Contract

Risk Assessment
Road Map
12/1/2004
What is Risk Assessment?
A strategic approach to
planning, at all levels
and across all
functions of an
organization, that
identifies exposures of
activities and assists in
making risk adjusted
business decisions
every day.
GET RID OF SILOS

Where Does Risk Assessment,
Insurance, Bonding and
Indemnification Fit in the Contracting
Process?


At the inception of an idea, your agency
should perform a risk assessment of the
activity.
Use The Contract Documents
As Your First Tools
A Request for Information (RFI) can be very
useful in determining the amounts of
insurance your targeted contractors carry
and how much the coverage costs them.
An Invitation to Bid (ITB) and a Request for
Proposal (RFP) are commonly used in the
bidding process.
At the beginning of the process, use the
Risk Assessment to decide types and
amounts of Insurance and Bonding that
should be built into the bid document.

Dont Forget About History!
Has your agency, oversight
agency, or peers procured
this type of service or
product before?
Review solicitation or
contract files.
Review past practice.
Ask the old timers.
Create your own
historical reference
material for future use.
Call Your Agency Area Experts
Who Are the Agency Area Experts?
Your Manager
Program staff and managers
What is the
specific
activity?
What is Your
Agencys Appetite
for Risk?
What is a Risk Appetite?
Risk appetite is the degree of
uncertainty an agency is willing to
accept to reach its goals.
Risk appetite is a key factor in
evaluating strategic options.
Risk Assessment helps
management consider risk
appetite when setting goals that
align with overall agency strategy,
and managing risks related to that
strategy.
Work with your agencys management to
decide:

What is your agencys risk
tolerance?
How much or what are you
willing to risk to accomplish
the mission or activity?
How much can your agency
afford to lose in any one
occurrence or in the
aggregate?
What Does Your
Agency Do?
(Mission, Goals,
Objectives)
Does the activity
fit the Agency
mission, goals,
objectives?
No
If the answer =
Take to management
for consideration
Management decides yes = Move on
Management decides no = Stop
If the answer = Yes
What could go wrong?
Who could be harmed?
Make a list - write it down.
These are your loss exposures.
(See Risk Identification & Evaluation)

What is Risk?
The danger or probability of loss.
Loss Exposure
Possibility of financial loss as
the result of a particular peril
striking a thing of value.

Components of a Loss Exposure

The type of value exposed
to loss.
The peril that causes the loss.
The extent of the potential
financial consequences of that
loss.

Values Exposed to Loss
People
Property
Freedom from Liability
(Alleged Wrongdoing)



Perils Causing Loss
Natural Perils:



Human Perils:


Economic Perils:
Potential
Financial Consequences








Make sure that you dont give away the farm!
THINK ABOUT
WHAT CAN GO
Wrong!
Why is this important?
An unrecognized loss exposure
cannot, except by chance, be
effectively managed.
State of Oregon
Methods Of
Identifying Exposures:

Previous contracts of similar type and their
outcomes.
Standardized surveys/questionnaires
Financial statements
Records and files
Loss Reports/Claims
Flowcharts
Personal inspections
Experts

What questions should we ask?
What is the scope of the
contracted service or activity?
What is the overall service
or activity?
What functions are
necessary to deliver or
accomplish this service or
activity?
When and where will the
service or activity take
place(s)?
Who will be performing the service or
activity?
Will the contractor interact with
others, i.e., public, staff, etc?
Will there be any hazardous
materials involved?

What are the potential loss
exposures or risks associated
with the contracted service or
activity?

What could happen?

What could go wrong? Who could be
harmed?
Could there be bodily injury,
property damage or other
liability exposures caused
by this service or activity?
Is there any impact on
workload? Could there
be any damage to our
systems?


