URMIA White Paper: Executing a Total Cost of Risk Model

University Risk Management & Insurance Association

URMIA White Paper

Executing a Total Cost of Risk Model

August 2011

Barbara A. Davey, CPCU, ARM, CIC, DRM University of Notre Dame D. Jean Demchak, CPCU Marsh USA Inc. Phillip B. Dendy, CRM University of Texas System Gary W. Langsdale, ARM Pennsylvania State University

Kevin McGinnis The Texas A&M University System Vincent E. Morris, CPCU, ARM, AIC, CRM, CIC, DRM Wheaton College (Illinois) Donna Pearcy, ARM, MBA, DRM The University of Iowa Margaret Tungseth, CPA, MBA Concordia College (Minnesota)

Editor: Christie Wahlert URMIA

This URMIA white paper is published by the University Risk Management and Insurance Association (URMIA), P.O. Box 1027, Bloomington, IN 47402-1027.

URMIA is an incorporated non-profit professional organization.

Editing and layout of the August 2011 white paper was completed by Christie Wahlert, URMIA, Bloomington, Indiana.

There is no charge to members for this publication. It is a privilege of membership. Additional copies are available by contacting the URMIA National Office at the address above or at urmia@urmia.org. Membership information is also available at www.urmia.org. Š LEGAL NOTICE AND COPYRIGHT: The material herein is copyright August 2011 URMIA; all rights reserved.

Table of Contents

Executive Summary 1

Introduction 2

Environmental Health and Safety Cost of Risk 3

Unique Characteristics Relating to Environmental Health and Safety Programs 3

Measuring Internal and External Cost 3 Departmental Expenses 3

Safety Compliance Expenses 4

Environmental Management and Compliance Expenses 5 Hazardous Waste Management 5

Evaluating EH&S Cost of Risk 6

Research Cost of Risk 7

Unique Characteristics Relating to Research Cost of Risk 7 Strategic Considerations 7 Compliance Considerations 7 Financial Considerations 8

Measuring Internal and External Cost 9

Evaluating Research Cost of Risk 10

Human Resources Cost of Risk 11

Unique Characteristics Relating to Human Resources Cost of Risk 11

Measuring Internal and External Cost 12 Workplace Risk 12 Employment Risk 13

Evaluating Human Resources Cost of Risk 14

Transportation Cost of Risk 15

Unique Characteristics Relating to Transportation Cost of Risk 15 Measuring Internal and External Cost 15 Evaluating Transportation Cost of Risk 16

International Programs Cost of Risk 17

Unique Characteristics Relating to International Programs Cost of Risk 17

Measuring Internal and External Cost 18 Training 18 Orientation 19 Insurance 19 Emergency Communication 20 Site Inspections 21

Evaluating International Programs Cost of Risk 21

Legal Cost of Risk 22

Unique Characteristics Relating to Legal Cost of Risk 22 Measuring Internal and External Cost 22 Internal Allocation Model for Legal Expenses 22 Allocation Model Example 23 External Legal Expense 24 Evaluating Legal Cost of Risk 24 Insurance Coverage for Defense Costs 24

Table of Contents (continued) Claims Management 24 Tort Limits 25 Tort Immunity 25

Contractual Obligations to Defend 25

Internal Audit Cost of Risk 26

Unique Characteristics Relating to Internal Audit Cost of Risk 26 Measuring Internal and External Cost 26 Evaluating Internal Audit Cost of Risk 26

Unique Considerations for Select Segments in Higher Education

27

Health Care Cost of Risk 28

Unique Characteristics Relating to Health Care Cost of Risk 28

Understanding the Culture of Risk Management in Academic Medical Centers 28

Defining the Role and Impact of Compliance 28

Identifying the Factors Contributing to

Academic Medical Center Cost of Risk 28

Measuring Internal and External Cost 29

Evaluating Health Care Cost of Risk 29

University Systems Cost of Risk 31

Unique Characteristics Relating to University System Cost of Risk 31 Measuring Internal and External Cost 31 Evaluating University System Cost of Risk 32

Community College Cost of Risk 33

Unique Characteristics Relating to Community College Cost of Risk 33 Organizational Structure 33

Differences Between Two-Year and Four-Year Institutions 34

Student Population and Full-Time Equivalents 34 Cost of Tuition 34

Loss Data Sources 35

Measuring Internal and External Cost 35

Category of Student: Using FTE or Total Revenue 35 Premiums Paid 36

Enterprise Risk Management (ERM) 36

Insurance or Pool Arrangement: Impacts to Budgets 36 Torts, Limits 37

Evaluating Community College Cost of Risk 37

In Summary 38

Glossary 39 Resources 43

Additional Resources 43 Website Resources 44 Template Resources 45

Executive Summary The purpose of this paper is to build upon the basic tenets provided in URMIA’s prior total cost of risk (TCOR) white paper, Measuring the Total Cost of Risk, published in November 2008. This paper presents concepts and techniques that build on the common foundation of an institution’s risk profile and broaden it to include the complexities of TCOR development for other operational areas, such as research, international programs, and academic medical centers. There are common threads throughout this paper that discuss the cost of doing business versus the cost of risk, a discussion that encourages an institution to communicate with senior management and refine its TCOR going forward. Enterprise risk management (ERM) remains another common thread that is embedded throughout this paper as part of the conceptual framework upon which an institution of higher “The changes I’ve seen education can build a TCOR model.

A critical factor discussed in this paper relates to how TCOR supports benchmarking. One benefit of the TCOR measurement process is the ability to benchmark one institution’s costs against other institutions of similar situations, sizes, structures, and missions. For instance, one may compare the costs of risk of four-year liberal arts colleges in the northeastern United States, or they may compare land grant Research I universities that have academic medical centers. In benchmarking one school against another, it is critical to ensure a fair comparison by consistent selection of the factors that comprise the overall TCOR model.

Higher education administrators may use various measurements to benchmark an institution’s TCOR internally or against that of other institutions. It is also important to recognize the potential variance and impact of individual interpretation on each measurement. Internally, the measurement should be consistent from year to year in order to be relevant. Externally, each organization should disclose how it defines each metric to achieve comparable metrics.

Risk managers should be mindful that a primary focus of institutional senior management is the management of costs. TCOR falls within that purview. Thus, we encourage institutions to include the TCOR model as part of the strategic measurement used by the institution’s management.

This approach can lead to TCOR becoming a vital part of the strategic planning process for an institution, create a bridge to other departments in effective discussions regarding TCOR, and appropriately position cost of risk in considerations for future areas of operation.

1

throughout my tenure at the American Council on Education (ACE) include issues surrounding the college cost – especially the shift in student aid from grant to loans and the growing substitutions of individual for public support. This has led policy makers, opinion leaders, and the news media to place new emphasis on value for the money and accountability within higher education. [Also, these] stronger incentives for campuses to take entrepreneurial approaches to management have also created potential new conflicts of both values and interest.”

—David Ward, outgoing president of the American Council on Education (ACE), Trusteeship Magazine

URMIA White Paper: Executing a Total Cost of Risk Model

Introduction Total cost of risk (TCOR) has become a permanent term in the vocabulary of higher education risk management. Simply described, it is a calculated number that measures the overall cost of risk control, financing, and administrative efforts at an institution. An institution can track its TCOR over time to reveal trends and pinpoint areas of risk that are either well-managed or need additional attention. The general idea is that a lower TCOR is better, given the same set of risks to manage. Good risk managers are working to incorporate this method of measuring success into healthy risk management programs.

As noted earlier, the first URMIA white paper on the subject, Measuring the Total Cost of Risk,1 emphasized general metrics to develop an institution’s TCOR, including frequently used denominators and ratios that reveal costs and trends. Also included in the white paper is a template spreadsheet to assist risk managers in establishing institution-specific TCOR calculations.

Since that first TCOR white paper, many institutions have succeeded in implementing a TCOR model.

However, because colleges and universities each manage different risk portfolios, some of which are highly individualized, further clarification of TCOR may be helpful. A need to account for specific types of costs, particularly in areas likely to affect many higher education risk managers, led to the development of this document. Such costs include those associated with research, transportation, community college operations, entire “Look at the total cost university systems, or others. This white paper addresses how of risk. Risk is not just to track and measure risk in identifiable and relatively common areas of operations for higher education. about dollars and cents.

Although there are many commonalities that enable benchmarking TCOR between institutions, there are also administrative decisions that may affect the collection of data and the development of metrics for cost measurements. For example, it is at the discretion of senior management whether to include overhead costs or a percentage thereof in the TCOR. Perhaps the easiest way to understand how to measure TCOR when it is associated with a program or function is to consider those costs to an institution that would go away if the institution stopped doing the program or function. An institution can use whatever measures of cost are helpful for internal, time-series analysis of TCOR across fiscal periods.

However, in order to benchmark successfully against other institutions, an accepted understanding of the specific costs and the appropriate denominators against which to calculate cost ratios is required. The items listed for each specialty area included in this paper provide a recommended structure for benchmarking capability, both internally and externally.

1

Institutions must consider all the consequences of risk.

For example, in a lawsuit over denial of tenure, there are litigation costs, but there are also non-monetary costs, such as lost productivity, distraction from mission, and negative publicity.”

—Association of Governing Boards and United Educators Report, Enterprise Risk Management: Best Practices for Boards, Presidents, and Chancellors

Barbara A. Davey, et al., Measuring the Total Cost of Risk, URMIA White Paper, November 2008.

URMIA White Paper: Executing a Total Cost of Risk Model

2

Environmental Health and Safety Cost of Risk Critical to the effectiveness of any organization’s risk management program is a focus on environmental health and safety (EH&S) issues. It is perhaps unique to the higher education industry that, in many cases, the functions of EH&S and risk management are combined through a common reporting hierarchy, while other industries often align EH&S with facilities management and risk management with finance. Without a direct link, and because of this separation of roles, silos may develop that can directly impact the collaborative efforts between EH&S functions and risk management. Whether such separation exists or not, it is important to include the contributions and costs of EH&S in an institution’s total cost of risk (TCOR).

Unique Characteristics Relating to Environmental Health and Safety Programs EH&S programs strive to reduce the risk of loss and mitigate damage in the event of loss. Therefore, they fall into the loss control category of expenditures for risk management, as opposed to, for instance, insurance premiums and other risk financing entries. Historically, these programs focused on general safety standards for an institution’s departments and employees, often in tandem with new requirements from the Occupational Safety and Health Administration (OSHA) and other similar regulatory bodies. The increase in corporate governance requirements and the potential financial and reputational impact to the institution has led to a paradigm shift within EH&S departments.

In response to a plethora of regulatory agencies and standards, institutions of higher education, in addition to creating safety programs and providing training, must now develop, measure, and monitor loss control programs in safety compliance, environmental management, and hazardous waste management.

Measuring Internal and External Cost The expenses associated with EH&S programs are integral to the development of an institution’s TCOR. By determining costs and measuring them against relevant indexes, an institution can benchmark and identify trends over time. These trends can help define, or redefine, an institution’s risk profile. Total cost measures can also help EH&S managers pinpoint high-risk areas and tailor programs accordingly. The metrics developed will reflect both internal and external expenses that can be evaluated using cost/benefit analysis.

Both direct and indirect costs are important for TCOR. As defined by the Office of Management and Budget (OMB), direct costs are those identified specifically with a particular final cost objective. The direct cost of EH&S may be broadly categorized within the areas of departmental expenses, safety compliance expenses, environmental management and compliance expenses, and hazardous waste management expenses.

