Skip to content
Risk Mitigation

Risk Transference – Let Someone Else Handle the Heavy Lifting

Be notified when we post.

Relevant Contents

Need Tailored Business Continuity Insights?

Contact Us Now for Personalized Guidance!

Depending on your organization’s resources and size, using risk transference to mitigate your risk may be a good option.  

In a recent blog we discussed the acceptance of risk. When accepting risk is not appropriate, the strategies for risk mitigation include: developing and implementing strategies in house; using third parties to develop and implement the solutions, with in-house maintenance; or turning the entire solution over to a third party. For most organizations, some use of risk transference is appropriate.

What is Risk Transference and When Should You Use It?

Risk Transference: Risk transference is handing risk off to a willing third party.

risk transference

 

The most frequently used and easiest method of risk transference is insurance. Insurance is the financial transfer of risk. When using insurance for risk mitigation, it is important to remember:

  1. Insurance does not address brand/image impact. While the insurance may pay for financial losses, the loss of customer or public confidence may severely impact the organization. Think about organizations that lose customer data or restaurants where customers get sick.
  2. Insurance has conditions that must be met before the payout occurs. Ensure that you understand any conditions, notifications, documentation, etc.
  3. All situations may not be covered, depending on the cause. There may need to be additional riders on the policy or other mitigation solutions.

Third Parties That Manage Risk

Physical security is another risk transference function that can be performed by third party companies. Economies of scale often make external security a better choice than using an internal solution.

Third parties are often used for cost containment or to allow for more focus on core competencies. These same justifications can be used in the risk transference mitigation strategy. Rather than implementing risk mitigation solutions for business functions or processes, organizations may consider using third parties to accept the risk. For example, certain business functions with operational risk – such as customer service, call center, or payroll services – can easily be performed by third parties.

Technical functions such as network and data security monitoring, first level technical support, and server administration and monitoring are also candidates for third party use. As these functions become more impactful to overall risk, and the integration of technology more complex, the use of experts who can focus on those specific items often makes the most technical and financial sense.

The use of Software as a Service (SaaS) is analogous to using third party providers. The technical risk and recovery risk is moved to the SaaS provider along with the business risk it may mitigate.

For all third party vendor engagements, understanding the services, recovery commitment, service level agreements, change procedures, and risk mitigation strategies is critical to ensuring that your risk is mitigated appropriately.

Consider your current service providers and how they might fit in to your risk mitigation strategy. They may provide services that your organization can or should move to allow for more focus on competencies that are strategic and grow the business.

By Richard Long, Senior Advisory Consultant, MHA Consulting

Start building a stronger future

Navigate uncertainty with an expert - schedule your free consultation with our CEO, Michael Herrera.

Other resources you might enjoy

In an Ancient Land, Glimpsing the Future of Business Continuity

The Middle East is known for its ancient history and...

Weathering the Storm: Achieving Resilience in an Age of Extreme Weather

The rise of extreme weather is severely impacting business,...

Introducing the Continuity Crib Sheet: What to Do if You Have No BC Plan

For companies that are completely lacking in a business...

Ready to start focusing on higher-level challenges?