The Ins and Outs of a Workable Risk Management Plan

Oct 23, 2020

By Jim Moss
 
As a former litigator, I dreaded finding a risk management plan as an item I needed to disclose to the plaintiffs. They have become road maps for plaintiff’s counsel to sue and checklists for winning those lawsuits.
 
It is impossible to identify all the risks associated with any business, facility or event. If you try, the library you have written will have no value except to a plaintiff. One who is looking to see what you did wrong since your plan will lay out every rule you failed to follow.
 
Once you have identified potential risks, you have to start the process again, because so many things have changed. Any maintenance, sign changes, or staff changes will probably require alterations to your risk management plan.
 
What’s worse, the next accident or emergency that occurs will probably not be found in your plan. When you roll the dice, the results can circumvent your carefully written plan, leading you back to square one. In short, you will be left dealing with an emergency you never thought or one that took off in a direction you never imagined.
 
In 45 years of guiding on rivers and mountains, as well as my 35 years of practicing law, I’ve never found an incident that was described in a risk management plan. Consequently, every response to an emergency is off the cuff.
 
Ultimately, you are constantly re-writing or redoing your plan on the fly, providing the plaintiff’s attorney with a simple checklist of what you were supposed to do and when.
 
Here’s an example: your plan says in any emergency you are to first call the risk manager who will determine if the issues need outside response or can be handled in house. That’s a great idea, there’s no need to call paramedics when a band aid suffices. The next step in the plan is to assess the situation by the person reporting the emergency with a simple checklist of information the risk manager believes he or she needs. That checklist has 10 to 12 items the risk manager needs answered before implementing the plan.
 
When you have an arterial bleed you need outside help, immediately. If you follow the plan, you will be sued for waiting too long to provide first aid. If you don’t follow the plan, you will be asked, on the stand, why you didn’t follow the plan. Either way, you are squirming on the witness stand, which is the last place you want to look incompetent, or, worse, wrong.
 
Another issue with a comprehensive plan is the fact no one who will be using it has ever taken the time to read and understand it. Only the author can decipher the multi-volume treatise created, so again, the plan is ignored as the problem explodes. And once again, you have provided the opposing attorney; the opportunity to find fault. “Why did you not follow your risk management plan?” Your answer will probably be “because the issue was not in the risk management plan.”
 
The next question you will face: “This seems like something that would occur every day, and you failed to identify it and put it in your plan?”
 
Most front-line employees are not paid to read and understand the plan, yet 99 percent of the time they are the employees that are expected to execute the plan when a problem arises. They often are not given any training other than to follow the plan. However, your guests, customers and clients expect all employees to know and understand the risk management plan. Their lawyers will point that out to the jury, repeatedly.
 
Finally, a plan has no value unless it can be implemented. Your front-line employees, those dealing with the future plaintiffs won’t ever have access to the plan, will never understand the plan, and you will never train them on the pan.
 
Here are some suggestions:
 
First: Only write down what you have trained on.
 
That is something the employee can carry, read, understand and use in an emergency. You never see an EMT arrive in an ambulance to a medical scene and pull out a book to figure out what to do next. But you are expecting your employees to understand everything you wrote.
 
For your risk management plan to work, it needs to be something employees can understand and execute. The perfect risk management plan is one that can fit into an employee’s pocket or on the back side of his employee ID, or a 3×5 card.
 
So, how can you create an effective risk management plan that any employee can access and use? First, try to think differently and try not to think of what could go wrong. Second, use the tools at your disposal. You have employees who use a phone, radio or some system of communication. Make sure to effectively use those means of communication.
 
A scenario where you have a brush fire next to the stadium based on a comprehensive plan would identify water outlets, hoses, rakes, shovels and maybe moving valuable property out of the way. Great, but it does not provide you with solutions, just lists. It provides the opposing side with a checklist. Did you get the shovels? Did you have enough shovels? Why didn’t you have enough shovels?
 
Instead, think about what you have. You have a maintenance crew that has immediate access to everything you need. You have personnel on hand to move valuable equipment. You have transportation to move cars because they have the keys.
 