Remember..
Consider the values exposed to
loss: People, Property, Freedom from
Liability.
Consider the perils that could
cause loss: Natural, Human,
Economic.
Rate the Risks of Loss and
Weigh the Value of
Opportunities
Rate the severity of the risk of
each potential loss exposure.
How bad can each loss be?
What could it cost?
Rating Severity Description (Risk)
1 Insignificant No injuries; low financial loss
2 Minor First aide treatment; minor financial loss
3 Moderate Injuries; loss of operations; moderate financial loss
4 Major Extensive injuries; loss of operations; major financial loss
5 Critical Death; major loss of operations; huge financial loss
Rating the Severity of Loss Exposures
What is the likelihood that
each of these potential loss
exposures will happen?
Rating the Likelihood of Occurrence
Rating Descriptor Likelihood
(Probability)
Description
1 Rare 1 10% May occur only in exceptional
circumstances
2 Unlikely 11 25% Could occur at some time
3 Possible 26 75% Might occur at some time
4 Likely 76 90% Will probably occur in most
circumstances
5 Almost
Certain
91 100% Is expected to occur in most
circumstances
INSIGNIFICANT MINOR MODERATE MAJOR CRITICAL
ALMOST
CERTAIN
M H E E E
LIKELY M M H E E
POSSIBLE L M H E E
UNLIKELY L L M H E
RARE L L M H H
Determine the risk rating/level of risk
for each potential loss exposure.
Severity
L
i
k
e
l
i
h
o
o
d

Risk Rating (RR) = Level Of Risk

E = Extreme Risk - involve senior
management immediately, emergency
situation, consider not doing the activity.
H = High Risk - management attention
required for business and policy decisions,
risk control, insurance types and limits, etc.
M = Moderate Risk - management should be
kept informed of risk control, insurance types
and limits, etc.
L = Low Risk - manage by routine
procedures, insurance types and limits could
be flexible.
Now That You Have Rated The
Risks Of Loss.
Think About The Value Of
OPPORTUNITIES
EXPLOITING OPPORTUNITIES
What opportunities will be missed if the
activity is not done?
What is the upside and downside of
these opportunities?
By considering the full range of potential
eventsrather than just risksthe risk
assessment process ensures that
management can identify and take
advantage of positive events quickly
and efficiently.
Weighing the Value of Opportunities
Rating Value Description (Opportunity)
1 Insignificant Minor budgetary, funding, or resource gain; Little
or no gain in public and/or client relations.
2 Minor Low budgetary, funding, or resource gain; Some
gain in public and/or client relations.
3 Moderate Moderate budgetary, funding, or resource gain;
Adequate public and/or client relations.
4 Major Major budgetary, funding, or resource gain; Good
public and/or client relations.
5 Critical Huge budgetary, funding, or resource gain;
Excellent public and/or client relations.
If RR = E or H
Is the
Activity
Necessary
?
If the Answer =
No
Management
Business Decision
No = Stop
Management Decides
Yes = Move On
For Each Thing
That Could Go Wrong
What Tools Are Available To
Manage the Risks?
Statutory Immunities:
Research Statutes
No = Move on to Loss
Prevention/Risk
Control Measures
Do any
immunities
apply to the
activity?

Statutory Immunities

If the Answer is:
Yes
What are the
limitations and/
or exclusions?
Do you have a
legal opinion
on statutory
immunities?
No = Management
business decision
on legal opinion
Yes = Move on to Loss
Prevention/Risk Control
Measures
Loss Prevention/
Risk Control Measures
See Risk Control Methods and Measures
Avoid the risk altogether.
Prevent the frequency of loss.
Reduce the severity or cost of loss.
Segregate to prevent one event
from causing loss to the whole.
Contractually transfer the risk.

What are Loss Prevention/
Risk Control Methods?
Avoid Exposure
Entirely eliminates
any possibility of
loss. It is
achieved either by
abandoning or
never undertaking
an activity or an
asset.
Loss Prevention
Reduces the frequency or number of
losses.





Loss Reduction
Lowers the severity or cost of a loss.



Segregate Your Losses

Arrange your agencys activities and assets to
prevent one event from causing loss to the
whole.

