Everyday risk and why it matters
Every day businesses face risks ranging from a slip-and-fall injury to the theft of trade secrets. How a company manages those risks affects safety, productivity, and insurance costs.
Companies that manage risk well tend to keep insurance premiums lower and maintain a more organized, productive workplace.
Managing Risks
Risk management is the process a business uses to identify, evaluate, and control the variety of risks connected to its operations.
How can your business manage risk?
Risks are the negative consequences of events, circumstances, or situations in your business. Some consequences can be transferred to insurance; others must be managed through prevention and planning.
A risk management plan helps you identify, rate, prevent, or correct risks so you reduce uncertainty and exposure to loss. For practical frameworks and tools, see Risk Management.
When you have identified risks, classify them using a risk analysis matrix and then prioritize corrective actions before making insurance decisions.
Risk analysis matrix — overview
The risk analysis matrix combines a measure of likelihood (how often an event may occur) with consequence (how severe the outcome would be) to produce a numeric risk rating.
Likelihood (common descriptions)
- Rare — may occur in exceptional circumstances (less than once in 2 years).
- Unlikely — could occur at some time (about once per year).
- Moderate — will probably occur at some time (about once every 6 months).
- Likely — will occur in most circumstances (about once per month).
- Certain — expected to occur in all circumstances (about once per week).
Consequence levels (typical examples)
- Negligible — no injuries and low financial loss.
- Minor — first-aid treatment and moderate financial loss.
- Serious — medical treatment required, high financial loss, moderate reputational or business interruption impact.
- Major — multiple long-term injuries, major financial loss, major reputational and operational impact.
- Fatality — single death.
- Multiple fatalities — multiple deaths or very serious long-term injuries.
From rating to priority
After combining likelihood and consequence you assign a numeric risk rating. Use the rating to prioritize action according to the following common bands.
- 0 — N (No Risk): costs to treat the risk are disproportionately high compared to negligible consequences.
- 1–3 — L (Low): may require consideration during future changes or can be fixed immediately.
- 4–6 — M (Moderate): may require planned corrective action through budgeting and schedules.
- 8–12 — H (High): requires immediate corrective action.
- 15–25 — E (Extreme): requires immediate prohibition of the process and urgent corrective action.
Prioritize and review
Once you have rated and prioritized risks, meet with your insurance advisor to review which risks need corrective action and which need coverage changes. For additional guidance on integrating risk controls with insurance solutions, see Risk Management and Insurance Overview.
For businesses with digital operations or data exposure, include specialized controls and consider resources specific to online risk programs such as e-Business Risk Management Program.
Decisions about corrective action and insurance protection are generally in order for any identified risk with a rating of 4 or higher; you should review with an insurance agent to confirm next steps for your situation.
Frequently Asked Questions
How do I calculate a risk rating?
Assign a likelihood category and a consequence level for each hazard, then use your matrix to combine them into a numeric score used for prioritization.
At what score should I take action?
Scores of 4 and above usually require corrective action or insurance review; the exact response depends on the business context and the control options available.
What belongs in a risk management plan?
A plan should list identified risks, their ratings, proposed controls, responsible owners, timelines, and review dates.
Can I rely only on insurance to manage risk?
No; insurance transfers some financial risk but does not prevent incidents, so combine insurance with prevention and control measures.