Fundamentals of Risk Management

Control of selected hazard risks 
277
include encouraging former staff members with deferred benefits to opt out of the 
scheme by paying them a sum of money, transferring the deferred benefits arrange-
ments to an insurance company on payment of an annuity premium or seeking to 
transfer the deferred benefits into a captive insurance company.
Historical liabilities of this type are, by definition, more of an issue for organiza-
tions that have been in existence for some time. This means that the organization will 
have a long history and third parties will be able to pursue liabilities that arose some 
considerable time ago. These historical liabilities may be more severe if the organiza-
tion has changed in nature over time, especially if it is a much smaller organization 
than it had been previously. Also, organizations that have undergone a good deal of 
acquisition and merger activity will be more at risk.
Control of infrastructure risks
Health and safety at work
One of the major areas of concern in relation to infrastructure risks for organiza-
tions is health and safety at work. This is a highly regulated topic that should be a 
priority concern for all organizations. It is a well-established discipline within risk 
management, although it is often managed as an independent function.
The health and safety risks faced by an organization include prosecution by a 
regulatory authority, being sued by an injured employee and disruption caused by 
accidents and dangerous occurrences. Many health and safety tools and techniques 
are applied in broader risk management activities and there is no doubt that the
full cooperation of health and safety specialists is vital to the success of any risk 
management initiative.
Undertaking risk assessments in relation to health and safety has been established 
for a long time. These risk assessments can be generic when the risks are relatively 
low. For high-risk activities, specific written detailed risk assessments will usually be 
required.
The features of a risk assessment include identification of the hazard, identifica-
tion of who might be injured by the hazard and analysis of how serious it would be 
if an injury occurred. Details of the controls and precautions in place, together with 
the information on further actions that are required, should also be included as part 
of the risk assessment. The only purpose in undertaking a risk assessment is to ensure 
that controls are adequate and that people are not inappropriately at risk.
There is a hierarchy of controls that is well-established in relation to health and 
safety risks and this hierarchy is set out in Table 16.2. The overall generic control 
categories of preventive, corrective, directive and detective controls also apply to 
fraud risks, and Table 16.2 shows the equivalent categories of fraud control in
comparison with the well-established terminology for the hierarchy of health and 
safety at work controls.
Having undertaken a risk assessment of the health and safety risks, organizations 
need to introduce controls that will include strategies for minimizing the risks
(preventive controls), strategies for controlling the hazard (corrective controls),

---