- two methods -

Separation
Separate activities and assets among
several locations.
Duplication
Provide a duplicate or stand by for use in
case assets or activities suffer a loss.
Contractual Transfer of Risk
GOAL:
To insure that a contractor is
responsible for claims arising out
of his or her acts, and has some
way to pay for these losses.
Principle #1
Contractually transfer the risk to the
contractor.
Indemnity is only as good as the assets
or insurance coverage backing it up.
Ask for appropriate insurance and
bonds to cover the risk.
Principle #2
Do not indemnify an independent
contractor.
The state is subject to the Oregon Tort
Claims Act (OTCA). OTCA limits state
liability.
Contractors have unlimited liability.
Indemnifying a contractor may make the
state subject to unlimited liability.
Principle #3
Dont rely on insurance or bonds to
cover all of the risks associated
with your contract.
Many times outcome based
statements of work, contract
administration, and supervision are
far better risk control measures to
protect the states interests than
insurance or bonds.
Insurance and bonds should be
thought of as the safety net that
catches us when everything else
goes wrong.
Develop Risk Control Measures
Specific to the Situation

Personal protective equipment.
Housekeeping, repair, and maintenance.
Inspections.
Tools and equipment.
Policies, procedures, and process.
Supervision.
Contract Management and Administration.
Which
measures
best fit the
mission,
activity, and
RR?
How can the
measures be
implemented
? Who will
implement?
Who will be
responsible
for making
sure the
measures
are
followed?
Who will be
responsible
for ongoing
monitoring?
Did you
choose
Contractual
Transfer?
Yes = Move on to select
appropriate Contractual
Transfer - Contract
Clauses
No = Go to
States Self Insurance or
Commercial Insurance
Contractual Transfer
Contract Clauses
Independent Contractor
Indemnity/Hold Harmless
Insurance and Bonds
Warranties
Will you
use a
contract?
Will you
use a
template?
Will you
require
insuranc
e or
bonds?
No = How will the state be protected?
Re-evaluate the situation. Figure
out how the state will be protected.
Talk to management.
Yes = Move on to Contractual Transfer
Independent Contractor
We use the Independent Contractor
Clause to support our assertion that
the contractor is not our agent.

What Does Indemnify
Mean in a Contract?
It is an agreement to pay or
reimburse another party for losses
you are legally obligated to pay.
Indemnity/Hold Harmless
A method of contractually transferring the
risk.
States that the contractor or service
provider will not hold us responsible for
any claims arising out of their negligent
acts and that the contractor will pay
associated claim costs.
Provides the state with claims protection.
Most effective when used in conjunction
with the appropriate insurance clauses.
How do you contractually
transfer risk to a contractor?
Four Steps
(1) Do a risk assessment.

(2) Determine the necessary actions for the
contractual transfer of risk, such as the
use of appropriate contract templates,
contract language, insurance, bonds and
risk control measures.

(3) Review each contract.

(4) Follow-up to insure compliance with the
insurance and bonding requirements.

Step 1: Risk Assessment
(1) What is the scope of the contracted service or
activity?
(2) What are the potential loss exposures or risks?
What can go wrong? Who can be harmed?
(3) What is the likelihood that each of these
potential loss exposures will happen?

4) Rate the severity of each potential loss
exposure. How bad can it be? What
could it cost?
5) Determine the risk rating for each
potential loss exposure.
Step 2: Determine the
necessary actions for the
contractual transfer of risk
Use of standardized contract
templates.
Use of appropriate contract
language including indemnification
clauses and other non-insurance
risk transfer.
Use of appropriate insurance, bonds
and coverage limits.
Use of appropriate risk control
measures.


Coverage Assessment
What kind and
how much
insurance or
bonds?
(See Insurance
Coverage
Assessment)
Your World has changed!
9-11-01
Examples of Common Types of
Insurance and Bonds
What is the Difference Between
an Umbrella Policy
and Excess Coverage?
Umbrella Policies
Provide excess coverage over
another underlying liability policy.
Many times provides broader
coverage than the primary
(underlying) liability policy.
Excess Liability
Pays after the primary (underlying)
liability policy limits have been
exhausted.
May not be as broad as primary
(underlying) liability policy.
Recommended Insurance
Coverage
Aircraft Liability
Insurance covering liability and bodily
injury to others arising out of the
operation of an airplane.
When Do You Need To Require
Aircraft Liability Coverage?
When the contractor is using an
airplane to provide the service.
If the contractor will carry
passengers, the contractor will also
need to have a per seat limit for
bodily injury to passengers.
Automobile Liability
Insurance that provides coverage
for third party bodily injury or
property damage arising out of the
use of an insured vehicle.
When Do You Need To Require
Automobile Liability Insurance
Coverage?
When the contractor needs to
use an automobile to provide
the services.
Usually, Personal Automobile
Liability insurance coverage is not
sufficient to cover a contractors
business operations.
What Does
General Liability Insurance
Really Cover?
General Liability Insurance
Myths
Insurance covers the
indemnification provided in the
contract.
FALSE
General Liability insurance will
cover your entity if the contractors
work is done negligently.
FALSE
There is contractual liability
coverage in a General Liability
policy.
MOSTLY FALSE

