Contract Risk Assessment

Road Map12/1/2004

What is Risk Assessment?

A strategic approach to planning, at all levels and across all functions of an organization, that identifies exposures of activities and assists in making risk adjusted business decisions every day.

GET RID OF SILOS

Where Does Risk Assessment, Insurance, Bonding and

Indemnification Fit in the Contracting Process?

• At the inception of an idea, your agency should perform a risk assessment of the activity.

Use The Contract Documents As Your First Tools

• A Request for Information (RFI) can be very useful in determining the amounts of insurance your targeted contractors carry and how much the coverage costs them.

• An Invitation to Bid (ITB) and a Request for Proposal (RFP) are commonly used in the bidding process.

• At the beginning of the process, use the Risk Assessment to decide types and amounts of Insurance and Bonding that should be built into the bid document.

Don’t Forget About History!• Has your agency, oversight

agency, or peers procured this type of service or product before?

– Review solicitation or contract files.

– Review past practice.

– Ask the old timers.

– Create your own historical reference material for future use.

Call Your Agency Area Experts

Who Are the Agency Area Experts?• Your Manager• Program staff and managers

What is the specific activity?

What is Your Agency’s Appetite

for Risk?

What is a Risk Appetite?• Risk appetite is the degree of

uncertainty an agency is willing to accept to reach its goals.

• Risk appetite is a key factor in evaluating strategic options.

• Risk Assessment helps management consider risk appetite when setting goals that align with overall agency strategy, and managing risks related to that strategy.

Work with your agency’s management to decide:• What is your agency’s risk

tolerance?

• How much or what are you willing to risk to accomplish the mission or activity?

• How much can your agency afford to lose in any one occurrence or in the aggregate?

What Does Your Agency Do?

(Mission, Goals, Objectives)

Does the activity fit the Agency

mission, goals, objectives?

NoIf the answer =

Take to management for consideration

Management decides yes =

Move on

Management decides no =

Stop

If the answer = Yes

What could go wrong? Who could be harmed?

Make a list - write it down. These are your loss exposures.

(See Risk Identification & Evaluation)

What is Risk?

The danger or probability of loss.

Loss Exposure

Possibility of financial loss as the result of a particular peril

striking a thing of value.

Components of a Loss Exposure

The type of value exposed to loss.

The peril that causes the loss. The extent of the potential

financial consequences of that loss.

Values Exposed to Loss

• People

• Property

• Freedom from Liability

(Alleged Wrongdoing)

Perils Causing Loss

Natural Perils:

Human Perils:

Economic Perils:

Potential Financial Consequences

Make sure that you don’t give away the farm!

THINK ABOUT WHAT CAN GO

Wrong!

Why is this important?

An unrecognized loss exposure cannot, except by chance, be effectively managed.

State of Oregon

Methods Of Identifying Exposures:

• Previous contracts of similar type and their outcomes.

• Standardized surveys/questionnaires• Financial statements• Records and files• Loss Reports/Claims• Flowcharts• Personal inspections• Experts

What questions should we ask?

What is the scope of the contracted service or activity?• What is the overall service

or activity?

• What functions are necessary to deliver or accomplish this service or activity?

• When and where will the service or activity take place(s)?

• Who will be performing the service or activity?

• Will the contractor interact with others, i.e., public, staff, etc?

• Will there be any hazardous materials involved?

What are the potential loss exposures or risks associated with the contracted service or

activity?

What could happen?

• What could go wrong? Who could be harmed?

• Could there be bodily injury, property damage or other liability exposures caused by this service or activity?

• Is there any impact on workload? Could there be any damage to our systems?

Remember…..

• Consider the values exposed to loss: People, Property, Freedom from Liability.

• Consider the perils that could cause loss: Natural, Human, Economic.

Rate the Risks of Loss and Weigh the Value of

Opportunities

Rate the severity of the risk of each potential loss exposure. How bad can each loss be?

What could it cost?