Departmental Expenses As noted previously, the decision to include overhead cost or a percentage thereof is at the discretion of senior management. Whatever is determined, consistency should be maintained in order to ensure the credibility of the data. In this example, overhead items such as office space and supplies are considered a cost of doing business rather than a cost of risk and should not be included in the calculation. Salaries, however, should be included as part of an institution’s TCOR. Within an EH&S department, this includes staff involved in risk control and 3

Departmental Expenses to Include in TCOR Salaries Professional Fees/ Services Training Expenses Travel Expenses

URMIA White Paper: Executing a Total Cost of Risk Model

claims management. Those persons with duties outside these areas should only have a proportionate share of their salaries included in the calculation. Professional fees, training expenses, and travel expenses should also be included.

Safety Compliance Expenses The total cost of the EH&S function also includes expenses supporting the institution’s safety compliance programs. Such costs include personal protective equipment, inspections, safety equipment, testing, training, and other resources. Additionally, calculations should include the cost of outside consultants, vendors, or other providers.

Defining safety compliance costs can also assist in the performance of a cost/benefit analysis. For instance, the direct cost of a fall protection policy includes personnel training and the necessary personal protective equipment.

The measurable benefit to this policy includes the prevention of a workers’ compensation claim and the potential OSHA fine or penalty. Further, the indirect cost of a workers’ compensation claim is estimated at four times the direct cost, as discussed later in the Human Resources Cost of Risk section of this paper. While more challenging to quantify, this example demonstrates that the inclusion of indirect costs to the cost/benefit analysis paints a powerful picture for leadership. The particular challenge for those developing the EH&S TCOR calculation will be to properly estimate the costs avoided in losses and fines, as well as the costs incurred. An institution may seek actuarial assistance to define this calculation, which is both important and complex.

URMIA White Paper: Executing a Total Cost of Risk Model

4

Safety Compliance Expenses to Include in TCOR Personal Protective Equipment Safety glasses/goggles Hearing protection Respirators and masks Tyvek suits Foot protection Inspection, Testing, and Training Food safety Hearing conservation Crane safety Vehicle/golf cart use Forklift/man-lift use Fall protection Confined space Lockout-tagout procedures Ergonomics Bloodborne pathogens Ladder safety Proper lifting Building inspections Indoor air quality Signage MSDS management systems Back safety Outside Consultants, Vendors, or Providers Hearing conservation companies Building inspection services Fire suppression consultants

Environmental Management and Compliance Expenses Institutions of higher education are stewards of the environment. Costs associated with environmental management and compliance impact an institution’s financial statements and should be included in the TCOR calculation. Poor environmental management may lead to human, physical, financial, and reputational loss. For example, the cost to maintain the institution’s power plant and monitor emission levels must be weighed against the “avoided” costs associated with a potential incident. An accident at a power plant which results in the release of emissions may cause injury to employees and third parties, harm to the environment, and damage to the physical plant. Regulatory agencies, including the Environmental Protection Agency (EPA) and OSHA, may impose fines on the college or university. Penalties assessed by the EPA for violation of emission standards can reach seven figures. In addition to these costs, an institution must add resulting workers’ compensation claims, liability claims, and reengineering costs.

Hazardous Waste Management Expenses TCOR calculations should also include expenses supporting the management of hazardous waste. These should include all direct costs attributable to the storage, containment, processing, transportation, and disposal of waste. In addition to the environmental issues previously addressed, non-compliance with local, state, and federal government requirements opens an institution to environmental fines and penalties, which can be substantial.

Environmental Management and Compliance Expenses to Include in TCOR Air quality and emissions Asbestos/lead abatement Water quality Environmental Phase I & II evaluations Laboratory inspections Laboratory hood inspections Emergency response training Remediation DEA licensing Import/export control Spill Prevention, Control, and Countermeasure Plans (SPCC)

Hazardous Waste Management Expenses to Include in TCOR Storage Containers Transportation Processing Outside vendors Training Department of Transportation (DOT) compliance Satellite inspections

Consider a one gallon bottle of Acetone, a common chemical found in science laboratories. A lab can purchase a one-gallon bottle of acetone for $8.00. If the lab reuses the bottle correctly in the accumulation of waste, the disposal cost is an estimated additional $2.00. Conversely, if the EPA conducts an inspection of the lab and finds the bottle uncapped and improperly labeled, the institution may be fined $6,000 with additional penalties up to $27,000 per violation under the Resource Conservation and Recovery Act (RCRA).

This example shows how imposed fines and penalties can quickly escalate the cost of managing hazardous waste.

5

URMIA White Paper: Executing a Total Cost of Risk Model

Evaluating EH&S Cost of Risk Once an institution’s administrators calculate the costs associated with overhead, safety, environmental compliance, and hazardous waste management, they can develop various metrics for internal and external benchmarking purposes. To begin, they should develop a standard “per unit” cost. Insurance premiums and losses are typically measured against property values, payroll, and revenue. As shown below, EH&S metrics may be calculated by dividing total program costs (the numerator) by different institutional measures (the denominator): FIGURE 1: EVALUATING EH&S COST OF RISK - DEVELOPING METRICS PROGRAM COST / INSTITUTIONAL MEASURE METRIC RESULT = TCOR TCOR/(Total Employee FTE/1000)

Per 1000 FTE

TCOR/(Total Student FTE/1000)

Per 1000 FTE

TCOR/(Research Expenditures/1000)

Per $1000 Research Expenditures Per Lab Space Square Foot

TCOR/Laboratory Space Square Footage TCOR/Buildings Serviced Square Footage TCOR/(Total Campus Expenditures/1000)

Per Buildings Serviced Square Foot Per $1000 Campus Expenditures

TCOR/Number of Buildings Serviced

Per Building

Campus administrators can target and monitor cost of risk drivers over time. For example, the EH&S department can track the cost of waste treatment and disposal by outside vendors against the processed waste poundage. With this metric, an institution can compare its vendor costs with those of peer institutions and track the percentage increase or decrease in cost over time.

FIGURE 2: EVALUATING EH&S COST OF RISK - VENDOR COSTS PROGRAM COST / INSTITUTIONAL MEASURE METRIC RESULT = TCOR Vendor Costs/Total Number of Pounds

Per Pound

Finally, an institution can measure cost against losses. By determining the training and general safety costs associated with employee performance, it is possible to calculate useful metrics for benchmarking purposes. Sample ratios might include: FIGURE 3: EVALUATING EH&S COST OF RISK - COSTS AGAINST LOSSES INSTITUTIONAL MEASURE/LOSS STATISTIC METRIC RESULT = TCOR FTE/(Number of Recordable Injuries/100)

No. of Injuries per 100 FTE

FTE/(Number of Lost Work Days/100)

No. of Lost Days per 100 FTE

As with any metric, it is possible to interpret data in many different ways. A risk manager should always carefully document what costs were included in the calculation and how the data was collected.

This provides consistency in the data from year to year and yields comparable metrics.

URMIA White Paper: Executing a Total Cost of Risk Model

6

Research Cost of Risk Top research institutions benefit from a reputation of excellence and an ability to attract top-tier faculty, principal investigators, and students; future consideration for grants and funding; and potential revenue streams. However, beyond the physical environmental health and safety (EH&S) risks involved in research, there are other strategic, compliance, and financial risks an institution should consider in its total cost of risk (TCOR) calculations. This section addresses the spectrum of costs associated with research in an institution of higher education.

Unique Characteristics Relating to Research Cost of Risk Strategic Considerations Research issues reach broadly across a number of Strategic Considerations administrative units within the institution, requiring an enterprise risk management (ERM) approach to effectively mitigate the likelihood and costs of unfavorable outcomes.

ERM approach For instance, a sponsored program may require increased Director of research security if an activist group targets a particular researcher Legal counsel or project. Human subject research may involve particular Risk management Security challenges and costs for implementing an Institutional Review Board and patient-safety protocols. Additional staff may be necessary to handle the sheer volume of informed consent documentation. The complexity of grant proposals and subsequent awards will require the review of legal counsel. Without an enterprise-wide coordination of these areas of expertise, including the office of risk management, the institution can expose itself to financial and reputational loss.

Compliance Considerations Compliance challenges faced by research institutions Compliance Considerations involve at least 1) the cost of monitoring the implementation of the sponsor’s grant requirements, 2) audit requirements imposed by government agencies Grant implementation to document overhead and expenses charged to the Audit requirements project, and 3) the school’s own financial policies on grant Institutional policies Expense allocation expenditures and expense allocation. Failure to comply with these requirements can result in monetary fines, unwanted publicity and expenses due to injury to research subjects, allegations of inadequate stewardship of the sponsor’s funds, and loss of future funding from a particular source (private sponsor or government agency), any and all of which could be crippling to a researcher, department, and, more broadly, the institution’s reputation and accreditation.

7

URMIA White Paper: Executing a Total Cost of Risk Model

Financial Considerations In some research projects, the awardee may not have the Financial Considerations resources required to fulfill all aspects of the project and may need to collaborate with other entities or institutions to assure completion. In such a case, the subcontracted Personnel resources work is beyond the practical control of the original grantee, Physical resources but since problems will impact the entire project, the Outsourced work grantee is obligated (by contract and simply to ensure Insurance Safety standards quality control) to carefully oversee all work performed Quality standards in furtherance of the research. Complications arise Principal investigators when expectations are unclear, differing contract terms or conflicting laws apply to differing tiers of awardees, or communication failures take place. The potential for complication increases when one or more parties in a project are located in different parts of the world where safety and insurance standards may differ and where it is more difficult to document and review the science being conducted by the sub-awardee and the safety of research subjects.

The portability of principal investigators among research institutions may lead to disruptions in units and increased costs in replacing equipment or accommodating laboratory renovations for incoming or departing researchers, their projects, and capital equipment. However, it is important to note and account properly for the fact that each of these is a cost of doing business versus a cost of risk.

Sponsored programs with an international reach can be a considerable percentage of a college or university’s total research portfolio. Measuring TCOR for international programs can create challenges, including the need to develop an understanding of employment law, building code and lease agreement terms, local laws, governmental compliance, and corporate governance.

URMIA White Paper: Executing a Total Cost of Risk Model

8

Measuring Internal and External Cost The cost categories discussed in the EH&S Cost of Risk section of this paper—departmental, safety compliance, environmental management and compliance, and hazardous waste management—are also applicable within the research units at colleges and universities. However, the unique characteristics of research, as outlined above, create additional costs not included within the traditional boundaries of EH&S standards. For example, when measuring the TCOR for research, an institution should include the cost of managing material transfer agreements, import and export rule compliance, and the staffing of principal investigators.

Additional costs include the certification of compliance prior to the award of a grant. Throughout the term of a grant, continual recertification may be required. This compliance would include areas such as biological safety levels, EPA compliance, and appropriate OSHA compliance. Granting agencies could impose restrictions for compliance certification, which may require implementation of monitoring programs and increase cost.

The complexity of research grants requires not only the skills of a grant writer, but also those of an attorney and a compliance officer. Contractual issues, including collaboration agreements, licensing agreements, and compliance certification, must be addressed within each grant. As noted above, complications will arise and expenses increase when contractual obligations are not clearly defined.

Each of these processes contributes to the institution’s cost of doing business as well as the cost of risk.

