Of course, many of the exposures to be managed are first-party risks, such as buildings and business personal property. Such cross-functional teamwork is more likely to occur if one institutionalizes and perpetuates it by welding the two functions together within the corporate legal department of office of the general counsel. Further, there is a productive synergy that comes from having the risk manager an in-house legal counsel share ideas and team up on projects. Risk managers deal with liabilities, and the legal department is very concerned with these too. Some observers feel that the risk manager should be part of the legal department. Too often one sees line management trying to shift the ultimate responsibility to the risk manager or safety director.

As such, the risk manager will develop plans to control and reduce risk, but the implementation of all risk control, safety and loss prevention actions remains a line management responsibility. The risk manager should be involved in all early discussions of any major changes in facilities, products or processes. Regarding risk management's involvement in purchasing, many would have the safety director involved in the decision-making process for buying equipment, tools, and any changes or additions to buildings or facilities which impact on safety.

They are integral parts of controlling the ultimate cost of risk for an organization.Īs for the scope of the risk management function, one could include usual property loss exposures, legal & liability exposures (including 'newer' exposures such as employment related practices liability exposures), product liability, auto fleet exposures, and regulatory compliance (FDA, OSHA, EPA, etc.). You can't properly manage loss costs if you separate risk management, safety, and claims management. Claims management can also be part of the risk manager's responsibilities, though the actual handling of the claims might be delegated to human resources, a third-party administrator, insurer, etc. If the medical device company is too small to support a safety director, the risk manager should have those responsibilities. The risk management function (or department, if the organization is large enough) should include risk evaluation (identifying risks, determining the probability and severity of the risk, etc.), developing appropriate controls to reduce or eliminate risk (safety policies, engineering controls, transfer of risk to others, etc.), and risk financing (insurance, self-insurance, risk retention levels, decision not to finance risk at all, etc.).Īs a result, many feel strongly that safety directors should report directly to the risk manager. Let's look for some other suitable ports for the S.S. While this makes sense, it is hardly the only option. Some feel that the risk manager should report directly to the chief financial officer, since the purpose of risk management is to protect the organization's financial assets from potential risks and losses. Nor is the medical design professional's goal to avoid all risk, but rather to manage it and take only smart, calculated risks. The risk manager does not make products or services which the medical device firm sells in order to stay afloat. The risk manager's role is to be an enabler and facilitator, to serve those who make products. Medical device businesses exist, not to manage risks, but rather to make innovative technologies and earn a profit. In virtually all medical device firms, risk managers hold staff - not line - positions. Regardless of where the risk manager is, one matter is clear. Which is best? In lawyerly fashion, the answer is probably: 'It depends.' What are some of the pros and cons of locating the risk management function in one area or another? In a few organizations, the risk manager is part of the legal or safety departments. Typically, the risk manager is lodged in the finance department.

Most risk managers seem to report to either a CFO, a treasurer, or a vice president of finance. Among them: Where does risk management belong on the organizational chart? Assuming a medical device company recognizes a need for a risk manager, other questions come into play.