A risk control report is the fix. Done right, it does two jobs at once: it shows you where injuries actually come from before they turn into claims, and it gives you the documented, defensible record that keeps your loss history — and therefore your premium — from compounding another year.
This guide covers what risk reporting is, how it differs from risk control, the five core control measures, what a strong report must include, and how active claims handling turns that report into real savings. The default lens here is healthcare — nursing homes, home health, and hospitals carry the highest injury risk — but the framework applies to any high-exposure employer.
Key Takeaways
- A risk control report is the structured record of an organization's key risks, control status, injury trends, and mitigation progress — and it directly feeds the EMR that sets your premium
- The five control measures — elimination, substitution, engineering controls, administrative controls, and PPE — form a hierarchy ranked from most to least effective
- A strong report includes an executive summary, a scored risk register, key risk indicators, named mitigation ownership, and trend data
- Reporting only pays off when someone acts on it — evaluating incidents day one, correcting inflated claim values, and moving injured staff to light duty is where premium savings actually come from
What Is a Risk Control Report and Why Does It Matter?
A risk control report is the systematic record of identifying, scoring, documenting, and communicating an organization's risks to the people who can act on them — leadership, operations managers, and safety teams. The goal is informed decisions before losses occur, not an autopsy after.
OSHA's hazard-identification framework pulls from the same sources a good report should: injury and illness records, workers' compensation loss data, near-miss reports, incident investigations, and control-status information. Together they show where exposure actually lives — the wet floors and transfer lifts in a nursing home, not the abstractions in a policy binder.
Beyond Compliance
An effective risk control report does far more than satisfy a regulatory checkbox. It:
- Surfaces hazards before they produce claims
- Ranks risks against each other so budget goes where the exposure is
- Creates a defensible audit trail that demonstrates good-faith safety management
- Feeds the EMR calculation with clean data — which directly affects what you pay at renewal
The cost stakes are real. The average workers' compensation claim costs $47,316 for accident years 2022–2023, with falls averaging $54,499. In a nursing home, a single uncontrolled patient-transfer exposure producing two lost-time back injuries a year adds nearly $100,000 to your loss run — and here is the part that stings: once a claim pushes your premium up, it rarely comes back down even after the claim resolves. Premium stickiness makes every avoidable claim a multi-year cost, not a one-year one.
Reporting vs. Control: A Critical Distinction
These two functions get conflated constantly, but they do different jobs.
Risk reporting creates visibility — what risks exist, how severe they are, and whether mitigation is working. Risk control is the specific action deployed to reduce or eliminate those risks. Neither works alone. Reporting without control leaves you with a well-documented record of things getting worse. Control without reporting means taking action you can't measure, defend, or get credit for at renewal.
There is a third piece most guides skip entirely: claims control. You can report and control hazards perfectly and still bleed money if, once an injury happens, no one manages the claim itself. That is where a brokerage that handles the claim directly — rather than handing you off to the insurer's adjuster — changes the math. More on that below.
The 5 Core Risk Control Measures Every Employer Should Know
The Hierarchy of Controls is the internationally recognized framework for managing workplace risk. NIOSH ranks the five control tiers from most to least effective, and the principle is simple: fix risk at the highest tier you can before falling back on lower-order measures.
Elimination
Elimination is the most effective control because it removes the hazard entirely — discontinuing a dangerous task, retiring defective equipment, redesigning a process so the exposure no longer exists. In a care setting, that might mean eliminating manual patient lifts on a wing altogether. It's the only control that guarantees the risk is gone, which is why it should always be evaluated first, even when it looks impractical.
Substitution
When elimination isn't feasible, substitution swaps a hazardous process or material for a safer one — replacing manual transfers with ceiling-mounted lift equipment, switching to a less caustic cleaning agent. Substitution reduces the severity of the exposure rather than removing it outright.
Engineering Controls
Engineering controls are physical or design changes that isolate workers from the hazard: mechanical lift systems, non-slip flooring, ergonomic workstation redesign, sharps-disposal engineering. Their advantage is that they don't depend on employee behavior — a lift is either used or it isn't. NIOSH data from Ohio's Safety Intervention Grant program found engineering controls were associated with $4–$7 million in avoided workers' compensation costs per year between 2013 and 2017.
Administrative Controls
Administrative controls change how work is done through policy: staffing ratios that limit solo transfers, mandatory rest breaks, standard procedures, pre-shift safety huddles. They're meaningful, but they require ongoing enforcement and human compliance, which makes them less reliable than engineering controls over time.
Personal Protective Equipment (PPE)
PPE is the last line of defense, not the first. It protects the worker only when the hazard can't be eliminated, substituted, or engineered away. Handing out back belts and gloves and calling it loss control is a costly mistake in high-claim settings. OSHA places PPE last because it needs constant effort, correct use, and retraining to work — with no backup when it fails.