However, an institution should only include the direct risk control cost in its TCOR calculation.

FIGURE 4: RESEARCH COST OF DOING BUSINESS VS. COST OF RISK COST OF DOING BUSINESS COST OF RISK Laboratory space and related overhead expenses

Air and water quality testing

Researcher, graduate assistant, and staff salaries

Lab safety inspections

Principal investigator*

Lab hood inspections

Occupational medicine specialist*

Emergency response training

Grant writing and applications

Remediation

Travel expenses

Import/export control

Cost of permits and licenses (i.e. DEA and ATF)

SPCC training

Import/export costs Contract negotiation costs

Hazardous waste containment, storage, processing, transportation, and training Department of Transportation (DOT) compliance

Scientific (or other) equipment and maintenance

Personal protective equipment

Audit requirements

Insurance (property, casualty, and international, if applicable) Cost of compliance with regard to permit and license requirements

*A portion of a principal investigator or occupational medicine specialist’s salary may be allocated to safety and compliance work.

9

URMIA White Paper: Executing a Total Cost of Risk Model

Evaluating Research Cost of Risk As the competition for sponsored programs increases, a full understanding of the direct and indirect costs will become more significant. Risk managers can assist in this process by clearly defining and generating TCOR calculations for researchers. With an accurately developed TCOR metric, an institution can better measure its ultimate cost in the execution of a grant and assist risk managers in the areas of budget and research staffing support. These measurements also allow an institution to benchmark internally over time and externally against other institutions.

FIGURE 5: EVALUATING RESEARCH COST OF RISK - DEVELOPING METRICS PROGRAM COST/INSTITUTIONAL MEASURE METRIC RESULT = TCOR TCOR/(Research Funding/1000)

Per $1000 Research Funding

TCOR for Hazardous Waste Management/(Lab Square Footage/1000) EH&S FTE Hours/(Lab Square Footage/1000)

Per 1000 Square Feet Hours FTE per 1000 Square Feet

In summary, research programs remain a critical revenue generator on many campuses. The internationalization efforts driven by strategic plans across higher education in the United States include research as a cornerstone. Given the increase in competition for research funding, certainty of how to calculate the TCOR associated with those funds would offer an institution clear perspective on protecting their assets.

URMIA White Paper: Executing a Total Cost of Risk Model

10

Human Resources Cost of Risk In today’s service economy, an organization’s most valuable assets are their human resources. However, the risks associated with these resources can have significant impacts on an institution’s bottom line.

Unique Characteristics Relating to Human Resources Cost of Risk As with many other departments on an institution’s campus, the human resources department faces a changing risk landscape. As of the development of this paper, the current economic crisis has created a fragile employment environment. With no clear sign that the economy has rebounded, institutions continue to cut salary and benefit costs through restructuring and downsizing. These reductions have resulted in an increase in the number and size of claim settlements stemming from workers’ compensation and employment claims. Institutions of higher education have reacted to the impact of this environment by providing additional managerial training, stronger employment contract terms, and tighter claim releases. In addition, many institutions have developed outplacement and counseling services for those who have been displaced.

From a business perspective, it is important to note that the costs of these risk management programs may erode the perceived savings from staff reductions. In fact, as evidenced by Figure 6, while the number of employment claims has escalated during the past several years, the increase has not been as dramatic as the unemployment rate.

FIGURE 6: INCREASES IN EEOC CHARGE FILINGS2

2 Tom Hams, “EEOC Charge Filings Surge,” Aon’s EPL Advisor, Fall 2010, http://www.aon.com/attachments/ risk-services/Fall_2010_EPL_Advisor_Final%20.pdf.

11

URMIA White Paper: Executing a Total Cost of Risk Model

Evidenced by recent tragic events, employee mental health issues can negatively impact an institution’s financial and reputational profile. Financially, the direct costs of employee mental health issues include higher medical and workers’ compensation insurance premiums while indirect costs include loss of productivity and reduced morale. To mitigate the escalating cost of treating employees with mental health issues, employers are increasingly developing employee assistance programs (EAP) and wellness programs. These programs provide counseling and assistance services at a minimal cost to the employee.

The management of workers’ compensation claims may lie with the human resources or risk management departments, depending on the philosophy of the institution. This philosophy can also drive the focus and cost of managing the workers’ compensation program. For instance, the focus may be on health care costs and indemnity payments if workers’ compensation is viewed strictly as an employee benefit program. Alternately, a risk management program should include the analysis of claim patterns and ultimate loss costs along with the administration of safety and return to work programs.

Measuring Internal and External Cost To determine which risks should be included in calculating the TCOR, human resources risk can be divided into two categories: workplace risk and employment risk.

Workplace Claim Analysis

Workplace Risk Workplace risk encompasses all programs and expenses involved in keeping a safe workplace and providing care for employees when accidents happen. The two primary cost drivers of workplace risk are safety programs and workers’ compensation insurance cost, each of which is measurable. Money spent on proper safety programs should result in fewer accidents, which in turn result in less money spent on insurance covering workplace injuries. At the same time, these programs can reach a level of diminishing return where it is difficult to measure whether an additional dollar spent on safety programs results in savings on workplace injuries.

URMIA White Paper: Executing a Total Cost of Risk Model

12

$20,000 Direct Cost • Medical expenses and indemnity payment $80,000 Indirect Cost • Loss of time and productivity for accident response • Loss of time and productivity for coworker distraction • Reduced morale • Continuation of employee benefits • Hiring and training temporary labor • Loss of time for reporting, paper handling, and claim handling • Increase in experience modifier • Damage to tools, equipment, or vehicles used by employee at the time of the incident • OSHA fines and/or penalties • Legal expenses

$100,000 Total Loss

An institution must evaluate cost of workplace injuries and workplace cost of risk using a comparable set of metrics. While one would assume that the injury cost includes both the cost of medical care and the replacement pay for injured employees, what about the indirect cost? Research shows that the indirect cost associated with workplace injuries can reach four times the direct cost,31including decreases in productivity, cost of temporary labor, and the impact of work that just will not get accomplished. For example, a $20,000 accident would generate $80,000 in indirect cost, resulting in injury total cost of $100,000.

Employment Risk Employment risk encompasses the risk cost associated with hiring, employing, and terminating employees. These include unemployment compensation insurance (UCI), Equal Employment Opportunity Commission (EEOC) issues, and benefit programs. The first two, UCI and EEOC, represent areas where time and resources allocated to educating supervisors and management can decrease unwanted outcomes. The benefits of having a workplace well versed in the requirements should result in lower claims costs.

The ability to measure employment risk cost is significant in the current employment environment.

Unprecedented layoffs, employee-friendly government legislation, and a culture of entitlement have all contributed to an increase in employment claims. These claims encompass racial, gender, and age discrimination; retaliation; and mental health issues. Additionally, there is an increase in regulatory legislation, such as the recent passing of the Lilly Ledbetter Fair Pay Act of 2009,42which addresses the timeframe in which a claim for “fair pay” may be filed. Legislation such as the Ledbetter FIGURE 7: LARGE LOSS REPORT, Fair Pay Act creates a new claim base, while 2009 AND 20105 institutions strive to manage other new and EEOC CASES 2009 2010 emerging compliance requirements. Risk SETTLEMENT RANGE managers with the capability to weigh the $250,000 to $500,000 16 15 direct and indirect costs of a loss against the $550,000 to $1,000,000 3 6 time and resources allocated to prevention $1,100,000 to $11,900,000 8 5 can provide value to leadership within an institution.

3 Occupational Safety and Health Administration, “Safety and Health Management Systems eTool,” http:// www.osha.gov/SLTC/etools/safetyhealth/mod1_estimating_costs.html.

4 US Equal Employment Opportunity Commission, “Notice Concerning the Lilly Ledbetter Fair Pay Act of 2009,” http://www.eeoc.gov/laws/statutes/epa_ledbetter.cfm.

5 United Educators, “Large Loss Report 2009,” https://www.ue.org/Libraries/General_Purpose_Documents/ Large_Loss_Report_2009.sflb.ashx.

13

URMIA White Paper: Executing a Total Cost of Risk Model

It is not as simple to calculate FIGURE 8: EEOC RISK MITIGATION STRATEGY the TCOR for benefit programs.

COST OF DOING BUSINESS VS. COST OF RISK Retirement, health benefits, sick COST OF DOING BUSINESS COST OF RISK leave, annual leave, and other Government compliance Training programs represent a significant • Equitable workplace • Management manageable cost to the entity.

• Ombudsman • Employee These benefit programs assist • Fair Labor Standards Act in attracting and retaining (FLSA) employees and subject the • Ledbetter Fair Pay Act entity to potential cost increases Collective bargaining as the cost of those benefit agreements programs change. However, as Employment contracts with the portability of principal *Layoffs or employment reductions investigators mentioned above Cost of doing business or cost of risk? for research institutions, this • Transitioning services should be considered a cost of • Resume assistance • Job search assistance doing business along with market salaries and other opportunities that may increase or decrease competition to attract and retain employees. Including these business costs in the TCOR calculation would shift this measure to reflect your operating cost instead of your cost of risk.

Evaluating Human Resources Cost of Risk Including elements of human resources in an institution’s TCOR is appropriate. Like other risk management programs, several of these programs have distinct risk-reward tradeoffs between proactive planning and resulting claims costs. There are also aspects of human resources expenses which fall outside the TCOR measurement, and institutions need to exercise caution when evaluating the inclusion of these in a TCOR model.

URMIA White Paper: Executing a Total Cost of Risk Model

14

Transportation Cost of Risk Transportation risk touches every department within an institution. Whether it is an athletic team traveling to a game or a faculty member headed to the far corners of the earth, mobility is part of the higher education culture. Strategies including contractual risk transfer, outsourcing of services, and restrictions on student drivers can be effective for reducing the ultimate cost of claims. Conventional risk control mechanisms, such as driver training programs and motor vehicle license record checks, also reduce risk. This section addresses the cost of these techniques to the institution.

Unique Issues Relating to Transportation Cost of Risk The most common transportation risk faced by higher education institutions involves owned or otherwise-controlled motor vehicles, whether used for maintenance of the physical plant; transportation of students, faculty, or staff; or emergency response, to name a few. Transportation total cost of risk (TCOR) includes, at least, funding for legal liability financial responsibility, whether through insurance, trusts/pools, or self-funded programs; insurance or self-funding for physical damage to the vehicles themselves; and expenses associated with driver training and screening through motor vehicle record reviews for potential drivers. However, the cost of vehicle maintenance is normally considered a cost of doing business.

Transportation Risk Profile Owned and non-owned Charters Medical center helicopters Flight school Global initiatives Athletic team transport Student drivers

Measuring Internal and External Cost Personally owned and rental vehicles driven by employees in the course of business may result in risk costs to the institution, such as a contribution by the institution’s insurer to claim payments after a serious accident where the personal vehicle’s liability insurance is inadequate to fully discharge the settlement. Most institutions occasionally charter buses to move larger groups. Ensuring that the charterer has adequate liability insurance and is compliant with US Department of Transportation requirements can be important but usually does not result in measurable cost of risk expenses—except in the case of an accident and subsequent liability claim if the institution allegedly fails to perform due diligence concerning the charterer. Institution policy decisions, such as the types of vehicles maintained by the institution, may have an indirect impact on the TCOR, as well. For example, an insurer may assign a higher premium due to the inclusion of 15-passenger vans, perceived inadequate driver screening and training, or allowing students to drive vehicles on behalf of the institution. The institution must also take into account its unlicensed vehicles, ranging from electric vehicles to all terrain vehicles (ATV) to Segways to bicycles, in TCOR calculations.