Rating Severity Description (Risk)

1 Insignificant No injuries; low financial loss

2 Minor First aide treatment; minor financial loss

3 Moderate Injuries; loss of operations; moderate financial loss

4 Major Extensive injuries; loss of operations; major financial loss

5 Critical Death; major loss of operations; huge financial loss

Rating the Severity of Loss Exposures

What is the likelihood that each of these potential loss

exposures will happen?

Rating the Likelihood of Occurrence

Rating Descriptor Likelihood

(Probability)

Description

1 Rare 1 – 10% May occur only in exceptional circumstances

2 Unlikely 11 – 25% Could occur at some time

3 Possible 26 – 75% Might occur at some time

4 Likely 76 – 90% Will probably occur in most circumstances

5 Almost Certain

91 – 100% Is expected to occur in most circumstances

INSIGNIFICANT MINOR MODERATE MAJOR CRITICAL

ALMOST CERTAIN

M H E E E

LIKELY M M H E E

POSSIBLE L M H E E

UNLIKELY L L M H E

RARE L L M H H

Determine the risk rating/level of risk for each potential loss exposure.

Severity

Likelih

oo

d

Risk Rating (RR) = Level Of Risk

• E = Extreme Risk - involve senior management immediately, emergency situation, consider not doing the activity.

• H = High Risk - management attention required for business and policy decisions, risk control, insurance types and limits, etc.

• M = Moderate Risk - management should be kept informed of risk control, insurance types and limits, etc.

• L = Low Risk - manage by routine procedures, insurance types and limits could be flexible.

Now That You Have Rated The Risks Of Loss.…

Think About The Value Of OPPORTUNITIES

EXPLOITING OPPORTUNITIES

• What opportunities will be missed if the activity is not done?

• What is the upside and downside of these opportunities?

• By considering the full range of potential events—rather than just risks—the risk assessment process ensures that management can identify and take advantage of positive events quickly and efficiently.

Weighing the Value of OpportunitiesRating Value Description (Opportunity)

1 Insignificant Minor budgetary, funding, or resource gain; Little or no gain in public and/or client relations.

2 Minor Low budgetary, funding, or resource gain; Some gain in public and/or client relations.

3 Moderate Moderate budgetary, funding, or resource gain; Adequate public and/or client relations.

4 Major Major budgetary, funding, or resource gain; Good public and/or client relations.

5 Critical Huge budgetary, funding, or resource gain; Excellent public and/or client relations.

If RR = E or H

Is the Activity

Necessary?

If the Answer = No

Management Business Decision

No = StopManagement Decides Yes = Move On

For Each Thing That Could Go Wrong…

What Tools Are Available To Manage the Risks?

Statutory Immunities:Research Statutes

No = Move on to Loss Prevention/Risk

Control Measures

Do any immunities apply to the

activity?

Statutory Immunities

If the Answer is: Yes

What are the limitations and/ or exclusions?

Do you have a legal opinion on statutory immunities?

No = Management business decision on legal opinion

Yes = Move on to Loss Prevention/Risk Control

Measures

Loss Prevention/Risk Control Measures

See Risk Control Methods and Measures

Avoid the risk altogether. Prevent the frequency of loss. Reduce the severity or cost of loss. Segregate to prevent one event

from causing loss to the whole. Contractually transfer the risk.

What are Loss Prevention/Risk Control Methods?

Avoid Exposure

Entirely eliminates any possibility of loss. It is achieved either by abandoning or never undertaking an activity or an asset.

Loss PreventionReduces the frequency or number of

losses.

Loss ReductionLowers the severity or cost of a loss.

Segregate Your Losses

Arrange your agency’s activities and assets to prevent one event from causing loss to the

whole.

- two methods -

SeparationSeparate activities and assets among

several locations.

DuplicationProvide a duplicate or stand by for use in

case assets or activities suffer a loss.

Contractual Transfer of Risk

GOAL:

To insure that a contractor is responsible for claims arising

out of his or her acts, and has some way to pay for these losses.

Principle #1

Contractually transfer the risk to the contractor.

Indemnity is only as good as the assets or insurance coverage backing it up.

Ask for appropriate insurance and bonds to cover the risk.

Principle #2Do not indemnify an independent

contractor.The state is subject to the Oregon Tort

Claims Act (OTCA). OTCA limits state liability.