Commercial General Liability
(CGL)
Insurance covering Third Party:
Bodily injury.
Property damage.
Limited Contractual liability.
Products and completed operations.
May also cover personal and
advertising injury liability.
CGL Policy Definitions
Bodily Injury: The injury of physical
tissue by an outside force, bodily harm,
sickness, or disease.
Personal Injury: Libel, slander, false
arrest, and invasion of privacy.
CGL Policy Definitions
(Continued)
Products & Completed Operations:
Insurance covering the contractor for
damage or injury to third parties
resulting from something the contractor
made, repaired, or installed. The
damage to third parties resulting from
the service would be covered not the
contractors actual product.
CGL Policy Definitions
(Continued)
Contractual Liability: A portion of
Commercial General Liability coverage that
allows limited coverage for liability
assumed under the contract. The coverage
allowed by Contractual Liability includes:
Liability assumed under an insured
contract.
Liability that the insured would have in
the absence of the contract or
agreement.
What is an Insured Contract?
Per the CGL Policy Definitions, an Insured
Contract means:
A contract for a lease of premises.
A sidetrack agreement (a railroad term).
Easements.
Agreements required by municipalities as a
result of ordinances (not for work done for
municipalities.)
Elevator maintenance agreements.
Liabilities that would be imposed by law in
the absence of any contract or agreement.
Current Case Law
Id. at 479. A tort claim, where there is a
contract between parties, may only proceed
where there is some kind of obligation owed
by one party to the other beyond the duties
that the contract imposes.
Id. at 477. Examples of such relationships
are those between lawyers and clients,
doctors and patients, or trustees and
beneficiaries. The court has called these
special relationships.
Jones v. Emerald Pacific Homes, 188 Or App 471, id at 477 & 479
Special Relationships
Only Exist When:
One party has relinquished control over
the subject matter of the relationship to
the other party; and
Has placed its potential monetary
liability in the others hands.
CRIME COVERAGE

Employee Dishonesty, Third
Party Fidelity and (when
applicable) Money and
Securities

Insurance covering loss to money,
securities, and other property (other
than money) caused directly by
employee dishonesty.
When Do You Need To Require
Employee Dishonesty
Coverage?
When the contractor is handling money,
securities, other valuable property, or
data.
Third Party Fidelity Bond
If the Employee Dishonesty coverage is
not specifically endorsed to include a
Third Party Fidelity/Crime Bond, in most
cases, it will not be comprehensive
enough to provide coverage for a claim
for theft by your contractor or their
employees that results in a loss for your
agency.
Professional Liability or
Errors and Omissions
Coverage
The terms
Professional Liability
and
Errors and Omissions
Coverage are used
interchangeably.
Who Should Have Professional
Liability or Errors and Omissions
Coverage?
Licensed and accredited specialists such
as:
Doctors or medical practitioners.
Engineers.
Information technology specialists
(computer programmers, etc).
And non-licensed professionals such
as interpreters, recorders, testing
facilities, and research laboratories.
What Does Professional Liability
or Errors and Omissions Cover?
Pays the financial loss of the state,
when the covered person fails to
perform their professional duty.
The coverage is specific to the nature of
the profession.
Covers malpractice, misconduct,
negligence, errors, omissions, or
incompetence in the performance of a
covered act.
Garage and Garagekeepers
Legal Liability Coverage
Garage Liability Coverage
Covers garage operators for liability,
medical payments, and automobile
physical damage arising out of the
operations of auto dealers, service
stations, auto repair shops, and parking
lots.
Includes General Liability coverage for
garage operations.
Garagekeepers Legal Liability
Coverage
Coverage for autos left for service,
repair, storage, or Safekeeping.
The limits of coverage should be
high enough to cover the total value
of any autos left for safekeeping
(yours and others) at any time.
Workers Compensation
Insurance covering employee injuries,
disability or death.
The policy protects the employer from
being sued by the employee for injuries.
Oregon law requires all employers,
unless exempt, provide this coverage
for all subject employees working in
Oregon.
When Should I Ask Questions
About Oregon Specific
Workers Compensation?
When the contractor has one or
more employees performing
services under the contract in
Oregon.
Specific questions about
Workers Compensation?
Call the Department of Consumer
& Business Services, Workers
Compensation, Employer
Section at (503) 947-7815.
Will you require
Additional
Insured and
other clauses?
No
Re-evaluate the situation. Figure
out how the state will be protected.
Talk to management.
Additional Insured
Protects the state when named in an
action that is not its responsibility or
fault.
Ensures that the contractor or service
providers insurance company would
expend funds to have the states name
removed.
The state benefits by not having to use
its assets for litigation purposes.
Certificates of Insurance 101
What Document(s) are
Acceptable to Verify Insurance
Coverage?
Certificate of Insurance.
Letter from corporation stating they are
self-insured. This should be accompanied
by a financial statement, unless you are
certain about the entitys financial stability.
Letter from bank stating the amount held in
reserves to pay claims and lawsuits.
What Do We Look For on
the Certificate of Insurance?
Make sure the coverage and policy limits
match the contract requirements.
Look at the policy effective date and expiration
dates to make sure they coincide with the
contract term. If not, request another
certificate several months before the policy
expires.
The State of Oregon or your agency is named
as the certificate holder and additional insured.
What do the comments in the description
section say? Contact the agent with any
questions.
Is there an SIR (self-insured retention) listed?