Some institutions own or operate aircraft for convenient transportation of executives or athletic teams.

Other institutions, especially those with academic medical centers, own or lease helicopters for air ambulance use. Almost all institutions knowingly or unknowingly have some “non-owned” aircraft exposure when the institution—or a unit, individual faculty member, or staff member—charters a plane, contracts for aerial spraying of trees on campus, or permits an external organization military unit to land a helicopter on campus as part of ROTC training. Some engineering departments that teach aeronautical engineering may also charter air time to have students personally experience flight dynamics.

15

URMIA White Paper: Executing a Total Cost of Risk Model

A few institutions have other aviation exposures, such as owning and operating the local airport, teaching flying lessons, or owning a grounded plane for technical education of avionics or aviation mechanics. Most of these exposures are primarily handled via the purchase of aviation liability insurance, but residual risk remains beyond the premium payment for such items as pilot safety training, firefighting equipment, and personnel for the owned aircraft or airport. Institutions should include these costs in its TCOR calculations.

The development of transportation products by institutions, while relatively rare, can also affect the transportation risk profile. Sponsored programs should be structured so that collaborative agreements in the development of these products protect the intellectual property rights of the institution but transfer any liability stemming from the further design or development of the transportation-related product. Careful consideration must be given to the commercialization or creation of a for-profit entity within the institution’s umbrella of “companies.” These entities can have unexpected outcomes, including a broader range of liabilities and the potential loss of public entity governmental protections. These changes in the risk profile can substantially increase the institution’s TCOR substantially.

The globalization of institutions has further increased transportation risk. Colleges and universities no longer have just a select number of faculty, staff, and students traveling for meetings or educational experiences. As outlined in the International Programs Cost of Risk section of this paper, over 200,000 students travel abroad each year. Executives are traveling overseas for a variety of reasons, including the development of additional institutional programs and collaborative initiatives with public sector corporations or other higher education institutions. Faculty, with the assistance of graduate and undergraduate students, are teaching, researching, and providing social services. Compulsory insurance requirements and strict regional transportation laws coupled with the complexity of contractually transferring risk abroad, obtaining certificates of insurance, and evaluating the safety standards of transportation carriers lead to the potential for loss regardless of the reason for travel. Transportation TCOR should include expenses related to the management of international transportation risks.

Evaluating Transportation Cost of Risk As each segment of this paper reflects, an institution should not include capital expenses and the costs associated with doing business in its transportation TCOR calculation. Within transportation units, the capital outlay for vehicles or airplanes should not be included in the TCOR measurement, nor should a pilot’s salary or hangar rental. However, direct risk management cost, as outlined above, should be included in the calculation of an institution’s transportation TCOR. Therefore, consistent with other programs, there are portions of transportation costs which fall outside the TCOR measurement, and institutions need to exercise caution when evaluating the inclusion of these in the cost of risk.

URMIA White Paper: Executing a Total Cost of Risk Model

16

International Programs Cost of Risk There has been an explosive growth in international programs and travel in recent years. Over 260,000 students travel abroad annually, according to the Institute of International Education (IIE).61Faculty and staff from a significant number of higher education campuses travel abroad for reasons vary“College and university presidents ing from research to athletic recruitment. Many institutions maintain facilities in foreign countries. have increased their emphasis on Some institutions may limit travel to a select internationalization. This has created group of countries while others plan programs across the globe. Some may choose to outsource aggressive growth and provided tremendous the entire process while others strive to provide educational opportunities for millions all the necessary services in-house. Typically, the structure of an institution’s study abroad programs of students. With growth, international will be a combination of both. Regardless of their programs have increasingly expanded into size or structure, institutions of higher education are investing increasingly in international prodeveloping world countries where risk types grams, and business officers are scrutinizing the and levels can differ. We are seeing more associated costs. short-term and faculty led programs in Unique Characteristics of International recent years. The levels of risk management Programs Cost of Risk While the signature risks of environmental health and the approaches to student health and and safety, health care, and human resources are safety among these programs are often compliance driven, academic excellence and safety are the core issues facing international programs. The uneven. This is further complicated by the cost of doing business in an international academic fact that short-term and ad hoc programs setting aligns with domestic expenditures and includes faculty salaries, textbooks, classrooms, often have less infrastructure in place on housing, and enrichment. Alternately, a sizeable the ground to help identify, manage, and portion of the cost of international programming is attributable to safety in a well-managed internamitigate risk. Varied approaches to crisis tional study department. management, drills, training of faculty Adequate and effective staff training, student oriand staff, and other matters can impact entation, insurance purchasing, emergency communications, and site inspections are critical to an institution’s risk profile and present maintaining a safe international environment. In challenges to its risk management team.” addition, international programming requires an understanding of the unique risks involved: —William P. Hoye, Executive Vice President, • Colleges and universities may have contracGeneral Counsel, and Chief Operating Officer, tual obligations with faculty, staff, students, The Institute for the International host families, partner organizations/inEducation of Students stitutions, transportation providers, and event/activity providers.

6 Institute of International Education, “Open Doors Report on International Educational Exchange: About the Open Doors Report,” 2011, http://iie.org/en/research-and-publications/open-doors/data.

17

URMIA White Paper: Executing a Total Cost of Risk Model

• A duty of care for each student exists, whether mandated by law or due to increased level of expectation.

• Health issues—in particular, mental health issues—can be exacerbated while traveling abroad.

• Individual countries maintain specific compulsory insurance requirements.

• Admitted insurance versus non-admitted insurance requirements vary by country.

• Governmental immunities will not apply on a worldwide basis.

• There is a vast difference in the laws, customs, and standards of countries.

• Expansive reach of research and service goes beyond the core curriculum of the home campus (i.e. non-medical faculty, staff, or students) participating in medical related services outside the United States.

• Governmental contracts may require purchase of Defense Base Act coverage, as shown in Figure 9.

FIGURE 9: DEFENSE BASE ACT • • • •

•

Original legislation passed in 1941 and administered by the Department of Labor Amended over the years with the current law protecting virtually all employees working overseas on US government contracts Extends the application of United States Longshore and Harbor Workers Compensation (USL&H) to employees working on US military bases overseas and to employees of federal contractors engaged in contracts outside the continental United States Required: - Work performed on military bases outside the United States except Guam - Specific US government contracts for work outside the United States - Public works contract through a US agency to be performed outside the continental United States - Public works in or on any US territory possession - Departments of Defense, Agriculture, Homeland Security, and Education; Navy; Financial Investigation Bureau (FIB); Centers for Disease Control (CDC); NASA; etc.

Benefits: - Disability, medical, and death benefits - Compensation for partial or total disability - Permanent and total disability benefits payable for life

Aside from student international travel programs, institutions are establishing research and service programs that fall outside the sponsored research umbrella at an increasing rate. The issues noted above are also applicable to these programs. An institution should include the direct cost to address these risks in its TCOR calculation.

URMIA White Paper: Executing a Total Cost of Risk Model

18

Measuring Internal and External Cost While the value of the safety of faculty, staff, and students is immeasurable, the costs associated with safety programs are measurable.

Training The role of international program faculty and staff is complex, and proper training is crucial. On a “home” campus, faculty and staff have access to many different resources, including residence halls, health services, fire departments, security, food services, and the collective wisdom of other administrators. Abroad, these resources may not be readily available. Meeting the needs of faculty and staff through training carries a cost to the institution, which should be calculated and included in the TCOR for international programs.

Orientation An additional cost is the orientation of students to best practices when traveling abroad and to the country in which they will be traveling. Orientation should include pre-trip information, as well as ongoing site, security, and health information. Institutions may provide parents or guardians with information relevant to the travel and safety of their students while balancing the students’ rights under the Family Educational Rights and Privacy Act (FERPA) and Health Insurance Portability and Accountability Act (HIPAA).

Insurance Institutions of higher education should consider property, casualty, life, and health insurance products to adequately cover the exposures of international programs. Physical property may include everything from student personal property if your institution chooses to cover this to institutional extension buildings. Liability exposure can be the direct result of the activities of faculty, staff, and students and the ownership of property. Other liability may be assumed contractually. Purchase of voluntary (workers’) compensation and/or employer’s liability coverage for faculty and staff may be required.

Finally, institutions should verify that executive management policies extend outside the United States and are administratively supported with appropriate risk mitigation strategies.

Travel Assistance Products Medical provider referral Legal assistance Replacement documents Evacuation (security/political/ natural hazards) Tracking Security Life and accident Health insurance

The myriad of life, health, and safety insurance products that may be applicable, and whose premiums should be included in the TCOR calculation for international programs, includes life and international health insurance, medical assistance, medical evacuation, repatriation of remains, crisis response, political risk, travel accident, and security evacuation. To ensure that the institution is protecting faculty, staff, and students for the exposures of international travel, the institution should develop and review periodically a risk map.

19

URMIA White Paper: Executing a Total Cost of Risk Model

FIGURE 10: RISK MAPPING OF INTERNATIONAL PROGRAMS (Marsh, USA, Education Practice)

Risk mapping, as shown in Figure 10, can help a risk manager purchase a portfolio of insurance products tailored for the institution. To create a proper risk map and develop the appropriate insurance portfolio, it is important to partner with insurance representatives who can understand an institution’s risk profile. A strong partner can assist in the prioritization of the numerous global issues and evaluate available insurance coverage. An evaluation of applicable insurance is essential because many countries have compulsory insurance laws affecting what types and what limits of insurance may be required and, for instance, may accept only “admitted” paper.

Emergency Communication Emergency communication has emerged as one of the core components in every crisis plan. The ability to track faculty, students, and staff while traveling and apprise them of changing conditions and potentially dangerous situations has become essential. Costs to an institution of managing this risk may include a combination of electronic tracking and information resources and mobile or solar powered satellite phones with international capabilities. An international program’s TCOR should include the purchase and management costs of such systems and tools since they are risk control and mitigation measures.

URMIA White Paper: Executing a Total Cost of Risk Model

20

Site Inspections Employing staff to perform site inspections on campus is expected and routine in any environmental health and safety and risk management program. International program administrators should also incorporate site inspections into their operations. If possible, risk management personnel from the home institution should be included in the assessment. A loss control engineer familiar with the governmental codes and standards of the country should also be included in the inspection so the institution can assess and address any deficiencies. An attorney with expertise in employment and general contract issues relevant to the site and the country can be invaluable in resolving issues before they become losses. An institution should include the travel and fee costs for the site inspection in its TCOR calculation for international programs.

Evaluating International Programs Cost of Risk An institution calculates the TCOR for FIGURE 11: INTERNATIONAL PROGRAMS international programs much the same as COST OF DOING BUSINESS VS. COST OF RISK other institutional programs—by addCOST OF DOING BUSINESS COST OF RISK ing up insurance premiums, loss/claim payments, and administrative expenses Student Safety Academic Programming • Faculty and staff dedicated to risk management. However, • Training salaries an institution should also include the • Orientation • Field trips / costs of additional safety and security • Insurance enrichment measures, communication systems, and • Emergency programs site inspections in the development of communication • Textbooks international program cost of risk. The • Site inspections • Housing inclusion of these services presents a • Travel more accurate picture of the program cost for trending, benchmarking, and decision making purposes.

