This weeks Case ‘n Point looks at the question on all our minds, “Is risk management doing its job?” Our real-world example isn’t based on just one story. We’ve encountered this scenario so many times that we’ve provided the quintessential example. As always, the names have been changed to protect the innocent parties.

The Risk Victim

Jake’s General Contracting employs Steve Shaky as a full-time risk manager. His responsibility is to eliminate or control risk wherever it may lie. Steve Shaky properly identified that subcontractors not complying with insurance requirements is a large risk exposure. Steve wrote up a formal process for confirming that Jake’s General Contracting is named as an additional insured on all subcontractors’ general liability insurance policies. The secretary, Annie Anderson, whose job it is to approve certificates, has read the process written by Steve and understands that Jake’s General Contracting must be named additional insured on the certificate of insurance.

The Risk Impact

One day, Annie received a certificate from Don’s Plumbing, a subcontractor. The description box of the certificate read:

The certificate also had an additional insured endorsement attached, which read:

Annie reviewed Steve’s formal process checklist, which was very clear:

Since Annie didn’t see the required text, she sent a letter to Don’s Plumbing outlining what needed to be changed. Later that day, Don’s insurance broker called to explain that the additional insured endorsement on Don’s insurance policy is a blanket endorsement. It will cover Jake’s GC as an additional insured as long as there is a contract between the parties that requires it.  Annie quickly replied “All I care about is that the certificate says ‘Jake’s General Contracting is named as general liability additional insured.’ That is a direct command from our risk manager.”

Don’s broker tried to explain that the required text was meaningless.  In fact, just about anything written directly on the Acord 25 – Certificate of Liability Insurance is meaningless.  The form even says so:

Only a proper contract will trigger the automatic additional insured endorsement in Don’s Plumbing’s policy. Since Annie was only concerned with satisfying her risk manager, she accepted the “revised” certificate fully aware that Jake’s General Contracting might not be an additional insured. Should a large loss occur at the job site, Jake’s General Contracting might not have the coverage they thought they did.

We’ve seen this countless times. The risk manager or owner is concerned about risk, while employees only care about satisfying a requirement handed to them from above. If something goes wrong, the employees defer blame and say they were following orders.  In the end, no one wins.  Until a culture of risk awareness is spread to all levels of the organization, these types of problems will continue.  By properly training employees and giving them access to proper resources, employers can help them seek out answers on their own and truly combat risk.  So, is risk management doing its job? It can if all employees become responsible for risk in their department.