Certificates of Insurance
Did We Get What We Asked For?

Notice of Cancellation
or Change
Requires the contractor or service
providers insurance company to
notify us if:
There is a possibility of the policy
limits being exhausted.
The policy is cancelled or non-
renewed.
Certificate(s) of Insurance
Requires the contractor to prove to the
state that it has met the insurance
requirements of the contract.
One way to prove this request is by
submitting a Certificate of Insurance
stating the coverage and policy limits.
Tail Coverage
Can be purchased to extend the
period of time a claim can be
reported for a claims made policy.
Can be purchased on claims made
basis.
What Does Claims Made or
Occurrence Mean?
Insurance policies are written on a
claims made or occurrence
basis. These terms address claims
reporting time periods.
A Claims Made policy covers all
claims reported and filed during
the policy period.
An Occurrence policy covers all
claims arising out of incidents
occurring during the policy
period, regardless of whether or
not the policy is still in effect at
the time that the claim is made.
What Does SIR Mean?
Stands for Self-Insured Retention.
Works like a deductible.
If you see this on a Certificate of Insurance,
it means the contractor will perform all the
functions normally undertaken by an
insurance company for claims within the
SIR.
Any losses must exceed the SIR amount
before the insurance company will handle
the claim.
Should We Accept Self-Insurance?
Require an audited current financial
statement that indicates sufficient
reserves to pay in the event of claim(s),
and
Require objective evidence of an
administrative process that includes
policies and procedures that ensure:
Effective claims processing
Timely payment of claims.
Things to think about -
Who Should We Call With
Questions About
Certificates of Insurance?
The Contractor;
The Agent that issued
the Certificate; or
The insurance company
that is listed on the
Certificate.
What is a Bond?
Bonds?
Bonds are different from insurance.
A bond is a simple guarantee.
If there is a loss, the bonding
company (Surety) will pay but will
seek full reimbursement from the
contractor.
Premium is based on the
contractors loss experience,
assets, and finances.
What Are The Typical Kinds of
Bonds Used in Contracts?
Bid Bond
Provides financial assurance that the
bid is submitted in good faith and that
the contractor intends to enter into the
contract at the bid price and if stated in
the bid, provide the required
performance and payment bonds.

Performance Bond
Protects the state from financial
loss should the contractor fail to
perform the contract in accordance
with contract terms and conditions.


Payment Bond
(Labor & Materials Bond)

Guarantees that the contractor will pay
certain subcontractors, laborers and
material suppliers associated with the
project.

Maintenance Bond
Protects the state against defects in
workmanship or materials (usually
for two years) after the contractor
has completed the work.

