only obvious physical assets - its buildings, machinery,
stocks, vehicles, vessels, mineral deposits, pipelines, land and so forth - but also intangible assets
(such as patents, copyrights, royalties, designs and information systems}, and personnel. account
must also be taken of other facilities upon which the business is dependent (like public utility
supplies, road and rail access, and water from rivers and lakes), and the physical, natural, social,
economic, legal and political environments in which the organisation operates.

Sources of exposure to loss-producing events, Here one must not think solely in ''terms of insurable
perils: it is possible that the major threats to the business may arise from events for which insurance
is not readily available, such as industrial espionage. factors bearing on the size of losses that occur.
Examples have already been given above in relation to potential fire damage. To take one more
case, in considering products liability one would need to check the nature of the production process
(i.e. batch or continuous); the standard and frequency of quality control checks; the legal position in
the country of use regarding liability for defective products and any limits on awards for injury or
damage.

Once a check list has been compiled, the risk manager will probably be able to obtain many of the
answers without leaving his own office. There are many facts, however, that can only be established
by on-the-spot inspections, such as standards of maintenance and housekeeping, which have such
an important bearing on exposure to losses arising from fire, explosion, industrial accidents, and
product defects. The major weakness of the check list is that it draws attention only to the perils and
hazards listed, with the result that other potential sources of loss may be overlooked.

Risk analysis questionnaires

The checklist is therefore used in developing an orderly review of loss exposures. Insurers have
developed a lengthy survey form designed to obtain information on nearly every aspect of the
operations of any business firm, large or small. It is organized according to the major types of
insurance exposures, such as those relating to crime, transportation, physical loss to buildings and
contents, business interruption, motor vehicles, etc.

Questions are developed to elicit information needed to insure losses and are arranged according to
the type of insurance available. For example, in analyzing fire and explosion risks, consideration is
made in respect of each of the buildings and sites owned or occupied, with special attention to:
• Potential sources of ignition or explosion from both inside and outside the premises, such as
electrical, chemical, heating and process hazards.
• The security of the premises against arson.
• The occupation of adjoining and adjacent sites and premises.
 • Those features that influence the spread and so the size of any loss, such as the type of
construction – materials, number of storey, fire breaks, and whether sprinklers, drenchers, or
other fire extinguishing or alarm equipment are installed. The nature of the contents, the
distances from the nearest public fire brigade.

The form that a checklist will take is largely a matter of personal preference, but it will it will to
cover: All types of assets that are owned or used by the organization or for which it may be
responsible. The list should cover not only the obvious physical assets, but also the intangible assets
such as patents, copyrights, royalties, designs, information systems, and key personnel. Account
must also be taken of other facilities upon which the business is dependent like public utility
supplies, road and rail access, and water from rivers and lakes, etc. account must also be taken of
the physical, natural, economic, legal and political environments in which the organization operates.

Sources of exposures to loss-producing events. Here one must not think of only insurable perils
because it is possible that the major threats to the business may arise from events for which
insurance is not readily available, such as industrial espionage.

Factors bearing on the size of losses that occur such as the nature of the production process, the
standard and frequency of quality control checks, the legal position in the country of use regarding
liability for defective products and any limits on awards for injury or damage. A checklist will
provide information on the specific locations of property, special perils that exist, as well as the
nature and extent of insurance.

Once an appropriate checklist has been developed, the risk manager may obtain many of the
answers without leaving his office. But the risk manager should attempt to identify, as closely as he
can, exactly what loss the firm would suffer if the property were destroyed. How it might be
destroyed, what public or employee liability the firm faces in its operations, and how the firm
proposes to deal with the situation in each case. In this way the chance of overlooking important
exposures is reduced, and the chances of insuring values that are inconsequential nature is also
reduced.

There are many facts that the risk manager can establish by on the spot- inspections, such as
standards of maintenance and housekeeping, which have such an important bearing on the exposure
of losses arising from fire, explosion, industrial accidents, and product defects. The major weakness
of the checklist is that it draws attention only to the perils and hazards listed, with the result that
other potential sources of loss may be overlooked.

Many risk exposures that a risk manager must deal with may be unique to the firm. Therefore the
checklist employed in a given case must be tailored specially for a given firm, after careful
evaluation of the exposures faced by the firm. Once prepared, it must be updated at least annually.
An advantage of the checklist is that it warns the management of the firm to study loss exposures
and to make decisions on matters formerly neglected.

Threat analysis
An alternative approach to the checklist is to compile a list of the threats to the business. Take, for
example, the threats of denying access to the place of business. Denial of access to premises can
arise from many causes, for example quarantine regulations following epidemic, collapse of nearby
buildings blocking the road, burst water/gas mains preventing access, strike picketing, government
order (for example, a prohibition order issued by the Health and Safety Executive), and so on. The
threats to the business in terms of both the severity and duration of the interruption probably would
vary as shown.
Organization charts
Organisation charts can be a useful starting point in that they may reveal various facts about:
The nature and extent of the organisation's activities. For example, a large conglomerate may be
split into subsidiary companies specialising according to types of product, and possibly with further
divisions into home and overseas companies; Inter-relationships and inter-dependencies between
various parts of the organization. The breakdown of the organisation into individual profit and cost
centres, which are facts to be considered when risk financing decisions have to be taken; the people
with the authority to participate in making and implementing risk-handling decisions, and those
who may be able to help in providing technical and oilier information which the risk manager may
require; Any organisational weaknesses which may exacerbate risk situations; for example, the
Flixdorouph inquiry revealed that there had been no qualified mechanical engineer on the site to
supervise maintenance work.