The front-line employee with his 3×5 card checks it thoroughly. The first thing on the card says what is wrong. The second thing says: call your boss. If his/her boss is not available, then call his or her boss’ boss. Next, keep calling with your radio or phone until someone is reached. That higher-up manager can call 911. All of this information can be on the back of the 3×5 card. The front side says what is wrong, get people out of the way and call for help. The back side of the card has the names of the people to call and how best to reach them.
 
Why round up shovels, hoses and rakes if no one is around to use them. Why organize people who have never used a shovel to put out a brush fire. The maintenance crew probably has the tools and experience.
 
Second: Don’t just write a plan, write an education program for employees.
 
Without proper training, every risk management plan has little chance of succeeding. If your employees are not trained in how to use every aspect of your plan, who knows what types of problems that they will run into and when.
 
Third: Don’t just write a plan, create a response.
 
Using this approach your risk management plan will become an easy tool everyone can use. When I wrote a risk management plan for a ski area that included 27 lifts, 2800 condos and hotel rooms, 27 restaurants/bars, 120 vehicles for 300 to 3,000 3000 to 300 (depending upon the time of the year and two day-care centers) it came out to be 27 pages long.
 
The ski patrol knew the plan well and they used it every day. While our snow shovelers did not, they could read a 3×5 card and knew where the phones were around the property.
 
Fourth: Create a plan that will be understood by the people who are responding.
 
More importantly, the ski-area plan was based on the Incident Command System. The ICS system is used by all law enforcement, fire and land management agencies to deal with problems. It was designed so that teams of fire fighters, law enforcement personnel, forest service officers and secret service agents could work together using a system that coordinates identical responses, paperwork and like-minded training.
 
When you see fires burning through the west or a hurricane rips up the east coast on the nightly news, the responders, whatever the badge on their shirt says, are using the ICS system to communicate, respond to, and track the issues they face.
 
If your risk management plan follows this program, then fire, search & rescue or law enforcement officers arrive on the scene and resolve the problem.
 
Think about how many changes you would have to make in your risk management plan in the past decade with new risks. Terrorists, hostage situations, Covid-19 and what about serving alcohol and the related problems at stadiums. The pages you threw away when you stopped serving alcohol you are now frantically trying to locate when you started serving beer again.
 
Fifth: Write a plan that stays up to date.
 
Keep these questions in mind. What is your liability when you don’t keep your plan up to date? How many plans had been written to cover infectious diseases?
 
When writing the plan, understand that you have control over it. When an incident occurs, factors that were previously thought to be controllable can become problems. A few of the problems that can occur: employees can panic, tools required to address the problems are not where they are supposed to be, and/or and the person who knows how the plan is supposed to work quit six months ago.
 
Sixth: Don’t confuse a response to a problem as changes that need to be made.
 
One of the worst feelings a litigator can have is going through a client’s risk management plan after a disaster. If a plan had a specific course of action based on prior incidents and included documentation of those incidents, but the organizers did not list/implement changes to the plan (or make a new plan), litigators will likely become concerned.
 
Creating a safety improvement plan, as part of your risk management plan, could benefit a plaintiff’s attorney.
 
For example, a ski patrol office used to have a giant map of the area on the wall (near base camp). When an accident occurred, a pin would be placed on the map so the patrollers could identify area(s) causing issues.
 
The plaintiff’s attorneys would photograph those maps/pinned locations, and then show how the accident they are suing over occurred at a place with known problems.
 
You should always create a list of what needs to be done. Anytime any list is created you need to create a program and someone to make sure it gets done. It is not part of risk management; it is part of everyday life in the industry.
 
Seventh: A risk management plan is not a legal defense tool; it provides a map for how to solve problems, nothing more.
 
Don’t confuse risk management with a liability defense. They are not remotely the same thing. Risk management is dealing with problems and resolving those problems. A liability defense is how you stop lawsuits from happening or win a lawsuit. If every person who fell down and skinned a knee sued you when leaving a stadium, you would be in court forever. Most people don’t. A lot of people just want a band-aid or dry cleaning. The people who want more recompense can often be assuaged if you listen and respond to their complaints. If all else fails, send these individuals to said organization’s legal department.
 