Additional Bond Information
Bond terms are usually 12 24
months.
The bond amount requested
depends on the risk of the contract.
In most cases, bonds cost about
1% of the contract amount.
How Much Insurance Should
Be Required?
Use the risk rating to set
insurance and bonding limits.
INSIGNIFICANT MINOR MODERATE MAJOR CRITICAL
ALMOST
CERTAIN
M H E E E
LIKELY M M H E E
POSSIBLE L M H E E
UNLIKELY L L M H E
RARE L L M H H
L
i
k
e
l
i
h
o
o
d

Severity
E = Extreme Risk:
First, consider not doing
the activity.
If you must, you will need
to decide how much a
potential loss could cost?
In general, risks at this
level warrant more than $1
million in coverage.
H = High Risk:
Could a potential loss cost in
excess of $1 million? If so, ask
for more coverage.
Make sure your assessment
considers all costs of potential
losses.
Risk Management would not
recommend limits of less than
$1 million for High rated risks.
M = Moderate Risk:
Standard limit of insurance
is $1 million.
Assessment should
consider all costs of
potential losses.
If assessment reveals
potential loss in excess of
$1 million, your risk may
actually be high (see H for
High Risk.)
L = Low Risk:
If risk is minimal, this is the area where
coverage and limits may potentially be flexible.
Standard limit is still $1 million.
In the case of minimal risks, the agency could
make a business decision to lower the limits of
coverage.
Risk Management would not generally
recommend insurance limits of less than
$500,000.
If the risk assessment reveals only
minute risk, agency could make a
business decision to waive coverage.
For More Details on
Insurance Types and Limits
See Smart Contracting Toolkit at:
http://www.oregon.gov/DAS/SSD/
Risk/SmartContractingToolkit.sht
ml
Dont Forget!
About all of the other non-insurance
ways to manage risks. Remember
that insurance should be the safety
net when everything else goes
wrong.
Contractual Transfer of Risk
Final Steps
Step 3:
Review each contract to insure that
clauses are up-to-date and the language
is appropriate.

Step 4:
Insure that you collect and review
Certificates of Insurance. Keep a
tracking system to insure that coverages
do not expire.

The States Self-Insurance or
Commercial Insurance
Does self-
insurance
cover the
activity
and/or
people?
Does management
want Risk Mgmt to buy
commercial insurance
for the activity?
No
No = How will the agency
pay for losses resulting
from the activity?
Yes = Move on to evaluate Self-
Insurance or Commercial
Insurance Coverage
Evaluation of State Self-Insurance or
Commercial Insurance Coverage
Which kind
of coverage
and what
are the
limits?
What are the
exclusions
and
coverage
requirements
?
Does the
agency meet
the coverage
requirements
?
For Self-
Insurance
Coverage, see
the State of
Oregon Self-
Insurance
Handbook
For
Commercial
Insurance,
Contact
Andrea
Peters in
Risk Mgmt
If Your Agency:
Has no statutory immunity for the activity.
Has not decided to use loss prevention/risk
control measures to minimize or mitigate
the risks.
Has not contractually transferred the
liabilities associated with the activity to
another party.
Does not have self-insurance coverage for
the activity.
Has not purchased commercial insurance
coverage for the activity.
How will the agency pay for losses resulting
from the activity?
The Point?
Knowing the risks associated with your
agencys operations that should be
keeping you awake at night.

This insight provides your agency with the
ability to plan for proactive loss
prevention actions rather than just
reactive loss reduction reactions.
Risk Assessment is Not
Rocket Science
At times, people tell us that the
Risk Assessment Road Map
process is too simple..

Our Answer . . .
If Risk Assessment is so
simple, why arent you doing
them?
One More Tool
Risk Assessment is just one more tool
to enhance your agencys business
decision-making tool box.
This tool also gives your agency
a method of documenting the
rationale for your business
decisions.
Risk Assessment Roadmap Toolkit:
http://www.oregon.gov/DAS/SSD/Risk/RiskAsse
ssmentRoadmapToolkit.shtml
Future
Expectations
Your Goal
Become the Risk Assessment experts
of your agency.
Be able to independently make
business decisions regarding insurance:
Types;
Limits;
Deductibles, and
Acceptance of Self-Insurance.
Be able to independently read and
understand Certificates of Insurance for
your agencys contracts.
The End