Risk management sounds like something only large companies have departments for. In practice, it is a simple, repeatable habit: find what could seriously hurt the business, decide what to do about each item, pay for what you cannot prevent in the most efficient way, and check every year whether the plan still fits. Insurance is one part of that, not the whole of it. This guide sets out a working process an owner or manager can run without a dedicated risk manager.
The four-step process
Every method you will read about is a version of these four steps. The value is not in the framework but in doing it on a schedule, writing it down and assigning owners to each action.
Step 1: Identify your exposures
Start with a structured walk through the business, looking at each category of loss. Involve the people who do the work; they know where the near-misses happen.
People
Employee injuries, hiring and employment decisions, loss of a key owner or manager.
Property
Buildings, equipment, inventory, tools at job sites, and the systems that keep them running.
Liability
Injuries to customers and the public, products and completed work, professional advice, contracts you sign.
Vehicles
Owned fleet, employees driving their own cars on business, drivers' records and regulatory compliance.
Data and money
Customer data, funds transfer fraud, employee theft, ransomware and system outages.
Income
Anything that could shut the doors for weeks: fire, a key supplier failing, loss of access to your site.
Then read your contracts. Leases, customer agreements and loan documents often shift risk to you through indemnity clauses and insurance requirements. Those obligations belong on the list too. Our contractor management article covers the reverse side: making sure the vendors you hire carry their share.
Step 2: Assess frequency and severity
Not every risk deserves the same attention. Rate each exposure on two scales: how often it is likely to happen, and how bad it would be if it did. Use your own claims and incident history, industry experience and plain judgment.
| Low severity | High severity | |
|---|---|---|
| High frequency | Prevent and manage: minor injuries, small property damage, customer complaints | Top priority: reduce aggressively and transfer what remains |
| Low frequency | Often retain: absorb within deductibles or the budget | Transfer: insure catastrophic losses such as a major fire, serious vehicle accident or large liability suit |
Severity is where businesses fail. A loss that you can pay from operating cash is an expense; a loss that exceeds your reserves and borrowing capacity is an existential event. That is the threshold that should drive limit and deductible decisions.
Step 3: Choose how to treat each risk
There are four basic choices, and most risks use more than one:
| Approach | What it means | Example |
|---|---|---|
| Avoid | Stop the activity that creates the exposure | Declining a type of job your crews are not equipped for |
| Reduce | Lower the frequency or severity of losses | Safety training, driver screening, sprinklers, backups |
| Transfer | Move the financial consequence to someone else | Insurance; indemnity and additional insured requirements in contracts |
| Retain | Accept and budget for the loss | Deductibles; small, predictable losses |
Reduction measures often pay twice: they prevent losses, and they improve how you are priced. In Washington, for example, L&I's experience factor uses a three-year window of claims history, so an injury prevented this year improves premium for several years. Practical starting points include job hazard analysis, emergency action plans and a safety culture that rewards reporting near-misses.
Some programs help pay for risk reduction directly. Washington's Stay at Work program, for instance, reimburses employers for part of the wages and certain costs of light-duty work for injured workers, which also shortens claims.
Write it down. A risk register (a simple spreadsheet listing each exposure, its rating, the chosen treatment, the owner and the next review date) turns good intentions into accountability.
Step 4: Finance what remains with the right insurance
Insurance is the tool for the low-frequency, high-severity losses you cannot prevent or absorb. Build the program from the exposure list, not from last year's renewal:
- Match coverage to exposures. Each high-severity item on your list should map to a policy, an endorsement or a deliberate decision to retain it.
- Set limits by severity. Ask what a serious loss would really cost, including defense and lost income, and what your contracts require. An umbrella is often the most efficient way to add liability limits.
- Choose deductibles you can absorb. A higher retention can lower premium, but only if a bad year will not strain cash flow.
- Know your state's rules. Washington employers buy workers' comp from the state fund, which does not include employers liability; stop gap coverage is usually added to the general liability policy.
- Look for gaps and overlaps. Read policies so you are not paying twice for one exposure while another goes uncovered.
Our article on five critical insurance gaps lists the omissions we see most often.
Common mistakes to avoid
- Treating insurance as the whole plan. Policies pay for some losses after the fact. They do not prevent the shutdown, the lost customer or the injured employee, and claims history affects future pricing and availability.
- Renewing on autopilot. Carrying last year's limits and values forward after the business has grown is one of the most common ways owners end up underinsured.
- Signing contracts without reading the insurance section. Indemnity and insurance clauses can commit you to coverage you do not carry.
- Ignoring small, frequent losses. They are often the early warning of a larger one, and in lines like workers' comp they drive pricing.
- No single owner. When risk is everyone's job, follow-through is no one's. Name the person responsible for each item on the register.
- Never testing the plan. Walk through a fire, a cyber incident or a serious vehicle accident on paper once a year: who calls whom, where records are, and how you would keep operating.
Monitor and review
Risks change as the business changes. Staff, products, inventory, buildings and regulations all shift over a year, and each can change both your exposures and your costs. Build a review calendar:
| When | What to review |
|---|---|
| Monthly | Incidents, near-misses and open claims; follow-up on corrective actions |
| Quarterly | Risk register actions; training completed; vehicle and driver records |
| Before renewal | Exposure changes, property values, contract requirements, loss runs and claims status |
| When something changes | New locations, services, vehicles, large contracts, acquisitions, or new laws affecting hiring and operations |
Legal changes belong on that list. Washington's amended Fair Chance Act, which took effect July 1, 2026 for employers with 15 or more employees and applies to smaller employers from January 1, 2027, changed when and how employers may consider criminal history. Rules like that affect both your hiring process and your employment practices exposure.
When to call a broker
A broker is most useful at the start and at each change: when you build your first risk register, before signing contracts with significant insurance requirements, ahead of renewal, and after any serious loss. As a broker, we review exposures and coverage together, compare options across the market and connect you with loss control resources. See our risk management and coverage analysis and annual insurance program review services. Whether any given loss is covered depends on the terms of your policies.
Sources
- D.C. Department of Insurance, Securities and Banking — Consumer guide to the business owner's package
- Washington L&I — Experience rating
- Washington L&I — Stay at Work
- The Hartford — Monopolistic states for workers' compensation
- Morgan Lewis — Washington AG publishes Fair Chance Act employer guide as amended law takes effect