Performance Audit of the Office of Risk Management

ORM is aware of best practices in integrated risk management and has proposed the County adopt an enterprise risk management (ERM) approach to proactively identify and address risks. However, in comparing ORM’s ERM plan with a recognized risk management standard, ISO 31000, we found critical weaknesses within the plan. In addition, we identified auto accidents as a major area of claims against the County, finding that the County could improve its driver training systems, both for Metro transit drivers and for other frequent non-transit drivers of county vehicles.

While ORM manages overall claims administration in a timely and professional manner, ORM lacks solid performance measures to assess and improve effectiveness in claims management. ORM’s current Cost of Risk index understates county liabilities by not including workers’ compensation costs.

We recommend that ORM, in consultation with the County Executive, develop a work plan for an integrated risk management framework for the County, allowing the County to realize the benefits of ERM in reducing future claims. We also recommend that ORM track vehicle accident data for non-transit vehicles and develop performance targets for such accidents, as well as improve its internal performance measures and include workers’ compensation costs in its Cost of Risk calculations. Finally, we recommend that ORM work with Metro Transit Division and Office of Safety and Claims to improve driver safety training programs for both transit and non-transit county drivers.

Claims against the County cost the County and its insurers nearly $150 million over the past ten years. The purpose of the audit was to assess the effectiveness of the King County Office of Risk Management (ORM) in claims management, processing, and other administrative functions, and in preventing and reducing losses and protecting King County’s assets by identifying and addressing potential risks and liabilities. We also reviewed the effectiveness of the County’s overall approach to risk management.