Eight: Train, educate and improve your employees as efficiently as you can
 
As stated above, a risk management plan must be understood by everyone who is expected to respond to a problem(s). This means that 100% of your workforce, including volunteers, must know and understand the plan. My guess is that the only person who knows and understands a risk management plan in a vast majority of companies across the U.S., is the person who wrote it.
 
You must also make the training as realistic as possible, within reason. Think about angry parents or relatives, the media and public officials who work in law enforcement or medicine. No incident occurs in a vacuum.
 
The mysteries of evacuating people from a chairlift are all over YouTube for people to see. However, if a real incident occurs, the media will still be there, asking questions. Friends and relatives of those involved, as well as bystanders are going to be in the vicinity. Some could be upset, pester some and angry, while others might be offering assistance. Think about the chairlift accident several years ago where one of the riders worked from CNN and reported from the lift.
 
Nine: Don’t confuse paperwork with planning.
 
Too often I have walked into an office after the summons and complaint, have been served and the accident report is stacked on top of a 3-ring binder or binders. The binders are dusty and say on the spine Risk Management Plan. You likely have no chance of winning.
 
Even the ICS system goes too far, sometimes. The first thing on a plan page is the objective, and you write out the goal based on the broad problem. The goal is not to make things worse. Secondary goals include assessing the situation and solving the problem. Those lines should be included in the objective of every risk management plan.
 
What happens if you don’t follow your detailed plan? Sometimes, you can get lucky and not face any challenges or collateral damage. If it does not work, you’ve given the plaintiff materials they need to sue you.
 
I was once approached at a restaurant by a woman who had lost her husband at a ski area during the summer. She had transported him to the top of the adjoining pass, and he was hiking home. He expected to be home in a few hours. (Knowing the terrain, I would have taken a sleeping bag and breakfast.) She had a hand-held radio and intermittently could hear him. A comprehensive plan would have said organize people, call in SAR, lay out a grid line and finally find him later the next day.
 
I put the lady with the radio in the front seat of my car and drove up the pass. I knew he had been descending and ascending valleys and ridge lines all day. Those valleys could not be seen from the ski area. When he was in a valley, he could not communicate with his line of sight hand-held radio. By driving up the ends of the valleys, we quickly established clear communication and had him walk toward the sound of the semi’s passing us. 45 minutes after the lady found me; I was back, finishing up a cold dinner.
 
No plans were broken because the first step is assessing the situation. I did; I knew what we needed, and I could call in help quickly if needed. I also knew we had 4-5 hours of daylight left and there was a good chance, I could find him in one of the valleys. Problem solved and no self-imposed rules broken.
 
Did I take a risk? Yes. I delayed calling for more help by an hour. However, I had the freedom to think through the problem and come up with a viable solution. Instead of following a checklist, I thought about the problem. Intermittently she could communicate with her husband. I knew why; line sight radios worked on top, not in the valleys.
 
Ten: A risk management plan is a response for employees to know and use, not a marketing piece.
 
Many times, a risk management plan will be advertised or at least mentioned to guests. This approach can become part of the complaint, with plaintiffs arguing “People went to this business because they knew it was prepared.
 
What’s worse, you see a statement about the risk management plan prominently displayed on the website or in a brochure with a statement that employees have been trained in its use. Eventually, those employees graduated and left, and now your team consists of freshman working for work their first year after high school. They have basic first aid training, but no experience. There’s no easier way to lose a lawsuit
 
Things change, especially employees. If your plan is employee dependent or your business is seasonal, you’ll have to re-write the plan with every change in employees, promotions or season.
 
Risk management plans have become a requirement for businesses, programs, events and activities. Make sure it is written to help your clients, customers and guests. In addition, make sure it exposes you as little as possible.
 
Jim Moss is an attorney who specializes in outdoor recreation law. His clients are manufacturers, importers and retailers of recreation equipment. He also represents outfitters, guides, travel and tourism businesses. In addition, he represents resorts, ski areas and recreation providers worldwide. He can be reached at recreation.law@gmail.com


 

Articles in Current Issue