What could the financial impact of a cyber loss event cost?

How does your operation mitigate its cyber risk?

Looking for relief from reading articles like “Large Scale Cyberattacks Disrupt Essential Substance Use and Mental Health Services” ?

Smaller companies may get targeted with social engineering attacks

For example, an attempt at Funds Transfer Fraud, through phishing, may be frequently seen by small businesses [3]. Weaker security measures are targeted, which is why lower sized operations could find themselves susceptible. [4]

Protection

How can we help? The team at Conrey Insurance Brokers and Risk Managers specializes in risk transfer. This transfer offers protection for the recovery from tangible or intangible losses related to a security breach or similar event arising from digital risks. [1] Cyber insurance allows companies to resume normal business operations faster, minimizing the cost of recovery. [2] Although we are not technology experts, we can also assist with both mitigation, as we are paid by the insurer to help you.

Ranked by expected severity, cyber events could be categorized into the following sub-domains. [5] These all should follow a mitigation strategy:

  1. Ransomware
  2. Composite
  3. Funds Transfer Fraud
  4. Data Breach

 

“Data is from multiple sources, including Coalition’s own global data. Actual numbers may vary significantly from calculator estimates based on additional factors for a given business. The data provided is for informational and educational purposes only.”

References

[1, 2, 5]

Cyber Insurance: Active Insurance & Cybersecurity. Coalition. (n.d.). https://www.coalitioninc.com/

[3, 4]

Rahmonbek, K. (2024, February 1). 35 alarming small business cybersecurity statistics for 2024. StrongDM. https://www.strongdm.com/blog/small-business-cyber-security-statistics

What trends has the National Council of Nonprofits seen?

Challenges From Rising Yields

Higher yields could impact the cash flows of nonprofits that depend on loans or credit lines; because the cost of financing in the U.S. remains the highest since 2008, expense reduction becomes even more vital for nonprofits. [1]

Talent Competition, Shortage

“74.6% of respondents report job vacancies,” so the frequency of nonprofit job vacancy remains.” [2] By comparison, only 33% of private businesses had job vacancies at any time between August 2021 and September 2022, according to U.S. Department of Labor data.” [3]

The severity of the vacancy has pulled back since the 2021 survey reading of 76%, yet 33.8% of the responding nonprofits with vacancies reported 20% or more of their jobs were going unfilled. [4] Nearly another third 32.7% identified vacancy rates of between 10% and 19%. [5]

The root cause lies in the challenge to provide “competitive salaries and benefits, then “they may lose employees and candidates to higher-paying jobs in the for-profit sector.” [6]

Goal: Minimize Costs, Survival and Success

An intelligent insurance broker may have the capability to reduce operational expenses through data analytics, risk management, and insurance.

References

[1]–[6]

2023 Nonprofit Workforce Survey Results. Communities Suffer as the Nonprofit Workforce Shortage Crisis Continues (April, 2023). https://www.councilofnonprofits.org/files/media/documents/2023/2023-nonprofit-workforce-survey-results.pdf

 

How is Commercial General Liability Premium Exposure Rated?

What are the rating and premium basis options for Commercial General Liability exposure? Which cost basis provides the most favorable outcome for your risk management and insurance contracts?

  • (S) GROSS SALES
    • Exposure Rated per $1,000/Total Revenue
  • (A) AREA
    • Exposure Rated per 1,000/Sq. Ft. of space
  • (M) ADMISSIONS
    • Exposure Rated per 1,000/ADM
  • (P) PAYROLL
    • Exposure Rated per $1,000/Annual Payroll
  • (C) TOTAL COST
    • Exposure Rated per $1,000/Total Expenses
  • (U) UNIT
    • Exposure Rated per unit
  • (T) OTHER

Source: ACORD 126 (2016/09)

Directors and Officers: An Overlooked Exposure?

Edited February 6th, 2024 (Originally created November, 2019, by Kyle Langan)

Case: Elon Musk and Tesla vs. SEC

In August 2018, “Musk tweeted that he had funding secured for a plan to take Tesla private [traded publicly since 2010]. It turned out that was not entirely true — something the SEC objected to, given that Musk was the CEO and chair of a publicly traded company” (Marshall). The agency sued, and penalties included “$20 million fines for both Musk and Tesla, Musk stepping down as chairperson for at least three years (though would remain CEO), and Tesla would have its lawyers ‘pre-approve’ any of its execs’ written communications ‘that contain, or reasonably could contain, information material to the company or its shareholders’” (Marshall). The sanctions uncover unique risks for public companies that require well thought-out loss control and prevention techniques in order to limit exposure to these risks. Although Musk is a genius, he failed one of his primary duties and gravely overlooked the possible repercussions of his statements as a director and officer of Tesla. His failure resulted from inadequate risk management for the loss exposures in the actions and words of an officer at a large public company.