A recent study by the US Department of Education reports a shift in demographics on US campuses with a significant increase in Hispanic students. Additionally, students are choosing a wider variety of destinations, including many third world countries. These countries represent a different risk profile to our international programs and may require additional costs to assure safety and protection for the institution’s stakeholders. This changing landscape will have a direct impact on an institution’s TCOR and should be a part of the overall process.

21

URMIA White Paper: Executing a Total Cost of Risk Model

Legal Cost of Risk Institutions of higher education should include an accurate and complete accounting of legal expenses in their total cost of risk (TCOR) calculation. Capturing legal expenses may vary from institution to institution, and legal expenses may actually occur in several departments within an institution. Analyzing where losses occur and how the institution manages claims should help identify areas incurring costs and legal expenses that should be included in the TCOR calculation.

Unique Characteristics Relating to Legal Cost of Risk The first step in identifying legal expenses is to locate where the claims and the litigation are managed within the institution and work with the various departments to capture the legal expense totals for inclusion in the institution’s TCOR. Institutions may have general counsel departments that manage all claims and litigation for the institution, while other general counsel departments manage external legal counsel who are responsible for claims and litigation management. Still other general counsel departments represent a combination of internal and external claims management. Risk management departments may also manage claims, litigation, and the associated legal expense of external attorneys. Depending upon how the institution is structured, facilities management may be involved in construction claims or litigation and may even work directly with external counsel. If the institution has a hospital or medical center, hospital administration may be responsible for managing claims and litigation associated with its operations, including a range of issues from medical malpractice to the general liability of a patient’s missing personal belongings. Additionally, human resources may also incur legal expenses in the management of employment or workers’ compensation claims.

Measuring Internal and External Cost When an organization maintains staff within the institution who are responsible for the management and settlement of claims and litigation, the institution should include the expense of maintaining the department in the legal TCOR calculation. Departmental costs should be segregated to capture only those staff and administration expenses specifically associated with claims and litigation legal expense on behalf of the institution. Institutions should establish a measurable standard that separates the legal expenses from the costs associated with the operation of the institution. For example, general meetings or exploration of new business opportunities would not be eligible for capturing legal expenses for the TCOR. Internal Allocation Model for Legal Expenses The first step in the process for an internal allocation model is to identify where the legal expense is occurring. Once the organization knows and understands where legal costs are being expended then standards can be established to track the expenses. When a staff ’s full-time responsibility is managing claims and litigation legal expenses, the institution can establish a metric for the staff and administrative expenses. For an employee who has other job responsibilities in addition to the management of claims and legal expenses, the first task is to determine the percentage of time that employee spends on legal services. For example, an employee may spend 25 percent of his or her time managing claims and litigation; therefore, only 25 percent of his or her salary should be included in the legal portion of the institution’s TCOR. An important factor to remember when establishing standards for measuring the costs associated with legal expenses is to remove unrelated salary and administrative expenses. When unrelated expenses are segregated, the institution has a more accurate view of the legal TCOR and better metrics to use for comparing the costs of managing legal expenses internally or externally.

URMIA White Paper: Executing a Total Cost of Risk Model

22

Allocation Model Example There are generally two approaches utilized by institutions to manage legal expense and overhead.

The first approach is simply for central administration to assume all costs associated with maintaining in-house staff. The second approach involves establishing criteria in which legal expenses are distributed throughout the institution. Similar approaches are often taken with general costs associated with claims and deductibles. In either case, in order to include the internal legal expense in the TCOR, the institution should identify and segregate the institution’s legal costs.

To facilitate the allocation process under the first approach, the first step is to identify internal legal expenses associated with institutional staff. These legal expenses will include the cost associated with internal staff, a cost percentage of time spent on the legal settlement of claims and litigation.

An example is shown in Figure 12: FIGURE 12: LEGAL EXPENSES TOTAL COST OF RISK (TCOR) DEPARTMENT ADMIN SQ FT PER OVERHEAD STAFF STAFF TIME OVERHEAD STAFF ADMIN COST MONTHLY RELATED TOTAL SQ FT PER MONTH SALARY / TO LEGAL / BENEFITS CLAIM Risk 3600 $2400.00 Management Employee 1 120 0.033 $80.00 $6500.00 75%

$4875.00

Employee 2

80

0.022

$53.33

$4800.00

40%

$1920.00

Employee 3

100

0.028

$66.67

$6000.00

50%

$3000.00

$200.00

RM Subtotal

SALARY AND BENEFITS FOR TCOR

$9795.00

General Counsel Employee 1

3600 144

0.040

$160.00

$7000.00

75%

$5250.00

Employee 2

120

0.033

$133.33

$6500.00

50%

$3250.00

$4000.00

GC Subtotal

$293.33

Facilities 5000 Management Employee 1 144

$3600 0.0288

$103.68

$8500.00

$7000.00

10%

$700.00

FM Subtotal

$103.68

$700.00

Total

$597.01

$18,995.00 Monthly TCOR Exp. Annual TCOR Exp.

23

$19,592.01 $235,104.12

URMIA White Paper: Executing a Total Cost of Risk Model

Additionally, institutions should include any external legal expenses that may be managed by the internal staff but are incurred by hiring outside counsel, such as court fees, in the total legal expense model. The allocation model does not have to be complicated, and once the standards of measurement are established then the institution can record and evaluate expenses period over period, enabling internal benchmarking.

External Legal Expense An institution that hires outside legal counsel for litigation and claim settlement incurs legal expenses and often negotiates terms with outside firms for legal fees and the associated costs.

Legal expenses can be incurred regardless of the insurance coverage maintained by the institution.

For example, defense costs may be included within the policy limits and in the event of a large claim, the insurance carrier may simply pay the policy limits to the insured institution. In this circumstance, it then becomes the institution’s responsibility to defend and settle a loss. An institution that may also have a large self-insured retention limit within policy coverage or is selfinsured may also incur legal expense. Billing from external counsel also records the time spent on specific claims and by whom. Therefore, itemizing and capturing external legal costs per claim often is easier than doing so for the internal legal costs. The institution should then include external expenses billed to the institution should be included in the TCOR calculation.

As noted in the International Programs Cost of Risk section of this paper, institutional presence outside the United States is increasing exponentially. This growth will require the expertise of legal counsel outside the United States. The institution may include a portion of these costs, such as litigation and related expenses, in its TCOR calculation. Legal expenses incurred for risk management initiatives such as safety and employment training may also be included. Legal work in the course of doing business, however, will skew a TCOR metric and should not be included.

For example, legal counsel that an institution may secure to help develop the agreement for academic programming would be considered a cost of doing business, while expenses incurred in the management of work related injuries, employment claims, or third party liability claims should be captured within the TCOR. Evaluating Legal Cost of Risk Insurance Coverage for Defense Costs Insurance policies may or may not provide coverage for legal costs associated with claims. When the legal expenses are outside the policy and the institution pays legal costs, these expenses should be included in the TCOR. Additionally, when coverage is provided for legal costs, the legal costs may serve to erode available policy limits that would otherwise go toward claim payments.

Therefore, in the event of a large settlement that requires the payment of policy limits, there may be some claim settlement costs that the institution would have to pay since a portion of the policy limits were paid to cover the legal expense. In this case, it is also important for the institution to capture the legal expense and include it in the TCOR. Claims Management Institutions of higher education may outsource claims management services to a third party administrator (TPA). In many cases, the institution is responsible for paying the fees to the TPA. In the negotiation of claim administration services, there is often a separate rate applied for claims management of litigation claims. The TCOR calculation should capture such claims management URMIA White Paper: Executing a Total Cost of Risk Model

24

services. Additionally, if an institution is able to isolate legal expenses managed by the TPA, they should be segregated for use in the TCOR calculation. When claims management costs are separated, risk managers can conduct additional calculations based upon claims with or without legal expenses.

Institutions that have internal claims management staff for a self-insurance or self-retention program should conduct an analysis of the institutional expenses. There should be a determination of which expenses are associated with claims management or legal claims versus other duties unrelated to a specific claim. The appropriate expenses should be included in the TCOR. Tort Limits Tort limits are provided by state law and often will cap the amount of the award to a claimant in the event of a specific type of loss. Therefore, the amount that is paid on a claim may be reduced. Legal expense may be incurred not only in responding to the claim under tort but may also occur when there is a need to defend the rights afforded with tort immunity. Although the tort limit is designed to reduce claim and legal costs, in some instances increased expenses may occur when the tort immunity is challenged.

Institutions should include the expenses associated with the defense of a claim with tort limits in the TCOR.

Tort Immunity and Tort Limits Tort Immunity Tort immunity can apply to federal, state, and local governments within the United States and protects these governments from being sued without their consent. The idea behind governmental tort immunity is to prevent money judgments against the government, as such judgments would have to be paid with taxpayers’ dollars.

Tort Immunity In many cases, state law provides tort immunity to public institutions. Tort immunity for a state institution limits Tort Limits the right of recovery for a claim filed against the public Tort limits cap (or place limits on) institution. Often the state attorney general’s office will the amount of financial damages that may be awarded in a lawsuit. respond to the claim and provide a defense on behalf of the institution. In these instances, it may be difficult to isolate the legal expense and include it in the TCOR. However, for those instances where the institution is responsible for managing and settling the claim, the institution should capture and include claim and legal costs in the TCOR. Contractual Obligations to Defend In negotiating contracts with third parties, there may be a requirement for indemnification by the institution in the event a claim is filed. As a result, the institution may actually be responsible for defending and incurring expenses on behalf of a third party of a contract. Whether the insurance carrier provides coverage or the institution incurs the expense, the institution should include the legal expenses associated with the defense of a third party in the TCOR. Additionally, if other provisions of the contract negate the indemnification clause, then the institution may incur legal expenses in the denial of the contractual obligations. When contract provisions are in question, the institution may incur higher than normal legal expense. Overall, in order to properly track legal expenses, it is important for the institution to identify all departments that may be involved in the process and then develop the appropriate standards of measurement.

25

URMIA White Paper: Executing a Total Cost of Risk Model

Internal Audit Cost of Risk One of the key requirements of an institution’s board or its equivalent is to gain assurance that risk management processes are working effectively and that the institution is managing key risks to an acceptable level. Assurance from management is fundamental, but providing an objective independent assurance, for which internal audit is a key source, adds an additional and higher level of confidence.

Unique Characteristics of Internal Audit Cost of Risk The Institute of Internal Auditors, the recognized global body for professional internal auditors, defines internal audit as “an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an institution accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.”71 Measuring Internal and External Cost The broad scope of internal audit’s work is to determine if the institution’s network of risk management control and governance processes, as designed and represented by management, is adequate and functioning effectively. With an increased emphasis on enterprise risk management (ERM), internal audit has become even more closely interrelated with risk management while still critically maintaining its independence and objectivity.

Internal audit will normally provide assurances concerning risk management processes in three areas: • Risk management processes—both their design and how well they are working • Management of those risks classified as “key,” including the effectiveness of controls and other responses to them • Reliable and appropriate assessment of risks and reporting of risk and control status Although not all higher education institutions have an internal audit staff/function, this department exists at many large institutions. When an institution maintains a department that is responsible for assessing the effectiveness of risk management, compliance with state and federal law, and testing of internal controls, maintaining the department should be included in tracking internal audit expenses for the total cost of risk (TCOR). This includes overhead and administrative costs for staff members that are specifically responsible for these functions. These costs should be segregated from costs associated with operations of the institution, such as management consulting engagements, preparation of standard forms, or administrative duties, which would not be eligible for consideration.