Contractors have unlimited liability.Indemnifying a contractor may make the

state subject to unlimited liability.

Principle #3• Don’t rely on insurance or bonds to

cover all of the risks associated with your contract.

• Many times outcome based statements of work, contract administration, and supervision are far better risk control measures to protect the state’s interests than insurance or bonds.

• Insurance and bonds should be thought of as the safety net that catches us when everything else goes wrong.

Develop Risk Control Measures Specific to the Situation

•Personal protective equipment.

•Housekeeping, repair, and maintenance.

•Inspections.

•Tools and equipment.

•Policies, procedures, and process.

•Supervision.

•Contract Management and Administration.

Which measures best fit the mission,

activity, and RR?

How can the measures be implemented

? Who will implement?

Who will be responsible for making

sure the measures

are followed?

Who will be responsible for ongoing monitoring?

Did you choose Contractual Transfer?

Yes = Move on to select appropriate Contractual

Transfer - Contract Clauses

No = Go to State’s Self – Insurance or

Commercial Insurance

Contractual Transfer – Contract Clauses

• Independent Contractor

• Indemnity/Hold Harmless

• Insurance and Bonds

• Warranties

Will you use a

contract?

Will you use a

template?

Will you require

insurance or

bonds?

No = How will the state be protected?

Re-evaluate the situation. Figure out how the state will be

protected. Talk to management.

Yes = Move on to Contractual Transfer

Independent Contractor

We use the Independent Contractor Clause to support our assertion that the contractor is not our agent.

What Does “Indemnify” Mean in a Contract?

It is an agreement to pay or reimburse another party for losses you are legally obligated to pay.

Indemnity/Hold HarmlessA method of contractually transferring the

risk.States that the contractor or service

provider will not hold us responsible for any claims arising out of their negligent acts and that the contractor will pay associated claim costs.

Provides the state with claims protection.Most effective when used in conjunction

with the appropriate insurance clauses.

How do you contractually transfer risk to a contractor?

Four Steps

(1) Do a risk assessment.

(2) Determine the necessary actions for the contractual transfer of risk, such as the use of appropriate contract templates, contract language, insurance, bonds and risk control measures.

(3) Review each contract.

(4) Follow-up to insure compliance with the insurance and bonding requirements.

Step 1: Risk Assessment

(1) What is the scope of the contracted service or activity?

(2) What are the potential loss exposures or risks? What can go wrong? Who can be harmed?

(3) What is the likelihood that each of these potential loss exposures will happen?

4) Rate the severity of each potential loss exposure. How bad can it be? What could it cost?

5) Determine the risk rating for each potential loss exposure.

Step 2: Determine the necessary actions for the

contractual transfer of risk • Use of standardized contract

templates. • Use of appropriate contract

language including indemnification clauses and other non-insurance risk transfer.

• Use of appropriate insurance, bonds and coverage limits.

• Use of appropriate risk control measures.

Coverage Assessment

What kind and how much

insurance or bonds?

(See Insurance Coverage

Assessment)

Your World has changed!9-11-01

Examples of Common Types of Insurance and Bonds

What is the Difference Between an Umbrella Policy

and Excess Coverage?

Umbrella PoliciesProvide excess coverage over

another underlying liability policy.Many times provides broader

coverage than the primary (underlying) liability policy.

Excess Liability

Pays after the primary (underlying) liability policy limits have been exhausted.

May not be as broad as primary (underlying) liability policy.

Recommended Insurance Coverage

Aircraft Liability

Insurance covering liability and bodily injury to other’s arising out of the operation of an airplane.

When Do You Need To Require

Aircraft Liability Coverage?

• When the contractor is using an airplane to provide the service.

• If the contractor will carry passengers, the contractor will also need to have a “per seat” limit for bodily injury to passengers.

Automobile Liability

Insurance that provides coverage for third party bodily injury or property damage arising out of the use of an insured vehicle.

When Do You Need To RequireAutomobile Liability Insurance

Coverage?

• When the contractor needs to use an automobile to provide the services.

