back to list

Best Practices in Loss Prevention - 2005-06-17

By Joanne Sammer

Taking a proactive approach to identifying and preventing losses in all forms is one of the best ways companies can protect their bottom line.

The uncertain economy, regulatory changes and high shareholder expectations are causing companies to work harder than ever before to identify and prevent potential losses in every form they may take. Today's loss-prevention efforts encompass traditional concerns, such as stopping employee or customer theft and protecting the company against natural disasters, but they also extend into unconventional areas. "Loss prevention goes beyond safety programs," says Mark Tucker, corporate risk manager for Diebold Inc., a self-service and security solutions provider in North Canton, Ohio. "It is the foundation of risk management in the organization. You need to find ways to protect assets of the corporation, protect shareholders' stake in the company and make sure the company can continue doing business in the future."

"Loss prevention has gained greater importance as more corporations embrace the discipline of risk management," says Chris Johnson, senior vice president and division manager for insurance and risk management company FM Global in Plano, Texas. Lately, organizations have discovered the importance of preserving the continuity of their production processes, protecting their people and ensuring their uninterrupted participation in the marketplace.

A proactive approach to avoiding losses is also one of the best ways for a company to reduce risk-related costs, even for insured losses. Most organizations' total cost of insuring risk depends on their claims experience. About 70 percent to 95 percent of the cost of insurance premiums varies based on loss experience, so loss-prevention activities can have a huge impact on the bottom line.

"There is much more attention on losses and their costs because all costs are extremely important to companies today," says Brad Hart, senior vice president with insurance brokerage Willis in New York City. "Companies are trying to reduce costs in all areas, and risk-related losses lead to claims that greatly affect the bottom line. Companies want to reduce claims and costs to as close to zero as possible."

Of course, not all risks are created equal. "Companies need to consider what could happen and the implications," says Johnson. Because businesses have limited resources for loss prevention, they need to prioritize activities based on the size of each risk and its importance to the company's operations.

Many companies focus loss-prevention activities on reducing the risks that they encounter daily. For example, most large organizations deal with many workers' compensation claims every year, so these losses tend to be more predictable and easier to prevent than, say, disruptions in business resulting from natural disasters. Organizations are increasingly integrating workers' compensation-related safety and loss-prevention programs into overall operations, rather than treating them as an add-on. Some companies are also developing loss-allocation systems for workers' comp claims so that business units are made accountable for losses. If a business unit's level of workers' comp claims crosses a certain threshold, the parent company can charge back the costs associated with those losses to the business unit, suggests Hart.

At the same time, companies must do everything they can to guard against losses related to unpredictable but catastrophic events. A risk assessment can determine how much damage each potential event would cause the business. "Companies need to determine whether the event would be a nuisance or catastrophic and act accordingly to prevent those losses," says Johnson.

If a particular disruption would be minor or limited to secondary areas of operation, then related loss-prevention efforts would take lower priority. If a potential loss might cripple the company, then executives need to invest more resources in preventing that loss. Prevention efforts do not have to be expensive, but they should be thorough. They might include developing and practicing a disaster recovery plan or building a stronger roof on a vital facility located in a hurricane-prone area.

Companies sometimes fail to consider loss-prevention opportunities outside the boundaries of their business. But all companies rely on outside suppliers to keep them running, from electricity providers to telecom providers to the manufacturers of key parts for the company's production. Organizations need to consider their suppliers when identifying areas of potential loss and disruption. Then they should build in redundancies and alternatives.

If, for example, a company uses a just-in-time inventory system that stores only two weeks' worth of parts, its loss-prevention program may highlight the need to increase inventory of the company's most critical components or components for which it has just one supplier. In the event of a supplier problem, the extra inventory would buy the business time to find an alternative part provider without incurring production delays.

In addition, when choosing suppliers, companies should quiz candidates about their own loss-prevention and business-continuity plans and factor those answers into the selection process.

Mitigating Losses

Sometimes preventing losses means transferring the risk to another organization. Diebold produces and services ATMs, and it recently considered as part of its loss-prevention program the risks people face when delivering cash to ATMs located off bank premises. "We decided we couldn't afford to expose our employees to the potential hazards of delivering cash, so we subcontracted out that work," says Tucker.

He points out that strong relationships between risk managers and the company's line managers and employees are key to effective loss-prevention programs. Tucker talked to Diebold managers and employees to improve his understanding of ATM service technicians' experience on the job. Only once he was familiar with the risks associated with the work could he make informed recommendations of ways to minimize those risks and their potential losses. "You need to know what is going on in order to identify and understand potential losses," says Tucker. "Some managers and employees may not be willing to talk about what they are doing or planning from that perspective. You need to build relationships and find ways to work with those individuals."