Evaluating Internal Audit Cost of Risk As with legal costs, internal audit costs can be either centrally assumed or distributed throughout the institution. No matter which model is used, it is necessary to first identify appropriate expenses associated with internal audit staff. The percentage of time employees spend on internal audit activities identified as appropriate to include in the TCOR could then be applied to salaries and overhead.

7 The Institute of Internal Auditing, “What Is Internal Auditing?”, http://www.theiia.org/theiia/about-theprofession/internal-audit-faqs/?i=1077.

URMIA White Paper: Executing a Total Cost of Risk Model

26

Unique Considerations for Select Segments in Higher Education The prior sections focused on tracking and measuring risk in common areas of operation at institutions of higher education. It afforded a thorough review of each area and associated costs of risk that could be selectively integrated into your overall cost of risk.

The following section addresses three distinct areas that are not commonly shared by all institutions of higher education. They are health care or academic medical centers, university systems or consortia, and community colleges. As noted in our introduction, many institutions have succeeded in implementing a TCOR model. However, because colleges and universities each manage different risk portfolios, some of which are highly individualized, further clarification may be helpful. A need to account for certain kinds of costs, particularly within complex organizational structures such as medical centers and university systems, led to the development of this section.

In reviewing the following section, risk managers should consider the elements of operation that could be included in their own institutions’ risk profiles, such as shared research programs with a neighboring hospital. If an institution is a part of a state college system, its leaders may need to consider how that relationship impacts the institution’s TCOR. Finally, an institution that is part of a consortium or group purchase program may need to consider unique challenges to measuring its TCOR. Ultimately, every institution has a slightly different risk profile than its peers; therefore, it is just as critical to understand the differences as it is to identify the common denominators.

27

URMIA White Paper: Executing a Total Cost of Risk Model

Health Care Cost of Risk Although the concepts and techniques presented in the first URMIA total cost of risk (TCOR) white paper were intended to be broadly applicable, there were many areas left unexplored in developing a more refined approach to the TCOR for academic medical centers (AMC). This section provides a deeper understanding of the culture of risk management within the clinical side of AMCs, the role of compliance in this environment, the professional organizations that influence compliance, and the various factors that contribute to an AMC’s TCOR. Unique Characteristics of Health Care Cost of Risk Understanding the Culture of Risk Management in Academic Medical Centers An AMC’s culture of risk management is focused almost exclusively on clinical patient safety activities. Risk managers in these settings are often nurses or nurse/attorneys whose primary role is compliance with patient safety goals issued by various regulatory entities, as well as the reduction or elimination of medical errors in the hospital setting. The component of insurance with risk transfer is usually not a part of their job function. Instead, it rests with either the office of the general counsel, the chief financial officer, or the “parent” academic institution’s risk management department.

Defining the Role and Impact of Compliance Because of the nature of the US health care industry, “compliance” is a term that has a far-reaching impact in the AMC setting. Health care institutions receive most of their revenue, ranging from 60 to 80 percent or higher, through reimbursement of expenses from Medicare or Medicaid and the private insurance provided by managed care companies. Reimbursement is contingent upon “accreditation” by the Centers for Medicare/Medicaid Services (CMS), which means the facility must remain in compliance with multiple standards of safe patient care. CMS publishes these standards and adds many new standards each year. If a facility fails to comply with these standards, it risks losing its accreditation and, therefore, its revenue reimbursement. Risk managers in health care are dedicated to patient safety and compliance to maintain quality care, thereby securing the key revenue streams to the institution. AMCs are also subject to a variety of other compliance requirements, ranging from mandatory requirements through their accrediting organizations, such as the Joint Commission on the Accreditation of Healthcare Organizations ( JCAHO), to optional certifications, such as Magnet certification or Best Hospitals recognition. Each of these accreditations comes at a significant cost to the institution, but many of these expenses are a cost of doing business versus a cost of risk. However, when compliance audits reveal shortcomings, some remediation and consequential expenses may cross over into the TCOR arena.

Identifying the Factors Contributing to Academic Medical Center Cost of Risk Given this model of operation, AMCs present several unique factors that contribute to the overall TCOR model. AMCs add the additional risk of specific professional liability to an institution.

Professional liability is commonly referred to as “medical malpractice” and comprises the thirdparty liability for poor clinical outcomes. Medical malpractice losses and expenses are often large, so self-insured retentions or deductibles for insurance can be very high, with minimums usually around $1 million reaching to over $25 million. The cost of risk transfer above the retention is typically in the millions of dollars. So the proactive management of losses is the key to driving down TCOR for all three components: premiums, losses, and expenses.

URMIA White Paper: Executing a Total Cost of Risk Model

28

AMCs also add a different perspective to workers’ compensation exposures. The concentration of employees in a hospital results in increased exposure to communicable diseases. AMCs also have highly valued equipment and structures in a single location, resulting in a concentrated property exposure.

In addition, AMCs are typically the recipients of first response casualties during catastrophic events, so they must remain operational no matter what the increased cost. This adds to property values, including extra expense and business interruption valuation. AMC environmental concerns include medical waste, underground tanks, chemical pollutants, and animal research units attached to the human medical facilities. All of these coverages form a part of the traditional TCOR components for an academic institution, but they include the nuances needed for an AMC. Measuring Internal and External Cost As noted earlier, one benefit of the TCOR measurement process is the ability to benchmark one institution’s costs against those of other institutions with similar situations, sizes, structures, and missions. In benchmarking one school against another, institutions must use a consistent set of factors comprising the overall TCOR model, and institutions should recognize the potential impact of variance and individual interpretation.

There are several areas that should remain at the forefront when differentiating between risks associated with AMCs and those associated with only the academic side of operations.

• Internal medical expenses include medical malpractice liability claims; patients may have additional medical expenses that need to go into the claim cost versus count as income. The institution must also determine whether fines are part of the operational costs (a cost of doing business) or a metric in development of TCOR (a cost of risk).

• More institutions are tracking “never” events, “near misses,” or similar data based on reporting requirements to regulatory agencies. Effective in October 2008, pay for performance is based on an institution’s reimbursement.

CMS indicates that if an AMC has a “never” event, the liability would be assumed by the AMC, as opposed to counting on CMS for reimbursement of costs incurred.

“Near Miss” and “Never” Events A “near miss” event is an event that comes close to generating a loss or poor outcome. Although “not reportable,” these events serve as learning experiences for the institution.

A “never” event is a defined list of events that Centers for Medicare/ Medicaid (CMS) say should never happen. If they occur, the hospital will not be reimbursed for the procedure and subsequent costs to treat or correct.

Evaluating Health Care Cost of Risk To summarize, often an AMC must sort its risk profile into manageable risks versus operational risks.

Once an institution identifies the top 20 risks that contribute to health care TCOR, the next step is to identify specific items that could be included in the TCOR model. To identify these specific items, an institution should ask, “What are the signature risks of health care operations?” Some of these could include: • Clinical trials / research institutions • Medical malpractice exposures • Product development (products liability) • Operational (cost of capital)

29

URMIA White Paper: Executing a Total Cost of Risk Model

If there is a medical malpractice aspect of the operation, there may be ambiguities associated with crossover practice between the academic side and the AMC. Once the institution identifies the AMC’s signature risks, it should define what needs to be on the radar concerning the grouping premiums by signature lines for health care. This process will enable an AMC to determine TCOR by parsing out operational versus manageable risks based on this risk profile. Figure 13 provides an example of the metrics used in development of a TCOR calculation for the health care industry:

Health Care Industry Example Total Cost of Risk: $6,243,401 Exposure Base: 57,500 Exposure Type: OBE TCOR Index: $108.5809

Claims Admin., Other $25,000 Loss Control, Expenses, $15,000 $350,000

Premium, $2,849,401

Retained Loss, $3,004,000

FIGURE 13: HEALTH CARE INDUSTRY - EXAMPLE OF TCOR EXPENSES (Marsh, USA, Healthcare Practice)

URMIA White Paper: Executing a Total Cost of Risk Model

30

University Systems Cost of Risk University systems provide centralized governance for multiple institutions, adding value by consolidating management, where appropriate, and providing cost effective services. Individual institutions within the system can realize efficiencies through coordination of programs and shared services, including financial and administrative services, technology, procurement, legal, construction, and a wide range of expertise and resources they can call upon if needed.

Unique Issues Relating to University System Cost of Risk Academic institutions in a large university system may vary in enrollment from 3,000 to 50,000, and employee numbers can vary from 500 to 20,000. Health institutions and services may range from medical schools to full-service hospitals. Institutions have various missions in academics, research, and health care. Property exposures also vary considerably, including those from dry deserts to hurricane prone coastal areas. Although every institution has its own unique characteristics, including local control over most operations, the commonality associated with being a part of a system allows comparisons that are not readily available to independent institutions.

Independent universities have a variety of coverage, insurance limits, deductibles, fees, and expenses that are tailored and somewhat unique to them. While it is entirely appropriate to measure and evaluate their total cost of risk (TCOR) over time against themselves, it becomes complex and difficult to make meaningful comparisons to other institutions.

Unique Challenges for University Systems Public institutions generally rely upon the Attorney General’s (AG) office for information on losses that lead to claims. It can be challenging to extract complete and accurate information from the AG’s office, as well as other state agencies, for state systems.

To further complicate the issue, with little or no control over the allocated cost of a program, stakeholders find little reason to control losses. Maintaining effective loss control programs in these situations is a challenge for the most seasoned risk managers.

It is critical to develop incentives for each member of the state system so that risk managers can use risk mitigation strategies effectively to lower their TCOR.

Measuring Internal and External Cost The metrics of total insured values (TIV), number of employees, square footage, budget, or payroll and how TCOR can be calculated using those metrics over time was demonstrated in the first URMIA TCOR white paper. The components and metrics for conducting an analysis at the system level are not materially different from those used for independent universities. Risk premiums, expenses, and losses are all included, just as they would be for any institution. However, institutions within a system have the advantage of being able to make true comparisons between specific risk management programs since each institution within the system should calculate TCOR consistently.

Institutions within a system or consortium have the ability to take all their internal risk data and compare the results against themselves, each other, and in some cases even create subsets within their own systems. Meaningful comparisons can be made and data sets created by drilling down within certain lines of coverage and comparing costs over time against the institution, within the system, and within a subset of the system, such as academic or health institutions.

31

URMIA White Paper: Executing a Total Cost of Risk Model

Additionally, specific data can be illustrated by using a specific metric to examine a line of coverage.

For example, workers’ compensation evaluation traditionally uses an experience modifier or cost per $100 payroll. Taking that data, translating it to a cost per FTE, then comparing that number to other schools’ results within the system paints a different picture. It is much easier to explain to executive management that an average annual workers’ compensation cost per employee is $485 as opposed to $.97 per $100 of payroll.

The URMIA online library for members at my.urmia.org offers TCOR template spreadsheets. These spreadsheets can assist risk managers in the calculation of their institutions’ TCOR and provide instantaneous visual displays of the metrics.

