Create State Risk Office

Section 1. The executive law is amended by adding a new article 10-A to read as follows:

ARTICLE 10-A

OFFICE OF RISK ASSESSMENT AND MANAGEMENT Section 204. Definitions.

205. Office of risk assessment and management; qualifications of

risk manager.

206. Functions and duties of the office.

207. Board of risk assessment and management.

§ 204. Definitions. For the purposes of this article:

1. "Enterprise risk management" shall mean a strategic discipline that supports the achievement of the state's objectives by addressing the full spectrum of its risks and manages the combined impact of those risks as an interrelated risk portfolio.

2. "Local government" shall mean any county, city, town, village, supervisory district, school district, fire district, improvement district or special district.

3. "Office" shall mean the office of risk assessment and management established pursuant to section two hundred five of this article.

4. "Risk manager" shall mean the risk manager of the office.

5. "State agency" shall mean any department, division, board, commission, bureau, office or other agency of the state.

§ 205. Office of risk assessment and management; qualifications of risk manager. 1. There shall be established within the office of general

EXPLANATION--Matter in italics (underscored) is new; matter in brackets

[ ] is old law to be omitted.

LBD11029-01-7

A. 7416 2

services, an office of risk assessment and management. There shall be appointed by the commissioner of general services the risk manager of the office, who shall be charged with the duty of administering the office. The commissioner of general services shall fix compensation of the risk manager within the amounts appropriated therefor.

2. The risk manager shall have the following qualifications:

(a) an understanding of and the ability to apply the generally accepted principles, standards and techniques utilized for the identification, assessment and management of enterprise risk; and

(b) sufficient experience in identifying, assessing and managing enterprise risk exposures that present the breadth and level of complexity of issues that can reasonably be expected to be raised during the course of state operations.

3. Every risk manager shall have acquired his or her qualifications, as required by subdivision two of this section, through appropriate education and relevant risk management experience on behalf of a commercial or governmental organization.

§ 206. Functions and duties of the office. 1. The function of the office shall be:

(a) to determine the potential exposure of the state to liability and financial loss arising from its acts and omissions, from the ownership, control or use of its real and personal property, or conduct or actions of its employees or agents;

(b) to establish and coordinate business continuity programs for essential state functions and services;

(c) to implement risk management programs to manage the state's exposure to risk in the most cost effective manner including, but not limited to, programs to reduce the likelihood and potential cost of loss events, and the purchase of insurance or other risk sharing arrangements where appropriate; and

(d) to coordinate and support the risk management programs of all state agencies.

2. The risk manager and office shall fulfill their functions and duties by:

(a) conducting a study of the state's risk exposures on an ongoing basis. Such study shall include:

(i) practices and procedures of all state agencies, as they pertain to, impact upon, cause or deter damage or loss to: physical property owned or controlled by the state, or physical injuries sustained by state employees, persons receiving services from the state or members of the general public;

(ii) the actions, claim settlements, and claims settlement processes related to actions in the court of claims, and in federal and state courts of competent jurisdictions as they relate to the disposition of matters against the state. Furthermore, for the purpose of determining past, present and future exposures to liability, the nature and magnitude of such exposures, and the techniques for reducing the cost of managing and settling claims arising from such exposures;

(iii) the essential operations and service functions of the state, and the procedures necessary to maintain or restore such operations and functions to the required level following an emergency event;

(iv) the potential future liabilities arising from existing or proposed state operations or functions;

(v) the preparation of an inventory of all real property owned or leased, for a period of time of more than five years, by all state agen-

A. 7416 3

cies, and to ascertain past, present and potential future liability exposures and the nature of those exposures; and

(vi) the design and implementation of appropriate cost effective techniques and programs to reduce the cost of the state's exposure to liability and financial loss arising from its operations or the ownership, control or use of real and personal property, including recommending steps and procedures to be implemented by individual state agencies.

The risk manager, in the performance of such study, shall enjoy the full cooperation and assistance of state agencies and the court of claims; and

(b) recommending and implementing the appropriate risk management and business continuity programs as shall be necessary.

3. Such study and recommendations shall be completed and sent to the governor, comptroller, attorney general, executive officer of each state agency included therein, temporary president of the senate, speaker of the assembly, minority leader of the senate and minority leader of the assembly no later than eighteen months after the effective date of this article. The study and recommendations shall be revised and updated as is periodically deemed appropriate by the risk manager; provided, however, that such study and recommendations shall be revised and updated not less than once every five years.

4. The office shall advise the various state agencies on proper enterprise risk management techniques and procedures, and the implementation thereof, for the purpose of reducing exposures to liability and financial loss, or the disruption of essential state operations and functions, as well as all responsibilities and duties of the bureau of insurance in the office of general services. Those agencies involved in or responsible for the construction or maintenance of structures or roadways, the care and custody of persons more than in temporary quarters, the provision of services of the general public, and those agencies with vehicles assigned for their use, shall undergo detailed enterprise risk management analysis and, wherever practicable and after the agency is granted an opportunity to review and appeal the findings and recommendations of such analysis, implement the recommendations of the risk manager within one hundred eighty days of the date that such recommendations are agreed to by the executive officer of such agency.

5. The risk manager shall file an annual report on the activities of the office with the governor, comptroller, attorney general, temporary president of the senate, speaker of the assembly, the minority leaders of the senate and assembly, senate finance committee and assembly ways and means committee, no later than one hundred eighty days after the completion of the calendar year to which the report refers.

6. Any public benefit corporation, public authority or local government may contract for the services of the risk manager and the office in the event that such public benefit corporation, public authority or local government is without internal risk assessment and enterprise risk management services, or wishes to supplement such internal services with the services provided by the risk manager and the office.

7. The risk manager may review, study and enter into a relationship with: (a) outside vendors or consultants with expertise in risk management, claims management or safety management, and (b) captive insurance companies, as defined in subsection (c) of section seven thousand two of the insurance law, or other risk sharing entities to reduce personal injury or property damage liability claims and payments, either on an annual basis or over a longer period of time, for all state agencies, or

A. 7416 4

an individual state agency, public benefit corporation, public authority or local government.

§ 207. Board of risk assessment and management. 1. There is hereby established, within the office, a state board of risk assessment and management. The board, to be comprised of the risk manager, the commissioner of general services, the chair of the state insurance fund, the president of the state civil service commission, the director of the office of employee relations, the director of the division of the budget, and a representative of each of the public employee organizations with the three largest memberships. Such board shall meet quarterly for the purpose of examining current methods of enterprise risk management and control deployed by the state, and review instances of difficulty in deploying sound risk assessment and enterprise risk management procedures.

2. A summary of the proceedings of the board, with recommendations for improvement of the state's risk management practices and procedures, shall be included in the annual report of the risk manager. The risk manager shall take into consideration the recommendations periodically made by the board in conducting his or her management and abatement of potential liability activities.

§ 2. This act shall take effect on the one hundred eightieth day after it shall have become a law, except that any rules and regulations necessary for the timely implementation of this act on its effective date shall be promulgated on or before such date.