Risk, safety, and operations managers talk about risk resiliency in terms of bouncing back from a loss but that is not “resiliency,” that is “recovery.” Resiliency is understanding your risks before they are realized and building plans to address them. It is regularly reviewing the plans as risks have a habit of mutating and innovative solutions are always being created.
There are only four risk strategies:
- Risk Acceptance
- Risk Avoidance
- Risk Mitigation
- Risk Transfer
Yet, when you realize that there are only three prime colors (red, yellow, and blue), and that all the great visual art that has been created by blending these three colors, you can start to appreciate the complexity of mixing the four risk strategies.
Risk Acceptance
As a starting point, you have risk acceptance. When you get out of bed in the morning, you can step down, roll your ankle, and land up in the hospital. Nonetheless, we accept the risk because we realize that getting out of bed is necessary to perform our daily tasks.
In the world of assisted living, we accept thousands of risks per day, from having visitors enter the facility, to food preparation, to storing and dispensing medication, to housekeeping and providing resident activities. At a higher level of management, licensing and finances are the ultimate risks.
Accepting risk can be a stand-alone strategy, just as an artist may paint in a single hue of blue, but skilled risk managers do not rely on one strategy. Accepting the risk is based on a number of calculations. First you need to know the extent of the risk you are accepting. Once you have identified the risk, you need to determine whether there are parts of the risk that you can avoid. By example, you obviously must feed your residents; that is a risk you accept. You might decide to avoid certain risks such as ensuring that the food does not have nuts. You may look to mitigate the risk by providing training for your food staff. You may look to transfer the risk by bringing in a food service. Ultimately, the core activity is a risk you accept.
Risk Avoidance
The heart of your facility is providing medical care. Residents, however, have a wide array of health issues that are beyond the scope and expertise of the facility. Most facilities have physical therapy services onsite. Some facilities have x-ray equipment onsite, or in house emergency transportation services while others do not have the risk appetite for the risks associated with the additional services. Higher risk acceptance may lead to higher financial returns--or to financial loss. If your risk appetite is too limited, your market competitiveness may also be viewed as too limited. If your risk appetite is too high, you could risk financial stability. If you have ever said or heard someone else say “that is not part of our core mission,” you have witnessed risk avoidance.
Risk Mitigation
This is the most powerful risk management tool available. Its power is directly proportionate to the degree of understanding the risk under consideration and understanding all options for risk management. In the aftermath of September 11, risk avoidance would have dictated that airlines stopped flying. Risk acceptance would have been to say “that’s the risk associated with air travel.” Enter risk mitigation.
The airline industry and the world accepted that air travel must continue. Risk mitigation strategies were put into place including increasing pre-boarding security, enhanced luggage and package screening, and better security on cockpit doors. In the senior care industry, lifting residents is an essential activity. And it is also a leading cause of both employee and resident injuries. Mitigation strategies include an array of hydraulic and electric lifts, and transportation equipment as well as staff training. Some solutions carry large price tags. Risk mitigation includes understanding and leveraging financial opportunities and multilayered approaches.
Risk Transfer
Most operation managers and too many risk managers see risk transfer as a euphemism for “insurance.” Risk transfer is so much more. Transferring risk is the act of having someone else become responsible for the risk. You pay someone to do an act that you do not want to do or lack the skills to do. For example, you lack the skill to take down the old dead tree that is threatening to fall on your house, so you pay someone else to do it. You lack the skills and equipment to care for an aging family member properly, so you pay someone else to do it. The key is that you pay to transfer the risk.
When you have a vendor replace the roof or a toilet at your facility, who is responsible if the roofer falls off the roof or drops something that hits someone? Who is responsible if the roofer fails to do the job well causing the roof to leak or damages the building while doing the work? What happens if the plumber does a poor job and the new toilet on the second floor leaks causing the ceiling on the first floor to collapse or the water soaks into the walls creating a mold situation? Yes, you assume the vendor is responsible, but are they? It depends on the language in the contract. What if the plumber who charged you $500 to replace the toilet has language in the estimate that says damages are limited to the amount of the job?
Risk transfer starts with the contract. As an attorney, I learned that lawyers and risk managers see contracts differently. It is critical to review contracts, including purchase orders, to ensure that you are certain as to how much risk you are accepting and how much you are transferring.
Finally, we get to the issue of insurance. Who will obtain the insurance to make sure that the medical waste is handled and disposed of properly? Do you need to be named on the vendor’s insurance policy as an Additional Insured? And what is the correct insurance policy for the removal and disposal of medical waste? Is it commercial general liability (CGL)? Environmental waste? Errors & Omissions?
Insurance is the last consideration because it is supposed to be a safety net. Unfortunately, the insurance industry has convinced too many attorneys, operations managers, and risk managers to see insurance as a hammock. There has even been a spate of insurance commercials that use a hammock to communicate the message. Insurance is supposed to be for those risks that you either cannot anticipate or that you cannot afford to address any other way.
For most people, insurance brings to mind auto insurance and health insurance. Both are consumer products that are heavily regulated by the state. Your car insurance may have 10 decisions such as the amount of coverage, a deductible, whether you want collision coverage or not, replacement value versus present value and not too much more. Your health insurance is equally as easy. And yet, many of us labor over those simple options.
Business insurance is far more complicated. Consider a fire that destroys your kitchen facility. Unless you negotiated your property damage coverage properly, you may only receive the depreciated value of that six-year-old oven even though you have to buy a new one. How will you feed the residents until the kitchen is back up and running? That is not part of a standard property insurance policy. You need business interruption coverage. As for the business interruption policy, there are interesting deductibles associated with them. The policy may not cover the first 10 days of interruption. How do you pay for the food service during that time? What are the limits on an interruption period? Does business interruption coverage apply to the loss of computer damage caused by the fire? How about a cyberattack? And beyond all this, if the officers and directors get sued due to allegations that the fire was caused by their poor decisions regarding building maintenance or that a resident was harmed by a medical malpractice issue, does the Errors & Omissions policy protect the directors and officers or do they need a separate Directors & Officers policy?
Insurance is the last consideration because insurance companies set your rates on your loss experience (the frequency and severity of your losses), and your processes and procedures. The safer your operation, the better your rates.
Risk resiliency is partially the ability to recover from a loss, but if that is the limit of your interest, that is called “loss recovery.” An Errors & Omissions carrier may talk about risk resiliency, but it may be solely focused on patient treatment. A workers’ compensation risk manager, unaware of federal and state medical provider regulations, may recommend increasing worker safety by (unlawfully) increasing patient medication or restraints without understanding risk resiliency’s interconnectivity to all aspects of the business operation.
Risk resiliency can be a powerful tool for management, especially if the resiliency is formulated using the four risk strategies in a blend to meet the needs of your facility.
Jeff Marshall is a risk and claims management consultant focusing on nursing homes and assisted living facilities. He can be reached at IManageRisk4U@gmail.com.