Evaluating University System Cost of Risk Many of the components of TCOR discussed throughout this paper are directly attributable to financing the exposure in the event of loss, the purchase of insurance, formation of a captive, participation in a pool, or self-funding. In effect, therefore, these are the costs of financing risk. There are a number of other variables an institution can use when calculating its TCOR. As discussed in this paper, support operations, which include administration, environmental health and safety, fire and police departments, audit, and legal contribute to the expense variable. These are components of the cost to control and manage risk.

An institution can conduct a meaningful analysis demonstrating that an investment in these departments can impact the institution’s TCOR. The challenge is finding an appropriate mechanism or tool that substantiates the value and not simply the costs of risk management efforts. It is the old problem, the classic chestnut of the risk management value proposition: how does one prove the cost of a loss that didn’t happen due to good prevention efforts? In many cases, the benefits of a significant investment will avoid or minimize what would otherwise have been a significant loss.

If an institution installs sprinkler protection in a building at a cost of $500,000, the probable maximum loss (PML) may decrease from $10 million to $100,000. Although there may be some decrease in the property insurance premium, unfortunately there would have to be a fire to prove the property conservation engineering reports are accurate. In the same vein, hiring an occupational safety professional to develop and implement accident prevention and loss control initiatives might have a direct impact in reducing the number and severity of injuries and an indirect impact on many other aspects of the risk management program.

Clearly these operations and initiatives have a cost, but that does not mean an institution should include its entire budget in its TCOR measurement. Some discussion and concurrence with stakeholders must take place concerning the agreed methods used to assign specific costs, or a percentage of budget, to “cost of risk” as opposed to maintenance or administration, which are costs of doing business.

The methodology discussion is one that any institution should have, regardless of whether or not they are a member of a system. The system has the advantage of having a consistent methodology to apply among its individual institutions, allowing them to compare and analyze data more easily.

URMIA White Paper: Executing a Total Cost of Risk Model

32

Community College Cost of Risk Community colleges are open public campuses that provide services to the community as a whole.

They represent a broad range of student categories, from the typical student earning college credits for a two- or four-year degree to the lifelong learner. Community colleges often serve as the gateway into higher education for first-generation college students and may have outreach programs to connect with students early in their education, sometimes as early as middle school. They typically have robust distance or online learning programs for credit and non-credit coursework. Core credit requirements are structured to allow students to transfer their coursework credit to a four-year institution.

The community college offers a broad range of educational opportunities for post-secondary education to a diverse population. The education offered at the community college, in addition to preparing students for a continuation into four-year education, includes vocational training, a broad spectrum of certifications, and continuing education. Additionally, with the current economic downturn facing the United States, community colleges have experienced a significant increase in student enrollment.

As a result, risk management as a need and practice at community colleges has been thrust quickly into a much brighter spotlight, and calculation of total cost of risk (TCOR) is an important tool for success. Although there are some variables that may make the development of a TCOR calculation for a community college a little different from that of a four-year institution, the overall process is similar.

Unique Issues Relating to Community College Cost of Risk Organizational Structure Community colleges may be part of a university system. Others may be stand-alone institutions directly funded by the state. Institutions that are part of a system may have allocations assessed that are directly related to managing risk and should be included in the TCOR calculation.

Additionally, a community college may incorporate data regarding losses, premiums, and reserves into a consolidated accounting at the system level, and it may need to segregate that information before a TCOR can be developed specific to the community college.

Regardless of the organizational structure, size of the institution, level of access to data, or the need for resources to develop and maintain TCOR calculations, community colleges can find value in calculating and tracking TCOR. This section discusses the unique factors that can impact how a community college identifies metrics and calculates its TCOR.

33

URMIA White Paper: Executing a Total Cost of Risk Model

Differences Between Two-Year and Four-Year Institutions Community colleges have many risks similar to those of their sister four-year institutions.

However, certain differences between the typical community college and the typical four-year institution are worth acknowledging and including when considering the TCOR process. For example, a risk manager measuring TCOR for a community college may consider the data in Figure 14 and the potential denominators to be used to more effectively benchmark TCOR metrics.

FIGURE 14: DIFFERENCES BETWEEN TWO- AND FOUR-YEAR INSTITUTIONS STUDENT TYPE 4-YEAR STATE UNIV. 2-YEAR COMM. COLLEGE Credit Non-credit

15,000 FTE Negligible

70,885 (39,501 FTE) 20,000

Average age 1st year student

18

27

Tuition per credit hour

$300

$41

Student Population and Full-Time Equivalents Community colleges range widely in size from small to quite large. Some large community colleges have more students than four-year institutions. Whether in a community college or four-year institution, student counts are based upon full-time equivalents (FTE). FTE is a set of metrics that may be calculated using the number of students enrolled in specific types of credit coursework, the number of credit classes offered, or core requirements. For example, a community college may have credit enrollment of 70,885 individual students. However, after the metrics are applied and part-time, non-credit, and other standardizing tools are implemented, the calculated FTE might be 39,501. While this is a significantly smaller number, it is based on a common standardization tool that gives institutions the ability to compare across time and with other institutions.

Cost of Tuition As public institutions, community colleges provide education to a broad audience. Therefore, the typical tuition structure is different from that of a four-year institution. The goal is to create a tuition base that will reach the broadest number of students, which means community college tuition is usually significantly less expensive per hour than tuition at a four-year institution. For instance, a required English class may cost $41 per hour at a community college versus a fouryear institution charge of $300 or more per hour. There are other factors, such as administrative overhead and residential services, that also affect the calculation of tuition. Generally, most students enrolled in community colleges are commuters. Some community colleges offer residential housing, but this is not a general practice. Community colleges must use the tuition per credit hour as a denominator for comparative TCOR calculations with care to make sure benchmarking partners are not including non-tuition line items, such as residential housing.

URMIA White Paper: Executing a Total Cost of Risk Model

34

Loss Data Sources As noted above, TCOR calculations should include the cost of losses paid as a part of the cost of risk. However, it is not always clear where an administrator might find this data. Often, community colleges enter into insurance pool arrangements for various lines of coverage. Insurance pool claim loss systems may present different types of information than would be available from another insurance pool or through an insurance carrier or third-party administrator. Unless the insurance pool agreement specifically outlines access and reporting capability, the community college may face limitations in accessing the claim loss data. Often the data systems in place may not have the capability to produce “as of ” reporting. Therefore, the institution would need to retain or electronically store historical loss runs to avoid losing data that would be difficult to retrieve through the pool claims database. Claim data systems may also vary in the amount of claim loss detail available for the different lines of coverage. In addition, in order to monitor losses and loss development, a good tracking system should record the date the loss reserve is established and the date the loss reserve is changed. This allows the total amount for claim losses to be accurately reflected for the time period requested when a report is run. An accurate claim loss report will enable the institution to effectively track the claim loss cost.

Measuring Internal and External Cost Category of Student: Using FTE or Total Revenue In addition to students taking classes for academic credit, community colleges often have a large population of non-credit students and virtual or distance learning students. At the beginning of the TCOR process, the institution needs to decide what grouping of students will allow it to most accurately calculate the associated expenses and revenues for its TCOR. The average age of a student at a two-year institution is generally higher than that of a student at a four-year institution. There also may be a variance in the average age of the for-credit student at the community college versus the non-credit student. Non-credit students may be primarily lifelong learners, and non-credit course tracks may have more procedures implemented to minimize risks. For example, administrators may choose to hire additional security, improve lighting, fund additional maintenance, and provide parking closer to campus. Therefore, it may make sense to isolate for-credit and non-credit student groups for the calculation of TCOR, as one group may bring significantly higher levels of risk per person to the institution. How community colleges group their students varies by the revenue source for each program under consideration and is affected by whether associated expenses can be properly captured. Some institutions may choose not to distinguish between for-credit and non-credit students since the associated tracking can be difficult and may not be justified by the fine distinction of differences in risk between the groups.

This should be a discussion with business finance and administration.

Community colleges may compare TCOR between institutions based on full time equivalence for credit students or on total revenue. However, non-credit student numbers—and risks—are not captured in the metrics of FTEs in the same manner as for-credit students. When the institution wants to include the cost of risks brought by non-credit students, it may be more accurate to use the total revenue as the TCOR calculation denominator for the per-risk unit. If the institution determines that the impact from non-credit students is not a significant variable, the institution may use either FTE or total revenue as the basis for calculating TCOR. Additionally, if the institution cannot distinguish expenses and revenues stemming from credit and non-credit 35

URMIA White Paper: Executing a Total Cost of Risk Model

students, it should use total expenses and revenues as the basis for the denominator for TCOR calculations. An institution can use FTE as the basis for its TCOR calculation when it is clearly able to identify the expenses and revenues associated with each broad category of students. There is value to each methodology. Regardless of which method an institution selects, implementing the process and maintaining the metrics year after year will provide the information needed to compare the institution’s TCOR. Premiums Paid The categorization of students may also impact insurance premiums. Insurance premiums may be based solely on FTE count, which generally is calculated based on for-credit students only.

However, some insurance carriers for various lines of coverage also consider the non-credit student head count. In order to properly evaluate the total premium paid, the institution should discuss with the insurance carrier how to determine whether the premium rate will take into account forcredit, non-credit, and distance learners. Underwriters may also consider revenue, costs, and losses when developing premiums.

Enterprise Risk Management (ERM) Enterprise risk management (ERM) is a broader, more holistic approach to risk management.

Community colleges that have adopted the principles of ERM should recognize that they may need to incorporate additional expenses or revenues into the TCOR—and, if they want to benchmark against other institutions, they will need to clearly define the specific metrics used in the TCOR calculation. Institutions should use metrics that adequately capture the expenses and revenue stream for ERM. Identifying the standards to be measured and tracked year after year for the TCOR calculation is key to the success of the program. Once the institution fully implements ERM, it can integrate the TCOR process with ERM. Another area increasing cost of risk community colleges should consider is the significant growth in student population and the subsequent demand to increase adjunct faculty on campus. An institution should consider the emerging contractual liability risks with more adjunct faculty in both its ERM discussions and TCOR calculations.

Insurance or Pool Arrangement: Impact to Budgets Often due to financial constraints, a community college may carry first-dollar insurance coverage or low self-insured retentions or deductibles. A claim loss deductible can directly affect the budget. Therefore, the institution should attempt to minimize the exposure to the budget through managing the insurance deductible. For example, the institution might be willing to pay higher premiums in order to have more predictability by guaranteeing overall loss payments will not be more than a certain amount. In pool arrangements, there also can be an assessment by the pool to the insured for previous claim years which are underfunded. An institution may be unsure of whether to capture the assessment in the current year’s TCOR calculation or not. This should be an institutional discussion; however, the assessment is paid in the current year, so it makes sense to capture the expense in the current year TCOR. This effectively treats underfunded prior-year claims on a cash, as opposed to an accrual, basis. Some institutions may choose to not include the assessment in the TCOR calculation. The institution should make a determination of how to address the assessment, then include the assessment and the payment of deductibles in the appropriate year for the TCOR calculation.

URMIA White Paper: Executing a Total Cost of Risk Model

36

Laws, Torts In some states, community colleges are governed through the educational laws associated with K-12 schools. In other states, community colleges are associated with the university system of the state or are separately addressed within state government. Further, tort laws may vary between a community college and a four-year institution, and they can also vary by state. In the event of a loss, tort law provides some degree of immunity for the community college and limits the right of recovery for third parties prosecuting a claim against the institution. Recognizing the impact of tort immunity helps with management of the potential claim loss expense and analysis of the risk exposure. Tort immunity also provides the insurance carrier with a defense in their toolbox for claims management, reducing the insurer’s potential financial exposure.