• Usually, Personal Automobile Liability insurance coverage is not sufficient to cover a contractors business operations.

What Does General Liability Insurance

Really Cover?

General Liability Insurance Myths

• Insurance covers “the indemnification provided in the contract.” – FALSE

• General Liability insurance will cover your entity if the contractor’s work is done “negligently.” – FALSE

• There is “contractual liability” coverage in a General Liability policy.– MOSTLY FALSE

Commercial General Liability (CGL)

Insurance covering “Third Party”:Bodily injury. Property damage.Limited Contractual liability.Products and completed operations. May also cover personal and

advertising injury liability.

CGL Policy Definitions

Bodily Injury: The injury of physical tissue by an outside force, bodily harm, sickness, or disease.

Personal Injury: Libel, slander, false arrest, and invasion of privacy.

CGL Policy Definitions(Continued)

Products & Completed Operations: Insurance covering the contractor for damage or injury to third parties resulting from something the contractor made, repaired, or installed. The damage to third parties resulting from the service would be covered not the contractors actual product.

CGL Policy Definitions(Continued)

Contractual Liability: A portion of Commercial General Liability coverage that allows limited coverage for liability assumed under the contract. The coverage allowed by Contractual Liability includes: Liability assumed under an “insured

contract”. Liability that the insured would have in

the absence of the contract or agreement.

What is an “Insured Contract”?

Per the CGL Policy Definitions, an “Insured Contract means:

• A contract for a lease of premises.

• A sidetrack agreement (a railroad term).

• Easements.

• Agreements required by municipalities as a result of ordinances (not for work done for municipalities.)

• Elevator maintenance agreements.

• Liabilities that “would be imposed by law in the absence of any contract or agreement.”

Current Case Law

• Id. at 479. A tort claim, where there is a contract between parties, may only proceed where there is some kind of obligation owed by one party to the other beyond the duties that the contract imposes.

• Id. at 477. Examples of such relationships are those between lawyers and clients, doctors and patients, or trustees and beneficiaries. The court has called these “special relationships.”

Jones v. Emerald Pacific Homes, 188 Or App 471, id at 477 & 479

Special Relationships

Only Exist When:

• One party has relinquished control over the subject matter of the relationship to the other party; and

• Has placed its potential monetary liability in the other’s hands.

CRIME COVERAGE

Employee Dishonesty, Third Party Fidelity and (when applicable) Money and

Securities Insurance covering loss to money,

securities, and other property (other than money) caused directly by employee dishonesty.

When Do You Need To Require Employee Dishonesty

Coverage?When the contractor is handling money, securities, other valuable property, or data.

Third Party Fidelity Bond

If the Employee Dishonesty coverage is not specifically endorsed to include a Third Party Fidelity/Crime Bond, in most cases, it will not be comprehensive enough to provide coverage for a claim for theft by your contractor or their employees that results in a loss for your agency.

Professional Liability or Errors and Omissions

Coverage

The terms Professional Liability

and Errors and Omissions

Coverage are used interchangeably.

Who Should Have Professional Liability or Errors and Omissions

Coverage?Licensed and accredited specialists such

as:Doctors or medical practitioners.Engineers.Information technology specialists

(computer programmers, etc).And non-licensed professionals such

as interpreters, recorders, testing facilities, and research laboratories.

What Does Professional Liability or Errors and Omissions Cover?

Pays the financial loss of the state, when the covered person fails to perform their professional duty.

The coverage is specific to the nature of the profession.

Covers malpractice, misconduct, negligence, errors, omissions, or incompetence in the performance of a covered act.

Garage and Garagekeepers’ Legal Liability Coverage

Garage Liability CoverageCovers garage operators for liability,

medical payments, and automobile physical damage arising out of the operations of auto dealers, service stations, auto repair shops, and parking lots.

Includes General Liability coverage for garage operations.

Garagekeepers’ Legal Liability Coverage

Coverage for autos left for service, repair, storage, or Safekeeping.

The limits of coverage should be high enough to cover the total value of any autos left for safekeeping (yours and others) at any time.

