The first step is to perform a Risk Assessment. This allows BRMS to become familiar with an organization and its attitudes towards risk management. This may involve a complete review of financial statements, contractual agreements, various property listings, loss history, and past insurance policies. During the on site visit interviews will be conducted with department heads. The purpose of this extensive process is to identify the organization's principle risk exposures and the programs (if any) currently in place to control them.

Once the risk exposures have been identified they will be quantified by levels of frequency and severity of loss. It is important to understand the potential financial impact of each exposure in order to determine the best ways to manage it. Frequency refers to how often a loss occurs, and severity refers to how expensive one individual loss is or could be.

The feasibility of implementing various types of risk management techniques will then be examined based upon the nature of the loss exposures and the organization's ability and willingness to retain loss. The best combination of risk control and risk financing techniques for the organization will then be selected and implemented.

The final and often most important step in the risk management process is to monitor the program. Is it performing as it should? Have the operations, personnel, and property holdings of the organization changed? Has the law changed? Has the insurance market changed? These items can have a significant impact on the effectiveness of a risk management program.