Risk management

Kevin Marsh, the risk manager from a professional liability insurer who spoke in Professional Practice, returns in the eighth week. Last year he explained where an architect's liability comes from and how insurance responds to claims. This year Moss has asked him to look at risk from the point of view of the firm as a business. A claim on a project is only one way a practice can be hurt, he says. Firms also fail when their largest client stops paying, when a founder falls ill, when a computer virus locks every file, when two senior people leave in the same month, or when a fixed fee turns out to be half what the work required. A principal's job is to see these risks before they arrive and decide, for each one, what to do about it.

A risk register

Marsh introduces the tool most firms use: a risk register. It is a simple list of the risks the firm faces, each with an estimate of how likely it is in a given year, how much it would cost if it happened, what the firm is doing about it, who is responsible and when it will be reviewed. Larger firms keep a register for every major project as well as one for the firm. Marsh says the value of the register is less in the numbers, which are rough, than in the discussion it forces among the principals, who must agree on what could go wrong and who will act.

For each risk there are four kinds of response. The firm can avoid it, for example by declining a project with an unacceptable contract. It can reduce it, by lowering its likelihood or its cost, for example with backups that make ransomware less damaging. It can transfer it, usually through insurance or a contract clause that places the risk with someone better able to carry it. Or it can accept it, when the cost of a response exceeds the benefit, provided the firm could survive if the risk occurred.

Ranking risks by expected cost

Marsh helps the students build a register for a small firm. They estimate six risks, each with a likelihood per year, a cost if it happens, the cost of a response, and the likelihood after the response. The expected annual cost of a risk is its likelihood multiplied by its cost. A response is worth its price, on this simple measure, if it reduces the expected cost by more than it costs.

# A firm-wide risk register ranked by expected annual cost (US dollars).
risks = {  # risk: (likelihood per year, cost if it happens, cost of the response, likelihood after it)
    "key principal unable to work for 6 months": (0.04, 430_000, 7_000, 0.04),
    "ransomware locks project files":            (0.08, 200_000, 9_500, 0.02),
    "largest client (40% of fees) stops work":   (0.15, 560_000, 13_000, 0.10),
    "claim on a construction defect":            (0.10, 300_000, 8_500, 0.06),
    "fee written too low on a fixed contract":   (0.30, 65_000, 4_500, 0.15),
    "two senior staff leave in one year":        (0.12, 150_000, 16_000, 0.07),
}
print(f"{'risk':44}{'expected':>10}{'after':>9}{'response':>10}{'worth it':>10}")
rows = []
for name, (p, cost, resp, p2) in risks.items():
    before, after = p * cost, p2 * cost
    rows.append((before, name, after, resp))
for before, name, after, resp in sorted(rows, reverse=True):
    worth = "yes" if before - after > resp else "no"
    print(f"{name:44}{before:>10,.0f}{after:>9,.0f}{resp:>10,.0f}{worth:>10}")
print(f"total expected annual loss {sum(r[0] for r in rows):,.0f} -> {sum(r[2] for r in rows):,.0f} after responses")

risk                                          expected    after  response  worth it
largest client (40% of fees) stops work         84,000   56,000    13,000       yes
claim on a construction defect                  30,000   18,000     8,500       yes
fee written too low on a fixed contract         19,500    9,750     4,500       yes
two senior staff leave in one year              18,000   10,500    16,000        no
key principal unable to work for 6 months       17,200   17,200     7,000        no
ransomware locks project files                  16,000    4,000     9,500       yes
total expected annual loss 184,700 -> 115,450 after responses

The largest client stopping work is the most expensive risk by far, with an expected cost of about 84,000 dollars a year, because a firm that earns 40% of its fees from one client is badly exposed. The response, spending time and money to win other clients so that no single client provides more than about a quarter of the firm's fees, is clearly worth it. A defect claim and an underpriced fixed fee come next, and both have cheap responses: independent reviews, careful contracts and the fee-checking methods of the third week. Ransomware is less likely than any of these, but offline backups and better security reduce its expected cost by three quarters for a modest outlay.

Two results surprise the students. The response to losing two senior people, a retention program of better pay, mentoring and a path to partnership, costs more than the expected loss it prevents on this measure, and so shows as not worth it. And the response to a principal falling ill shows no benefit at all, because insurance does not make illness less likely.

Marsh says both results show the limits of expected values. A retention program does more than reduce one risk: it improves quality, recruitment and the firm's ability to grow, none of which appear in the register. And the expected cost of a principal's illness, about 17,000 dollars a year, hides the fact that it would cost 430,000 dollars if it happened, enough to close a small firm. Insurance against that risk does not change its likelihood; it transfers the cost to an insurer. A firm should not judge insurance by whether its premium is less than the expected loss, which is almost never true, since insurers must cover their costs and profit. It should buy insurance against the losses it could not survive, and accept the small ones.

