Glossary

Risk management

Identifying, assessing and treating threats to an organization by avoiding, reducing, transferring or retaining them; insurance is one tool among several.

Also called: risk management process, business risk management

Risk management is the discipline of deciding what could go wrong for a business and what to do about it. The cycle is simple: identify exposures to property, liability, people, cyber and supply chains; analyze each by likelihood and severity; choose a treatment; and monitor the results. A risk register records the outcome.

There are four treatments. Avoid the activity altogether. Reduce the likelihood or severity with loss control, such as safety programs, sprinklers and tested backups. Transfer the financial consequence, by insurance or by contract through indemnity clauses and additional insured requirements. Retain it through deductibles, a captive or reserves. Say a restaurant's worst severity risk is a grease fire. It cleans its hoods on a schedule (reduce), carries property and business income coverage (transfer) and accepts a $2,500 deductible (retain).

Insurance fits low-frequency, high-severity losses a business cannot absorb. It is a poor tool for frequent small losses the business could pay itself, since the premium then recycles those losses plus the insurer's expenses and profit.

The common mistake is equating risk management with buying insurance. A program with no loss control, no contract review and no written plan transfers risk at full price and reduces none of it. total cost of risk measures the whole bill: premiums, retained losses, administration and the cost of controls. The guide on risk management for small businesses: a practical framework offers a practical framework, and Enterprise risk management (ERM) explained covers the larger-company version.

Last reviewed October 10, 2026

In the index now

Related terms

Total cost of risk (TCOR) The full annual cost of carrying risk: insurance premiums, losses you retain, and loss-control and administrative spending, often shown as a share of revenue. Loss control The inspections, safety programs and physical improvements that a business and its insurer use to make claims less frequent and less severe. Retention The share of a loss a business pays itself, through a deductible, self-insured retention or captive, before insurance responds. Captive insurance company A licensed insurer owned by the business or group it insures, formed to underwrite their own risks rather than buying all coverage from outside insurers. Hold harmless agreement A contract clause in which one party agrees to take on another party's liability for specified claims, usually those arising from the first party's work.

Related guides

Annuities for business owners: where they fit and how they are taxed Where annuities appear in business planning, from retirement plans to buyout payments, with the tax mechanics of IRC 72 and the rule on entity-owned annuities. Writing a broker RFP for a commercial insurance program How to run a broker RFP: what to send, questions on compensation and claims advocacy, a scoring matrix, and how to avoid blocking carrier markets. Enterprise risk management (ERM) explained What enterprise risk management is, how COSO's 2017 framework and ISO 31000 define it, how risk appetite works, and how an ERM program changes insurance buying. Insurance designations: CPCU, ARM, CIC and more What CPCU, ARM, AIC, AU, CIC, CISR and CRM require, who each suits, and how a designation differs from a state license. Checked against the providers in 2026. Risk management for small businesses: a practical framework A five-step risk routine for small businesses: list exposures, rate them, choose avoid, reduce, transfer or retain, assign owners, and review every year. How to build a risk register A risk register is a table with one row per risk. The columns to use, a 1 to 5 scoring scale, a worked example and how to keep it current and tied to insurance.