If the community college is self-insured, evaluating claims and determining the probable developed losses are key elements in analyzing accurate claim expenses to be included in the TCOR calculation. If the community college carries insurance coverage, the claim expense and developed loss value will be available from the insurance carrier.

Evaluating Community College Cost of Risk This section provides great detail regarding the many variables unique to the development of a TCOR model for community colleges. It is important to understand each differential for your community college—whether stand alone or part of a group—and how the culture of risk management is supported by utilization of a TCOR model. This model can become part of the strategic discussions for the senior management team when developing plans for growth of the institution.

37

URMIA White Paper: Executing a Total Cost of Risk Model

In Summary The concepts and techniques presented here are intended to take the common foundation of an institution’s risk profile and broaden it to include total cost of risk (TCOR) calculations for more complex areas of operation, such as research, international programs, and academic medical centers.

Although this paper provides a comprehensive review of the broad areas of operation by various segments within the higher education industry, there are many emerging external influences that have the potential to impact not only the TCOR model for higher education, but also the business model as it now exists. The emergence of for-profit institutions coupled with the impact of the downturn in our economy and reduction of federal funds, for instance, have created a paradigm shift in how we view existing areas of operations. External expectations of accountability within higher education, as well as a shift in the perception of higher education as “big business operating in a commercial environment,” will Board Members and Senior further impact future considerations for implementing Administrators Should: enterprise risk management (ERM) on campus and associated TCOR models.

• Regularly consider and assess As these new influences evolve and new areas of risk emerge, URMIA will issue supplements to this paper to help further the profession of risk management in higher education and provide guidance to our members.

the likelihood and impact of expected and unexpected events— comprehensively assess risk and consider risk in making decisions; • Consider strategies, such as risk

avoidance, risk mitigation, risk sharing, and risk acceptance, in responding to major risks to mission success; • Identify activities needed to ensure

that institutional controls for major risks are in place; and • Use monitoring activities to

determine the effectiveness of institutional risk management activities.

—Association of Governing Boards and United Educators Report, The State of Enterprise Risk Management at Colleges and Universities Today URMIA White Paper: Executing a Total Cost of Risk Model

38

Glossary

Actuary: A professional statistician who can assist with assessing levels of risk (probability and severity).

Captive: A wholly-owned insurance subsidiary of an institution that insures all or part of the risks of its parent.

Cost of Capital: The return necessary to make an investment worthwhile. Sometimes also called the “hurdle rate” or the “internal rate of return.” The cost of setting aside monies in a funded reserve instead of seeking alternate methods of financing risk.

Deductible: The amount the insured will pay for a covered loss prior to the insurance company issuing payment.

Defense Base Act (DBA): DBA extends the application of USL&H to employees working on US military bases overseas and to employees of Federal contractors engaged in contracts outside the continental United States.

Direct Cost: A cost that can be directly related to the production of a specific good or performance of a specific service.

Efficient Risk Frontier: The point in an exposure to risk where the balance between risks taken and risks transferred is optimized and where an organization can afford to pay the costs of risks not transferred.

Enterprise Risk Management: Management of any issue that affects an institution’s ability to meet its objectives.

Environmental Protection Agency (EPA): An independent federal agency established to coordinate programs aimed at reducing pollution and protecting the environment.

Family Education Rights and Privacy Act (FERPA): The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable Department of Education program.

Funded Reserve: Monies actually set aside by management to cover anticipated future losses (not just an empty account tagged for losses - that would be an “unfunded reserve”); depending on the institution’s cost of capital, may be a less expensive way of funding losses than insurance or other alternatives.

Group Purchasing Plan: A group purchase plan is designed to realize economies of scale associated with leveraging the total insurance expenditures of a specific group. Consolidation of premium into one carrier, and the restructuring of risk assumptions given the increased dollar volume, allow members to realize savings.

Heath Insurance Portability and Accountability Act (HIPAA): HIPAA contains major federal protections for the renewability, preexisting conditions, and the portability of health insurance. In addition, the most recent changes include federal regulation regarding patient privacy. The HIPAA Privacy Rule provides federal protections for personal health information held by covered employers and gives patients an array of rights with respect to that information. At the same time, the Privacy Rule is balanced so that it permits the disclosure of personal health information needed for patient care and other important purposes.

Indirect Cost: An overhead cost that cannot be attributed directly to the production of a particular item or the performance of a specific service.

39

URMIA White Paper: Executing a Total Cost of Risk Model

Institutional Review Board (IRB): The National Research Act of 1974 established institutional review boards for the review of research activities involving human subjects to ensure that ethical standards for human subjects have been established and that research activities are in compliance with all pertinent regulations.

Insurance Pool: An association of institutions who share premium, losses and expenses in order to spread risk.

Joint Commission on the Accreditation of Healthcare Organization (JCAHO): JCAHO sets standards for healthcare organizations and issues accreditation to organizations to meet those standards.

Ledbetter Fair Pay Act of 2009: The Act establishes that each paycheck that delivers discriminatory compensation is a wrong actionable under federal EEO statutes, regardless of when the discrimination began.

Loss Reserve: At a point in time, the total estimated amount of outstanding liability for a given claim or set of claims that have occurred but the costs of which have not yet been fully paid. Also includes estimated costs for claims that have been “incurred but not reported” (IBNR).

Near Event: An event that comes close to generating a loss or poor outcome.

Never Event: A defined list of events that Centers for Medicare/Medicaid (CMS) say should “never” happen. If they occur, then the hospital will not be reimbursed for the procedure and subsequent costs to treat/correct.

Office of Management and Budget (OMB): OMB is an executive arm of the US government. OMB is responsible for 1) budget development and execution, 2) management of procurement, information/IT, and financial management, 3) coordination and review of significant federal regulations by executive agencies, 4) legislative clearance and coordination, and 5) executive orders and presidential memoranda to agency heads and officials.

Office of Safety & Health Administration (OSHA): OSHA was created after the passing of the Occupational Safety and Health Act of 1970 to ensure safe and healthful working conditions for working men and women by setting and enforcing standards and by providing training, outreach, education and assistance (www.osha.gov).

Operating Expense: The annual cost associated with the activities necessary to deliver the university’s services.

In general, this will include personnel expense, operations and maintenance, capitalized equipment, and debt service.

Opportunity Cost: The cost, including the loss of revenue or increased expense, of foregoing one alternative in order to pursue an alternate action.

Premium: Money paid by contract in exchange for promised coverage defined in an insurance policy, bond, letter of credit, etc.

Principal Investigator (PI): Lead scientist for a science or research project. Responsibilities include oversight of compliance with pertinent laws, regulations, policies, and award terms (if applicable).

Resource Conservation and Recovery Act (RCRA): The Resource Conservation and Recovery Act, enacted in 1976, is the principal federal law in the United States governing the disposal of solid waste and hazardous material.

Retrospective Rating: An experience-based rating program whereby a provisional premium is charged at the beginning of the plan, followed by a series of annual audits after the policy has expired to account for losses and determine the final premium.

URMIA White Paper: Executing a Total Cost of Risk Model

40

Risk Management Cycle: A five-step process of 1) risk identification, 2) analysis, 3) technique selection, 4) implementation, and 5) monitoring.

Risk Retention Group: A corporation or limited liability association that is owned by its members and spreads risk and results among the members.

Self-Insurance Program: A program whereby the institution retains all or a portion of a risk.

Self-Insurance Funds: A calculated amount of money set aside to compensate for losses retained under a selfinsurance program.

Third Party Administrator: An organization retained by an institution to administer and manage its claims retained under self-insurance programs.

Tort: A wrongful act other than a breach of contract that injures another and for which the law imposes civil liability.

Total Cost of Risk (TCOR): All costs borne by a university or college due to the possibility of risk. These costs are typically illustrative of a point in time that can be used to create an institution’s own benchmark comparison.

Ultimate Claim Cost: The total amount of money paid for a claim over time, determined at the time of the final closure of the claim.

41

URMIA White Paper: Executing a Total Cost of Risk Model

Additional Resources

Ackley, Sheri, et al. 2007. URMIA White Paper: ERM in Higher Education. Bloomington, Indiana: University Risk Management and Insurance Association.

Association of Governing Boards (AGB) and United Educators. 2009. The State of Enterprise Risk Management at Colleges and Universities Today.

Cassidy, Dale; Larry Goldstein; Sandra L. Johnson; John A. Mattie; and James E. Morley, Jr. 2001. Developing a Strategy to Manage Enterprisewide Risk in Higher Education. National Association of College and University Business Officers (NACUBO) and Pricewaterhouse Coopers LLP: 4.

D’Ancona, Frank, and James Walloga. April 2010. Foreign Travel: Risk and Response. ACE Group Progress Report.

Davey, Barbara A., et al. 2008. URMIA White Paper: Measuring the Total Cost of Risk.

Bloomington, Indiana: University Risk Management and Insurance Association.

Marsh, Inc. 2004. An Executive’s Guide to Risk Management and Total Cost of Risk. Risk Alert: A Report for Clients and Colleagues of Marsh on Risk-Related Topics III(4).

Risk and Insurance Management Society, Inc. (RIMS). 2008. RIMS Benchmark Survey Results Book. New York: RIMS. United Educators. Spring 2008. Reason & Risk 16(1).

43

URMIA White Paper: Executing a Total Cost of Risk Model

Website Resources

American Association of Community Colleges (AACC) (http://www.aacc.nche.edu/).

American Association of State Colleges and Universities (AASCU) (http://www.aascu.org/).

American Council on Education (ACE) (http://www.acenet.edu).

American Society for Healthcare Risk Management (ASHRM) (http://www.ashrm.org/).

Association of American Universities (AAU) (http://www.aau.edu/).

Association of College and University Auditors (ACUA) (http://acua.org/ACUA/College_University_Auditors.asp).

Association of Governing Boards (AGB) (http://agb.org/).

Association of Public and Land-grant Universities (APLC) (https://www.aplu.org/).

College and University Professional Association for Human Resources (CUPA) (http://www.cupahr.org/).

Institute of International Education (http://www.iie.org/).

NAFSA: Association of International Educators (http://www.nafsa.org/).

National Association of College and University Attorneys (NACUA) (http://www.nacua.org/).

National Association of College and University Business Officers (NACUBO) (http://www.nacubo.org/).

National Association of Independent Colleges and Universities (NAICU) (http://www.naicu.edu/).

United States Department of Labor, Occupational Safety & Health Administration (OSHA) (http://www.osha.gov/).

United States Office of Management and Budget (http://www.whitehouse.gov/omb).

URMIA White Paper: Executing a Total Cost of Risk Model

44

Template Resources

Worksheet templates to assist you with the modeling and execution of your institution’s total cost of risk are available in the URMIA online library at my.urmia.org.

The worksheets are designed to lead you through the process of establishing core metrics.

Measurements are automatically calculated as you input your institution’s metrics. In addition, graphics are dynamically generated to visually display the results.

If you need assistance accessing these resources, please contact the URMIA office at urmia@urmia.org or 812-855-6683.

45

URMIA White Paper: Executing a Total Cost of Risk Model

URMIA Home Office P.O. Box 1027 Bloomington, IN 47402 www.urmia.org