Workers’ Compensation

Insurance covering employee injuries, disability or death.

The policy protects the employer from being sued by the employee for injuries.

Oregon law requires all employers, unless exempt, provide this coverage for all subject employees working in Oregon.

When Should I Ask Questions About Oregon Specific

Workers’ Compensation?

When the contractor has one or more employees performing services under the contract in Oregon.

Specific questions about Workers’ Compensation?

Call the Department of Consumer & Business Services, Workers’ Compensation, Employer Section at (503) 947-7815.

Will you require Additional Insured and other clauses?

No

Re-evaluate the situation. Figure out how the state will be

protected. Talk to management.

Additional InsuredProtects the state when named in an

action that is not its responsibility or fault.

Ensures that the contractor or service provider’s insurance company would expend funds to have the state’s name removed.

The state benefits by not having to use its assets for litigation purposes.

Certificates of Insurance 101

What Document(s) are Acceptable to Verify Insurance

Coverage?Certificate of Insurance.Letter from corporation stating they are

self-insured. This should be accompanied by a financial statement, unless you are certain about the entity’s financial stability.

Letter from bank stating the amount held in reserves to pay claims and lawsuits.

What Do We Look For on the Certificate of Insurance?

Make sure the coverage and policy limits match the contract requirements.

Look at the policy effective date and expiration dates to make sure they coincide with the contract term. If not, request another certificate several months before the policy expires.

The State of Oregon or your agency is named as the certificate holder and additional insured.

What do the comments in the description section say? Contact the agent with any questions.

Is there an SIR (self-insured retention) listed?

Certificates of InsuranceDid We Get What We Asked For?

Notice of Cancellation or Change

Requires the contractor or service provider’s insurance company to notify us if:There is a possibility of the policy

limits being exhausted.The policy is cancelled or non-

renewed.

Certificate(s) of Insurance

Requires the contractor to prove to the state that it has met the insurance requirements of the contract.

One way to prove this request is by submitting a Certificate of Insurance stating the coverage and policy limits.

Tail CoverageCan be purchased to extend the

period of time a claim can be reported for a “claims made” policy.

Can be purchased on claims made basis.

What Does “Claims Made” or “Occurrence” Mean?

Insurance policies are written on a “claims made” or “occurrence” basis. These terms address claims reporting time periods.

A Claims Made policy covers all claims reported and filed during

the policy period.

An Occurrence policy covers all claims arising out of incidents

occurring during the policy period, regardless of whether or not the policy is still in effect at

the time that the claim is made.

What Does SIR Mean?Stands for Self-Insured Retention.Works like a deductible. If you see this on a Certificate of Insurance,

it means the contractor will perform all the functions normally undertaken by an insurance company for claims within the SIR.

Any losses must exceed the SIR amount before the insurance company will handle the claim.

Should We Accept Self-Insurance?

• Require an audited current financial statement that indicates sufficient reserves to pay in the event of claim(s), and

• Require objective evidence of an administrative process that includes policies and procedures that ensure:– Effective claims processing– Timely payment of claims.

Things to think about -

Who Should We Call With Questions About

Certificates of Insurance?

• The Contractor;

• The Agent that issued the Certificate; or

• The insurance company that is listed on the Certificate.

What is a Bond?

Bonds? Bonds are different from insurance. A bond is a simple guarantee. If there is a loss, the bonding

company (Surety) will pay but will seek full reimbursement from the contractor.

Premium is based on the contractor’s loss experience, assets, and finances.

What Are The Typical Kinds of Bonds Used in Contracts?

Bid Bond

Provides financial assurance that the bid is submitted in good faith and that the contractor intends to enter into the contract at the bid price and if stated in the bid, provide the required performance and payment bonds.

Performance Bond

Protects the state from financial loss should the contractor fail to perform the contract in accordance with contract terms and conditions.

Payment Bond(Labor & Materials Bond)

Guarantees that the contractor will pay certain subcontractors, laborers and material suppliers associated with the project.

Maintenance Bond

Protects the state against defects in workmanship or materials (usually for two years) after the contractor has completed the work.

Additional Bond Information

Bond terms are usually 12 – 24 months.