Common PPE-first pitfalls include:
- Treating PPE as a substitute for engineering or design fixes
- Skipping fit testing and retraining after incidents
- Providing equipment without enforcing consistent use
This is where an outside partner earns its keep. PCI Consultants' in-house risk managers assess which control tier is actually being applied across your operations and help you climb the hierarchy — part of a broader loss control program that is a key driver of reduced workers' compensation losses. This kind of risk management works alongside claims handling, not instead of it.
What Should a Risk Control Report Include?
A report is only as useful as its structure. Too vague and leadership can't act; too dense and no one reads it. These elements are non-negotiable.
Executive Summary
The executive summary should give an owner the full risk picture in under two minutes:
- Current high-priority risks and their status
- Changes since the last reporting period
- Open or overdue corrective actions
- Any immediate red flags requiring a decision
If it needs explaining to be understood, rewrite it.
Risk Register
The risk register is the backbone: a structured list of every identified risk, each tagged with a unique ID and category, a likelihood score, a severity score, current status, and an assigned owner. A consistent scoring method — a likelihood-by-severity matrix — keeps the register comparable across departments and time. "High" in one wing should mean the same as "high" in another.
Smart registers also separate the workforce by actual risk. A clerical receptionist and a floor nurse do not carry the same injury exposure, and classifying them the same way means you're overpaying premium on the low-risk roles. Proper risk classification makes sure clerical staff aren't rated as if they lift patients all day.
Key Risk Indicators (KRIs)
KRIs are the metrics that signal when a risk is growing or nearing an action threshold. In a workers' comp context, the ones that matter:
- Claim frequency rate — how often claims occur relative to hours worked or headcount
- Average claim cost — tracked against benchmarks (the ~$47,316 all-claims average)
- Days away from work (DAFW) rate — BLS 2024 benchmarks show healthcare at 1.1 DAFW per 100 workers, transportation and warehousing at 2.1
- Experience modification rate (EMR) — the compounding multiplier that ties everything back to premium
One nuance most dashboards miss: NCCI's 2025 State of the Line shows 2024 lost-time claim frequency fell 5% while medical and indemnity severity each rose 6%. A frequency-only view hides a severity-driven cost increase. Track both.
Tracking KRIs is how a program shifts from cost-response to cost-prevention. But a KRI that flags a high-severity claim is only useful if someone acts on the claim itself — reserves it accurately, questions an inflated valuation, and pushes for return to work. That's the difference between a report that measures your losses and one that reduces them.
Mitigation Plans and Ownership
Every risk in the register needs a named owner, a specific mitigation strategy, a timeline, and a current status. Vague responsibility — "the safety team will handle it" — is how corrective actions stall forever. The report should clearly separate risks with active controls from those still awaiting action. The uncontrolled ones sitting in that gap are where the most preventable losses live.
Trend Data and Progress Tracking
Trend data turns the report from a snapshot into a management tool. Track whether high-severity risks are rising, falling, or flat over rolling periods. This is what lets you prove the program is working — and justify continued investment in loss control when you sit down at renewal.
From Report to Result: How Active Claims Handling Cuts Real Cost
Here is what separates a report that documents losses from one that shrinks them. Reporting tells you a claim happened. What you do in the hours and weeks after is where the money is won or lost — and it's the part your insurer has little incentive to optimize.
Day One: Build the Medical Record Before It Can Be Exaggerated
When an injury occurs, PCI evaluates the incident immediately and, where appropriate, sends the injured worker to urgent care right away. That creates an accurate, timely medical record of exactly what was and wasn't injured. That record is your best protection against a claim that quietly inflates over the following months. With PCI, the employer calls the brokerage, not the insurer — and the brokerage handles the claim directly for the life of the policy.
Correcting the "Lawyer Number"
A demand letter might headline a "$250,000 claim." The real medical spend behind it is often closer to ~$30,000 — and it isn't paid as a lump sum. It's paid incrementally, frequently in the range of ~$1,500–$2,000 a month as treatment actually happens. Genuine injuries get paid without a fight. Exaggerated or fraudulent ones get investigated and contested, which protects your loss history and your future premium. Left unmanaged, the insurer tends to pay the headline number and move on. Individual results vary, but the pattern is consistent.
Faster Return to Work
A nurse with a lifting injury doesn't have to sit at home accruing indemnity cost until fully cleared. A structured light-duty transition — moving her into a receptionist-type role within weeks — sharply cuts the real cost of the claim and keeps her connected to the workplace. A well-run return-to-work program is one of the single biggest levers on your loss run.
Why the Default Doesn't Work in Your Favor
Worth being direct about incentives here. PCI is paid by commission from the insurer, not by your claims volume — so there is no upside for us in your claims running high or getting settled fast at face value. That's the opposite of the default arrangement, where the adjuster works for the carrier and "closing the file" counts as success regardless of what it cost you.
