Ch. 20
Risk Management
Risk Management Overview
BASK definition: identifying, assessing and prioritizing risks, and applying resources to minimize, monitor and control the probability and impact of those risks.
BASK key concepts: enterprise risk management (ERM) processes and risk treatments; qualitative and quantitative risk assessment (single loss expectancy, annualized loss expectancy); risk sources and types; legal and regulatory compliance auditing and investigation; quality assurance; business continuity planning; emergency and disaster preparation; safety and security; workplace injury and illness prevention; drug-free workplace.
Key definitions
- Risk (BASK): uncertainty that affects an objective. The effect may include opportunities as well as losses and threats.
- Hazard: a potential source of harm that could cause injury or damage if left uncontrolled.
- Risk management: a system for identifying, evaluating and controlling actual and potential risks, typically including mitigation and response strategies such as insurance.
Enterprise risk management (ERM) process
- Understand the context: the organization's objectives, environment and risk appetite.
- Identify risks: brainstorming, audits, checklists, past incidents, PESTLE.
- Analyze risks: their likelihood (probability) and impact (severity).
- Prioritize (evaluate) risks. A risk matrix or heat map plots likelihood against impact.
- Treat risks (see below).
- Monitor and review, and communicate.
Risk treatments (BASK)
| Treatment | Meaning | HR example |
|---|---|---|
| Avoidance | Eliminate the activity that creates the risk | Decide not to open a facility in an unstable region |
| Reduction (mitigation) | Lower the likelihood or impact | Safety training, harassment prevention training, background checks |
| Sharing (transfer) | Shift some of the risk to another party | Insurance (such as employment practices liability insurance), outsourcing, indemnification clauses |
| Retention (acceptance) | Accept the risk and budget for possible losses | Self-insuring minor claims |
Quantitative risk assessment (BASK)
| Term | Formula |
|---|---|
| Single loss expectancy (SLE) | The expected cost of one occurrence. In IT risk terms: Asset value × Exposure factor (the percentage of the asset lost). |
| Annualized rate of occurrence (ARO) | How many times per year the event is expected to occur |
| Annualized loss expectancy (ALE) | SLE × ARO = the expected yearly loss. It helps decide how much to spend on controls. |
Worked example: A workplace injury of a certain type costs on average $25,000 (SLE) and happens about 4 times a year (ARO). ALE = $25,000 × 4 = $100,000 per year. A $30,000 prevention program that halves the frequency saves $50,000 a year, which is worth doing.
Qualitative assessment uses ratings such as high, medium and low for likelihood and impact, often based on expert judgment.
Risk sources and types (BASK)
- Sources: project failures, insufficient resources, legal liability, accidents, natural disasters, cyberattacks, key-person dependency.
- Types:
- Hazard: injury, property damage, natural disaster.
- Financial: liquidity, credit, market.
- Operational: process failures, supply chain, people, technology.
- Strategic: competition, reputation, regulatory changes.
- Also: compliance/legal and reputational risk.
HR audits and compliance investigations
An HR audit systematically reviews HR policies, practices and records to check compliance and effectiveness. It can be comprehensive or focused, for example on I-9s, FLSA classification, EEO data, personnel files or benefits.
Steps: plan the audit (scope and team, possibly under legal counsel for attorney-client privilege) → gather data → compare with legal requirements and best practices → report the gaps → take corrective action → follow up.
The 2026 BASK also lists intellectual property and the proper use or citation of AI results as compliance concerns. Using AI-generated content may raise copyright, confidentiality or accuracy issues.
Quality assurance
After-action analysis (after-action review): after an event or project, ask what was supposed to happen, what actually happened, why it differed, and what to do differently. Other QA tools include industry-specific standards (such as the ISO standards, including ISO 45001 for occupational health and safety and ISO 30414 for human capital reporting), Six Sigma and continuous improvement.
Business continuity and disaster recovery
- Business continuity plan (BCP): how the organization will keep essential functions running during and after a disruption.
- Disaster recovery plan (DRP): how to restore IT systems and data.
- HR's role: emergency contact lists, communication trees, identifying essential personnel and backups, remote work capability, pay continuity, employee assistance, evacuation procedures and drills or simulations, and pandemic plans.
- Emergencies to plan for (BASK): communicable disease, natural disasters, severe weather, terrorism and man-made disasters.
Safety and security concerns (BASK)
These include workplace violence, active shooters, theft, fraud, corporate espionage, sabotage, kidnapping and ransom, insider threats and data breaches.
Workplace violence (NIOSH Types)
| Type | Perpetrator |
|---|---|
| Type I: criminal intent | Someone with no legitimate relationship to the business, such as a robber |
| Type II: customer/client | A customer, client, patient or student. Common in healthcare. |
| Type III: worker-on-worker | A current or former employee |
| Type IV: personal relationship | Someone with a personal relationship to an employee, such as domestic violence spilling into the workplace |
Prevention:
- A zero-tolerance policy and threat-reporting channels.
- A threat assessment team (HR, security, legal, management, mental health professionals).
- Training in warning signs and de-escalation.
- Physical security, EAP referrals and careful handling of terminations.
Active shooter response: The U.S. Department of Homeland Security recommends "Run, Hide, Fight." Evacuate if possible. Hide if you can't evacuate. Fight only as a last resort.
Other security measures: insider threat programs, access controls, background checks for sensitive roles, and kidnap and ransom (K&R) insurance for employees in high-risk countries.
Occupational injury and illness prevention
Hierarchy of controls (from most to least effective):
- Elimination: remove the hazard entirely.
- Substitution: replace it with something less hazardous.
- Engineering controls: isolate people from the hazard, for example with machine guards or ventilation.
- Administrative controls: change how people work, through procedures, training, job rotation and warning signs.
- Personal protective equipment (PPE): gloves, respirators, hard hats. This is the least effective because it depends on correct use.
Other key practices:
- Job hazard analysis (JHA): break a job into steps, identify the hazards at each step, and decide on controls.
- Incident investigation: find the root cause, not just someone to blame. Investigate near misses too.
- Ergonomics: design work to fit workers, which prevents musculoskeletal disorders.
- Safety committees and safety training.
Drug-free workplace
| Test type | When it is done |
|---|---|
| Pre-employment | After a conditional offer, or as part of the hiring process |
| Reasonable suspicion | Based on specific, documented observations of impairment |
| Post-accident | After a workplace accident. |
| Random | Common in safety-sensitive and DOT-regulated jobs |
| Return-to-duty and follow-up | After a policy violation or treatment |
★ OSHA warns against automatic post-accident testing used to discourage injury reporting. Testing should be done where drug use could have contributed to the accident.
Legal points:
- Under the ADA, a test for illegal drug use is not a medical exam, so it can be given before an offer.
- Current illegal drug users are not protected by the ADA. People in recovery (rehabilitated, not currently using) and people with alcoholism can be protected, but employers may still require that no one be impaired at work.
- U.S. Department of Transportation (DOT) rules require testing for safety-sensitive transportation jobs, such as commercial drivers and pilots.
- Marijuana remains illegal under federal law. State law varies widely regarding medical or recreational use and off-duty protections.
- Drug-Free Workplace Act of 1988: see Ch. 22.
Finished reading?