Insurance for a practice

Marsh lists the insurance a small practice typically carries.

• Professional liability insurance, which the students studied last year, covers claims that the firm's professional services were negligent. It is usually required by the regulator or by clients, and its limits, deductibles and terms matter as much as its price.
• Commercial general liability covers injuries to people and damage to property that are not caused by professional services, such as a visitor who trips in the office.
• Property and business interruption insurance covers the office's contents and the income lost if the office cannot operate after a fire or flood.
• Cyber insurance covers the costs of a data breach or ransomware attack, including recovery, notification of affected people and some liabilities. Insurers now commonly require basic security practices, such as multi-factor authentication and offline backups, before they will cover a firm.
• Key person and disability insurance pay the firm or the founder if a principal dies or cannot work, giving the firm time and money to recover or reorganize.
• Employment practices liability covers claims by employees of discrimination, harassment or wrongful dismissal.

He advises the students to work with a broker who understands design firms, to review coverage every year as the firm changes, and to read the exclusions. Professional liability policies, for example, usually exclude claims arising from guarantees or warranties the architect gives beyond the normal standard of care, and from work the firm does as a contractor or developer. A founder who moves into design-build or development without adjusting the firm's insurance may find that the riskiest part of the business is not covered.

Contracts as risk management

Many of a firm's largest risks are created or limited by the contracts it signs. Marsh and Moss list the clauses that deserve the most attention.

• The standard of care: the architect should promise the care and skill of a reasonably prudent architect in similar circumstances, not perfection or a guaranteed result such as a certain energy rating.
• Indemnities: clauses that require the architect to defend and pay for the client's losses should be limited to losses caused by the architect's negligence, because broader indemnities are often uninsurable.
• Limitation of liability: a cap on the architect's total liability, often linked to the fee or the insurance limit, and an exclusion of consequential damages such as the client's lost rent.
• Payment and suspension: the right to suspend services if invoices are not paid, which protects the firm's cash.
• Scope and additional services: a clear scope prevents the most common disputes.

Standard forms such as AIA B101 balance these risks reasonably, which is one reason to use them. Clients sometimes substitute their own forms with clauses that shift risk to the architect. Moss tells the students to read every client-written contract against the standard form, to mark the clauses that differ, and to ask their insurer or lawyer about any indemnity, warranty or unlimited liability before signing. A contract that cannot be negotiated to an acceptable form is a reason to decline the project, however attractive it is.

Business risks beyond projects

Moss returns to the risks that have nothing to do with buildings. Concentration of clients is the most common danger for a new firm: its first good client may provide most of its work, and if that client's funding is cut or its development director leaves, the firm can lose half its income in a month. Wren's housing studio is especially exposed, because many non-profit housing providers depend on the same government programs. Her plan sets a goal that no client will provide more than 30% of fees after the second year, and that the firm will keep a reserve of three months of costs.

Key person risk is the second danger. In a firm of three founders, each one is essential. If one leaves or falls ill, the others must carry the work and the relationships. The founders' shareholders agreement, which Moss will discuss in the eleventh week, should say what happens if a founder leaves, dies or becomes disabled, including how their shares are valued and paid for. Key person and disability insurance can fund those payments.

Cyber risk is the third. Architecture firms hold large digital files that are their entire working capital, and attacks on small professional firms have become common. Marsh lists the basics: multi-factor sign-in for every account, automatic software updates, backups kept offline or in a separate system that an attacker cannot reach, training staff to recognize suspicious messages, and a written plan for what to do if an attack happens. He says that the firms he has seen recover quickly from ransomware all had tested offline backups, and the ones that paid ransoms mostly did not.

Risk and opportunity

Marsh ends by reminding the students that risk is not only something to be minimized. Every business decision involves risk, and a firm that avoids all of it will never take on the new building type, the new client or the new service that lets it grow. The goal is not to eliminate risk but to choose it: take the risks the firm understands, can manage and can survive, and avoid or transfer the rest. He tells Joon-ho, whose developer plan carries more risk than the others, that the most important number in his business plan is not the expected profit but the largest loss he could survive.

Exercise 8: your firm's risk register

• List ten risks your firm would face, with likelihood, cost, response and owner.
• Calculate the expected cost of each before and after its response.
• Identify the risks you could not survive, and how you would transfer or avoid them.
• Mark three clauses in a client-written contract that differ from the standard form.

Self-check

• Do I keep a risk register and review it?
• Do I know which losses my firm could not survive?
• Have I matched my insurance to my services, including design-build or development?
• Do I read every client-written contract against the standard form?