Structuring the Program: High-Deductible Options and Scaling
For larger, well-run employers, the report isn't just a safety tool — it's the evidence base for restructuring how you buy coverage.
High-Deductible Programs
A business with a strong, well-documented loss history may qualify for a high-deductible program: you take on a defined first layer of loss (say the first $200K of a $500K program) and the insurer covers the rest. Structured well, this can roughly halve annual premium — think $100K down to about $50K. Claim payments are made monthly (often around ~$3,000/mo) and stop when the condition resolves, with the brokerage actively administering each claim rather than letting it drift. This isn't for everyone; not every business qualifies, and it only works when claims are managed tightly. A clean risk control report is exactly what makes the case to underwriters. You can read more on large-deductible structures and how they're administered.
Scaling and Consolidating
Smaller or newer operations can be grown into better programs over time as their loss history matures. And an owner running several nursing homes under separate policies can often consolidate them into a single master policy for better terms and cleaner, portfolio-level reporting.
Best Practices for Stronger Risk Reporting and Control
Tailor Reports to the Audience
An owner-level summary should look nothing like a floor-level risk register. Leadership needs top-line exposure and trend direction; operations needs specific hazards, control status, and corrective-action owners. One-size-fits-all documents get skimmed by everyone and used by no one.
Use Visuals to Surface What Raw Data Buries
Heat maps, trend lines, and status dashboards let stakeholders see instantly whether exposure is improving or worsening. The Campbell Institute's visual-literacy research found trained workers spotted hazards that would otherwise have gone unnoticed — the same principle applies to how leadership reads risk data.
Build a Culture Where Risk Data Flows Upward Freely
Frontline nurses and aides are usually the first to see an emerging hazard. Reporting systems that are burdensome, punitive, or ignored by management will suppress exactly the information you need most. Incident and near-miss reporting drops sharply when employees don't believe management will act. The fix is demonstrating, consistently, that reported data leads to visible corrective action.
Your Next Step
If you want to know whether your premium actually matches your risk — and whether your claims are being managed or just paid — the fastest way to find out is a review. Send us two things: a copy of your current workers' comp policy and your last five years of loss runs. From there our in-house risk and claims managers can show you where the reporting gaps, the misclassified roles, and the mishandled claims are costing you. Individual results vary, but the review itself is straightforward.
Frequently Asked Questions
What are the 5 risk control measures?
The five risk control measures are elimination, substitution, engineering controls, administrative controls, and personal protective equipment (PPE), ranked from most to least effective. NIOSH's Hierarchy of Controls sets this order, with elimination being the only measure that guarantees the hazard no longer exists. In practice, most high-claim employers over-rely on PPE and under-invest in the engineering controls that actually move the loss run.
What should a risk control report include?
A complete risk control report covers five core elements: an executive summary for leadership decisions, a risk register with scored and categorized risks, key risk indicators such as claim frequency and EMR, mitigation plans with named owners and deadlines, and trend data showing whether exposure is improving or worsening. The best reports also track claim-level status — reserves, return-to-work progress, and any claims whose valuation looks inflated.
How often should a risk control report be updated?
Operational and safety risks are typically reviewed monthly, while strategic and compliance-level risks are commonly reported quarterly. High-priority or fast-moving items — an open litigation cluster or a sudden spike in back injuries on one wing — may need more frequent ad hoc reporting. Active claims, by contrast, should be watched continuously, not on a calendar.
Who is responsible for risk reporting in an organization?
Internally, responsibility sits with the risk-management or safety function, with individual risk owners updating their areas and leadership reviewing for oversight. But most employers with 100+ staff don't have the claims infrastructure to manage the reporting's most valuable output — the claims themselves. That's where a brokerage that provides direct claims management fills the gap, handling each claim directly rather than leaving it to the carrier's adjuster.
What is the difference between risk reporting and risk control?
Risk reporting creates visibility — documenting what risks exist, how severe they are, and whether mitigation is working. Risk control is the active measure deployed to reduce or eliminate those risks: engineering changes, administrative policies, PPE. There's a third piece, claims control — what happens after an injury occurs. You can report and control hazards perfectly and still overpay if no one manages the claim, corrects an inflated valuation, or moves the worker to light duty.
How does a risk control report help reduce workers' compensation costs?
A structured report identifies hazards before they produce claims and gives you the clean, documented history that keeps your EMR and premium from compounding. But the bigger savings come from acting on it — building a day-one medical record, correcting inflated "lawyer number" claim values, paying real costs incrementally instead of as lump sums, and returning injured staff to light duty within weeks. Because premiums rarely fall back down once they rise, preventing and minimizing claims is a multi-year saving. Individual results vary.
