Are You a Risk Taker or Avoider?

1. Are You a Risk Taker or Avoider? How Risk Tolerance Affects Risk Financing Programs Bob BambinoWright Risk ManagementExecutive Vice President

2. Terms Risk An uncertain future outcome that can either improve or worsen our position. RIMS Enterprise Risk Management The objective of enterprise risk management is to develop a holistic, portfolio view of the most significant risks to the achievement of the entity’s most important objectives. Poole College of Management Risk Tolerance The amount of uncertainty an organization is prepared to accept in total, or, more narrowly within a certain business unit, a risk category or a specific initiative. RIMS Risk Culture The norms and traditions of behavior of individuals and groups within an organization that determine the manner in which they address the risk the organizations confronts and takes. RIMS

3. Risk Takers

4. Some Thoughts • Every entity assumes risk • Risk takers fail • Risk avoiders fail • Our risk tolerance varies • From topic to topic and situation to situation • Within each topic and situation • Risk taking is perceptual • Changes overtime • The key to successful risk-taking is evaluating loss vs. gain

5. Perception

6. Higher Ed Risk Profile

7. Leading Exposures by Coverage Line

8. Risk-Tolerance

9. Risk-Tolerance

10. Risk Appetite Statement “We are a private Christian college established for the benefit of our students, staff and community. We have an appetite for accident risks that arise from our activities, investment risks to support the pursuit of educational and missionary opportunities, and operational risks that offer potential to add value for our students, staff and community. Our risk-taking attitude is measured, deliberate and prudent. We are committed to making the investment to optimize our success relative to the risks taken.”

11. Risk Tolerance Statement:Investment “We will maintain a conservative asset allocation to support our mission of providing faith-based education, while not exposing the College to unnecessary risk outside the scope of our investment policy statement.” Risk Owner: University President, Finance Committee Measurement: The investment advisor will notify the CFO if there is noncompliance with the investment policy statement (IPS). Breach Response: Upon notification of noncompliance, the investment advisor will provides recommendations in compliance with the IPS. For noncomplying securities maturing in less than six-months, the CFO, with advise from the advisor, will decide if the security should be held to maturity or sold immediately.

12. Risk Tolerance Statement:Cyber Security “The College has a very low tolerance for cyber security threats to our assets arising from internal or external malicious attacks resulting in loss or compromise of sensitive, confidential or personal institutional, staff, student or client data.” Risk Owner: College CIO, Operations Committee Risk Description: Increased cybersecurity legal requirements, vulnerabilities, threats and more sophisticated and targeted computer crime could pose risk to our systems, networks, products, solutions, services and data. Breach Response: Investigation of breach; forensic activities; damage assessment and containment; remediation and/or eradication, and activation of crises management procedures. Measurement Frequency: Monthly

13. Risk Tolerance Statement:Enrollment “We will not experience an unexpected decline in applications greater than [x]-percent in any single three academic year period.” Risk Owner: University President, Planning and Operations Committee, Enrollment Management Committee. Measurement: Enrollment Management Committee will review data and trends at the end of each academic semester. Response: The Vice Presidents for Enrollment and Planning and Operations will: identify trends and potential impact, reasons for the decline, and develop recommendations.

14. Risk-Tolerance

15. Risk-Tolerance Taken from Pt – psychtests Testyourself.psychtests.com

16. Risk - Tolerance

17. Risk - Tolerance

18. Risk - Tolerance

19. Risk - Tolerance

20. Risk Evaluation – Risk Mapping • Entity determines score • Based on their risk tolerance, risk appetite, culture, experience • Determine impact and likelihood • Score each risk from 1-10 for both • Plot on a graph/map • Identify how to treat the risk • Avoid • Mitigate • Transfer to someone else

21. Risk Evaluation – Sample Scoring Model

22. Risk Mapping – Risk Adverse Impact Likelihood

23. Risk Mapping – Larger Appetite for Risk Impact Likelihood

24. Actions that Increase Risk in Property and Casualty Insurance Programs • Coverage gaps • Low liability limits • Unacceptable retention levels or deductibles • Unidentified exclusions or coverage reductions • Nonstandard policy forms or policies • Poor management control • Poor risk control program

25. Risk Tolerance – Educators Legal Liability (ELL) Risk Tolerance: High Risk Tolerance: Low “Sleep Insurance” Low or no retentions Buying back exclusions Less Uncertainty Most Losses are Insured Higher Premiums • Minimal or no ELL coverage • Unmanaged Retentions • Untreated exclusions • Lower Premiums • Cash Flow • Risk of uninsured events

26. Missionary Trip Example Two professors asked the College to sponsor a co-ed campus mission trip to Haiti. Working with local pastors, students would teach English and help international aid organizations with recovery efforts. The professors will select adult chaperones, make the arrangements and coordinate with the Haitian government. They are seeking sponsorship, funding and the use of College facilities and resources. The Board of Trustees wants a risk-assessment before making a decision.

27. Decision Process Risk Tolerance Moral - Ethical Legal Policy Violations Reputation Risk Insurance Resources Commitment

28. Questions? Thank you! Bob Bambino rbambino@wrightinsurance.com 516 750-9403