Accounting records
The records maintained primarily for accounting purposes are not only another source of qualitative
information, but also provide, for example: some of the data required for the valuation of buildings,
plant, stock and other assets; data for quantifying inter -dependencies between different parts of an
organisation, and its dependency upon particular suppliers and customers: details of an
organisation's financing arrangements and its financial position; past expenditure on handling risks
and the costs of losses that have occurred.

Published accounts are of limited value, though not without their uses. Most large companies go
beyond the minimum requirements of the Companies Acts in publishing details of their activities,
and provide a breakdown of turnover, and possibly earnings, among their various product and
geographical divisions.

Also, the accompanying chairman's report may provide further insight into the company's activities
and plans for the future. Far more revealing, however, arc internal accounts. In particular, nominal
accounts and cost/profit centre accounts should repay careful study. The nominal ledger and cost
accounting code designations should give an indication of not only the type(s) of business
undertaken, including details of suppliers, .subcontractors and customers, hut also of methods of
financing the business, likely cash constraints, and the ability to withstand unplanned losses. For
example, the examination of the books of a wholesale and retail business wild a number of sales
outlets probably would disclose: any vulnerability to sole sources of supplies; indebtedness to major
suppliers; the breakdown of turnover and earnings between the various outlets, types of goods and
customers; stock turnover rates; the fixed clement of total costs; and its ability to earn revenue on a
day-to-day basis. Such information would give some indication of the susceptibility of the business
to bankruptcy in the event of any interruption from such causes as damage to any of its own or
suppliers' premises, inclement weather or any obstruction which prevents customers from paining
access to its premises.

Any activity that involves a financial transaction will appear somewhere in the accounting records.
For example, from purchases and sales accounts it is possible to obtain details of suppliers,
customers, and analyses of purchases and sales of various materials and products in order to
establish the extent of dependence upon any one supplier or customer. Likewise, rent items will
reveal whether any buildings, plants, vehicles or other equipment arc leased.

Other records
Organisations keep many other records that can reveal facts about exposure to risk; for example:
leases specify who is responsible for repairing damaged properly; construction contracts and sub-
contracts assign responsibilities for damage or injury to persons arising out of the contract work;
purchasing and sales conditions may deal with questions of liability for damage or injury caused by
defective products: After-sales servicing records may point to potentially dangerous defects in
products.

The clearest evidence of what may happen is that which is provided by records of past losses,
including details of insurance claims. Such records not only provide evidence of potential sources
of loss but also of loss probabilities and severities, so that they are also of considerable value for
risk measurement purposes.

What organisation charts, accounts and records do not reveal are work processes find the physical
layout of plants; to obtain that information one can proceed to the examination of flow charts.

Flow charts
Flow charts show the flows of materials, parts, and products from suppliers, through the various
production stages and on to customers. By pinpointing potential bottlenecks, they reveal the
vulnerability of the business to risk, particularly when such diagrams are then translated into layout
drawings where potential hazards can be plotted against bottleneck exposures.

A simple flow chart is not complete, however, unless some quantitative throughput or value-added
dimension is included. For example, it is possible to see from figure 4/1 dial most of the parts
produced have to be painted, and that the finished parts store receives all of the parts before passing
them on for final assembly. However, it is not clear what proportion of total production has to be
painted, nor where the division between the wood machining and metal machining operations is in
relation lo total production. Besides illustrating the production flows, it also shows the values
transferred from one stage to another, and the values added (that is, labour, materials, and overhead
costs) at each singe. Amongst oilier things, the following points can be ascertained from the
diagram: plastic parts are obtained from just one source, and possibly certain of the metal parts and
sundry items may be in the same position; up to the machining and heal treatment stages,
woodworking accounts for almost 45% of production against 55% from metal working; clearly the
paint shop is critical to production, only a negligible part of the metals parts not being painted; a
third of the output is sold to one customer.

The information obtained from, and the points raised by, the diagram can then form the basis of an
exposure investigation covering such question as:
• How dependent is the manufacture of wooden toys upon metal parts produced in the
factory?
• If for nay reason there were a prolonged stoppage of production in the press shop, could
metal parts for the wooden toys be bought in?
• Could plastic parts – and any other parts for which there may be a sole supplier – be
purchased from any other producer?
• Where are patterns and moulds stored?
• What is the source of power?
• How soon could alternative warehouse facilities be obtained in the event of the loss of the
finished goods store?

Event analysis
'Event' analysis is a technique for considering likely events which could cause problems and then
investigating causes and effects. The varying impact between cause and effect is a function of the
'event'; for example, consider the event as failure of boiler services. There are many potential
causes, ranging from that of explosion, to burst water tube, to failure of the priming pump. The
effect of these three causes giving rise to the same event would be quite different. An explosion
could lead lo major interruption of processes, the destruction of property, and loss of life, including
potential third partly liability. On the other hand a burst tube may result in only minor interruption,
with no property damage or personal injuries. At the other end of the spectrum, the failure of the
water priming pump may have no effect at all if a standby pump can be brought into service
immediately.