I recently attended a risk management seminar for sports and recreation facilities, businesses with a high potential for big liability losses. The tone of the seminar bothered me. The speakers were a loss control professional, two defense attorneys and a representative of the trade association hosting the event. The attendees were well aware of the risky nature of their operations but only one or two were professional risk managers so they had to depend upon the information presented.
The disturbing message I heard was that a facility needs lots of policies and procedures but shouldn’t write them down. The speaker while discussing the need for a policy for handling children using the facilities, said to have a policy, make sure all employees know it but don’t write it down. What? How do you run a business, association or nonprofit without having written policies and procedures especially on children? How will your employees and volunteers know how to do their jobs?
The theory behind this “no written policy” belief is that if your policy says that employees must do X you have created a standard or duty of care. If the employee didn’t do X and someone got hurt the organization has breached its duty and may be liable. BUT if you don’t have a policy then you don’t have a duty to perform (not true). Consequently without a standard you can’t breach it and without a breach of duty you can’t be liable. Interesting theory but it’s not practical in the real world.
Policies are a double-edged sword. Your policy may create a standard of care which exceeds the basic requirements and put you at risk. However whether you have a policy or not society has its own opinion on the expected duty of care. Your behavior during a loss will be examined on the legal concept of the “reasonable or prudent person.” Under the prudent person rule the court will judge your behavior against the conduct of a hypothetical prudent person with similar background and experience under similar circumstances. So the legal system will get you either way. In the extreme, a court could rule that it was negligent to not have a policy for handling certain types of situations especially if similar organizations have established policies to address the issue. For example, the public expects organizations serving children to have a staff screening program. If your organization doesn’t have a screening program, your defense is a lot harder since the plaintiff’s attorney will argue a prudent organization would have such a program. Aside from the legal aspects, don’t you want to protect children from predators?
The issue isn’t whether or not you should have written policies, procedures and guidelines (you should) but that these documents need to be written properly. You don’t want your policies to exceed but rather meet the prudent person standard. Once you decide the need for a policy, it should:
- Support your organizational culture and values so the information is somewhat intuitive.
- Be practical and enforceable (and you enforce it).
- Be flexible so you have some discretion in interpreting the policy and the proper discipline.
- Be consistent throughout the organization.
Once you have written the policy you need to design a training and education program to make sure all personnel know and understand the policy. It is really bad to have a policy that no one follows – the plaintiff’s attorney love that since you just made it easier for them to win.
So my risk management advice is to have well-written policies and monitor their usefulness and enforcement. Don’t be afraid to change or drop a policy that isn’t working. Your employees, volunteers, members, customers, clients and service recipients will benefit from your efforts.