The bond amount requested depends on the risk of the contract.

In most cases, bonds cost about 1% of the contract amount.

How Much Insurance Should Be Required?

Use the risk rating to set insurance and bonding limits.

INSIGNIFICANT MINOR MODERATE MAJOR CRITICAL

ALMOST CERTAIN

M H E E E

LIKELY M M H E E

POSSIBLE L M H E E

UNLIKELY L L M H E

RARE L L M H H

Likelih

oo

d

Severity

E = Extreme Risk:

• First, consider not doing the activity.

• If you must, you will need to decide how much a potential loss could cost?

• In general, risks at this level warrant more than $1 million in coverage.

H = High Risk:• Could a potential loss cost in

excess of $1 million? If so, ask for more coverage.

• Make sure your assessment considers all costs of potential losses.

• Risk Management would not recommend limits of less than $1 million for High rated risks.

M = Moderate Risk:• Standard limit of insurance

is $1 million.• Assessment should

consider all costs of potential losses.

• If assessment reveals potential loss in excess of $1 million, your risk may actually be high (see H for High Risk.)

L = Low Risk:• If risk is minimal, this is the area where

coverage and limits may potentially be flexible.• Standard limit is still $1 million.• In the case of minimal risks, the agency could

make a business decision to lower the limits of coverage.

• Risk Management would not generally recommend insurance limits of less than $500,000.

• If the risk assessment reveals only minute risk, agency could make a business decision to waive coverage.

For More Details on Insurance Types and Limits

See Smart Contracting Toolkit at: http://www.oregon.gov/DAS/SSD/Risk/SmartContractingToolkit.shtml

Don’t Forget!

About all of the other non-insurance ways to manage risks. Remember that insurance should be the safety net when everything else goes wrong.

Contractual Transfer of Risk Final Steps

Step 3: Review each contract to insure that clauses are up-to-date and the language is appropriate.

Step 4: Insure that you collect and review Certificates of Insurance. Keep a tracking system to insure that coverages do not expire.

The State’s Self-Insurance orCommercial Insurance

Does self-insurance cover the activity and/or

people?

Does management want Risk Mgmt to buy commercial insurance for the activity?

No

No = How will the agency pay for losses resulting from the activity?

Yes = Move on to evaluate Self-Insurance or Commercial

Insurance Coverage

Evaluation of State Self-Insurance or Commercial Insurance Coverage

Which kind of coverage

and what are the limits?

What are the exclusions

and coverage requirements

?Does the agency meet the coverage requirements

?

For Self-Insurance

Coverage, see the State of

Oregon Self-Insurance Handbook

For Commercial Insurance,

Contact Andrea

Peters in Risk Mgmt

If Your Agency:• Has no statutory immunity for the activity.• Has not decided to use loss prevention/risk

control measures to minimize or mitigate the risks.

• Has not contractually transferred the liabilities associated with the activity to another party.

• Does not have self-insurance coverage for the activity.

• Has not purchased commercial insurance coverage for the activity.

How will the agency pay for losses resulting from the activity?

The Point?

• Knowing the risks associated with your agency’s operations that should be keeping you awake at night.

• This insight provides your agency with the ability to plan for proactive loss prevention actions rather than just reactive loss reduction reactions.

Risk Assessment is Not Rocket Science

At times, people tell us that the Risk Assessment Road Map process is too simple…..

Our Answer . . .If Risk Assessment is so simple, why aren’t you doing them?

One More Tool• Risk Assessment is just one more tool

to enhance your agency’s business decision-making tool box.

• This tool also gives your agency a method of documenting the rationale for your business decisions.

• Risk Assessment Roadmap Toolkit: http://www.oregon.gov/DAS/SSD/Risk/RiskAssessmentRoadmapToolkit.shtml

Future Expectations

Your Goal

• Become the Risk Assessment experts of your agency.

• Be able to independently make business decisions regarding insurance:– Types;– Limits;– Deductibles, and– Acceptance of Self-Insurance.

• Be able to independently read and understand Certificates of Insurance for your agency’s contracts.

The End