Tucker meets regularly with managers and employees from the company's service operations to talk about risk management and about how to prevent and deal with losses in their domain. He also asks them about emerging problem areas that could lead to risks in the future. If a bank customer has new requirements for ATMs or other services, Tucker works with line employees and managers to determine whether those requirements will create the potential for losses. If so, he figures out how to deal with that risk. "You can't prevent losses by sitting in your office," says Tucker.

Thinking Creatively

In creative organizations, loss-prevention activities go well beyond insurable risks and address all sorts of exposures. For example, Hewlett-Packard Co. has developed risk management practices that help its procurement function mitigate losses from three types of risks: price, demand and availability. The program has saved the company $50 million over the past three years by enabling it to strategically manage sourcing uncertainties through forward-looking supplier contracts. The company uses software to analyze the impact of product demand, component price and availability uncertainties on its revenues, costs and profits.

The initiative took hold a few years ago, after HP faced significant price increases and an availability shortfall for components used in the production of its printers. The company looked for a way to negotiate contracts to ensure the future availability of those components without overpaying for them. To that end, the company developed standardized methods for determining what to pay for components, how to structure payments, how much to purchase, the length of the contract and how to structure contract provisions to ensure vendor compliance.

Using this approach, HP has built a portfolio of contracts with various terms that the company's procurement staff can manage as a whole. To deal with price uncertainty, commodity managers assess component price risk in the market and predict future component and commodity prices. With this information, those individuals can negotiate contracts to deal with that risk or use hedging instruments to guard against it. To assure an adequate supply of components, the procurement risk team projects parts' availability and compares it with predicted demand. If HP's current suppliers are not likely to be able to provide the necessary components, the company has time to secure alternative sources.

"This is a sea change in approach," says Patrick Scholler, the director of HP's procurement risk management initiative in Palo Alto, Calif. "We have found a way to transform risk so that risk becomes a tradable value with suppliers that is spelled out in contracts." So far, the program affects only $3 billion of the company's $51 billion annual procurement budget, but HP plans to expand the program to other areas of procurement over time. It is currently being used to purchase energy, printer supplies and packaging materials.

No matter what steps a company takes to prevent losses, it must keep those efforts up-to-date and relevant to current operations. "It is important to do periodic impact analyses," says Joyce Repsher, director of business continuity management for Electronic Data Systems in Plano, Texas. Even a seemingly innocuous event, such as a process change or new vendor, can affect loss-prevention efforts. "In many ways, this is more of a business process problem because it is important to rethink loss prevention plans and issues as business models change," she says.

The Basics of Loss Prevention

Companies that are serious about developing and maintaining an effective loss prevention program need to make sure the following elements are present in their plan.

Management commitment. This is essential to ensuring that loss prevention gets the necessary resources and attention. The program will not be effective if it's undertaken half-heartedly. "Loss prevention starts with senior management wanting to avoid or minimize employee injuries, as well as any other losses that could harm shareholder value or the business as a whole," says Mark Tucker, corporate risk manager for Diebold Inc. in North Canton, Ohio. Assignment of responsibility. Someone must be responsible for loss prevention; generally this person is a risk manager or an operations manager.

Development of program objectives. The company should develop clear goals for the loss-prevention program. It must establish a method for evaluating the effect of events and potential events on the company's key value drivers, then develop an action plan for loss mitigation and control.

Employee involvement. Employees at all levels in the company should be involved in the program so that they know what to do to minimize losses before, during and after an event. For example, Electronic Data Systems requires all of its employees to take a loss-prevention training course each year. If they do not complete the course within a reasonable period of time, their manager is notified and the issue could be reflected in their performance review. "If companies don't get the people side of loss prevention right, the physical protection of assets won't get you there," says Chris Johnson, senior vice president and division manager for FM Global, an insurance and risk management company based in Johnston, R.I.

Use of metrics and trend tracking. Through metrics and trend tracking, companies can identify problem areas that have the potential for large losses and take action to prevent those losses.

Monitoring of the program and maintenance of its visibility. The business is continually changing and so are its risks and the tools that can prevent losses from those risks. "Until a loss-prevention plan is tested, it is just a piece of paper," says Joyce Repsher, director of business continuity management for Electronic Data Systems in Plano, Texas. "Don't leave it on the shelf; it needs to be a living document that keeps changing as the business changes." That means reviewing the plan at least annually and making it part of the corporate culture.

Originally printed in the February 2005 issue of Business Finance