Shannon Tornoe says the “primary duty in the responsibility of managing a company is to always act within the best interest of the company and accurately represent key financials.” Musk’s duty is to protect his company as an officer; showcasing a loud virtual mouth on social media is within the scope of this duty and he is solely responsible for being aware of avoiding this. In addition, Musk faced harsh backlash from the public and numerous lawsuits from investors. The vital takeaway from Musk’s mistakes is the high level of risk when insuring actions of Directors and Officers (D&O). Despite the need to protect against severe litigation, coverage for D&O can easily be overlooked by risk management teams in large public companies because they are not correctly evaluating loss exposures. Executives represent their companies to the public at all times because stocks fluctuate based on what they say. The SEC enforces high control and oversight over publicly traded companies. As a result of this regulation, they can be sued over anything; high risk exposures exist if companies lack cautious and proactive loss control systems with liability policies. D&O exposure is a dynamic risk with the ever-changing landscape of technology, social media and news outlets. Investors in public companies “make decisions based on what key executives say and that information can be shared as quickly as a tweet” (Tornoe). News spreads rapidly and can sometimes be shared in a negative light. To offset this, risk management departments, or the representing brokers must complete proper research of exposures the company may face and practice adequate loss control techniques. Tornoe thinks “Musk failed in his legal duties when [a director/officer] joins the board of a company. Duty of loyalty and duty of care are significant.” Musk did not act within the best interest of Tesla nor did he accurately represent financials. Tesla had loss control measures in place with D&O coverage policies paying for penalties as a result, but proactive loss prevention programs teaching risks of not maintaining accuracy or acting within the best interest of Tesla would have aided their officers significantly. Tornoe also says “accuracy is key. Twitter and other public social media platforms are not casual backyard barbeque talk; if directors and officers are not clear on this fact, they are misunderstanding the responsibility of their roles.” The risks of having everything executives do and say under watch could be a reason a company chooses not to go public. Tornoe’s CCIB policies have proactive loss control/prevention measures in place such as quiet periods for 48 hours until earnings releases (directors and officers have to watch what they say about financials) in order to limit and control the risks of losses.

Case: Quintus, Unify, and Legato vs. SEC

Tornoe’s extensive knowledge of D&O coverage also recalls a 2002 SEC case that brought financial fraud charges against executives at three publicly traded northern California Software Companies: Quintus, Unify, and Legato (n.d.SEC). Some officers were arrested and charged with crimes for materially misrepresenting their companies; bankruptcies and massive lawsuits followed. D&O liability coverages in place defended officers, but proven guilt for any crimes would cease coverage and officers would be uninsured (Severability is key: coverage ends if the officers are proven in court to be crooks. This clause separates the good people from the bad). Many individuals claimed they were owed money, but the policy wording made clear that the company’s insurance for D&O payed settlements to individuals first and the company second. Insurance was vital because it was covering expensive defense cases; this makes the importance of policy wording extremely clear. In the case of disasters, policies need to adapt to pay out settlements in the best way possible. Order of payments in any policy is vital but it is another exposure overlooked by directors and officers in many companies.

Case: Boeing 737 Max jetliner crashes

10.29.18: Lion Air flight crash kills 189 people after takeoff in Indonesia, 3.10.19: Ethiopian Airlines Flight 302 crash kills 157 people shortly after takeoff in Addis Ababa (Chicago Tribune).

Lastly, Tornoe cited catastrophes caused by Boeing crashes and struggles with automatic safety systems pushing planes’ noses down during the 2018 development of 737 models. Two different planes nosedived and killed all on board in both crashes. Lots of controversy ensued over whether or not the officers of Boeing knew anything or not. Lawsuits and scrutiny followed these catastrophes as they always do (ultimately CEO Dennis Muilenburg lost chairman post on 10.14.19) and many questions were asked: Did the CEO know there were clear defects in the aircrafts? How or why did he keep selling the planes? It shows extreme ignorance if he didn’t know and it would be a failure of his primary duty. His head was deservingly on a platter for the public; it is his duty to know better. This case demonstrates the need for key executives to improve and inculcate loss exposure management proactively and intensely. Boeing’s problems resulted from a loose culture that did not put nearly enough stress into managing potential catastrophes.

Interview with Joseph Brennan

For a close look onto the reverse side of Directors and Officers, Joseph Brennan, can provide valuable insight. Mr. Brennan is the Global Chief Risk Officer at Vanguard. “He is responsible for the firm’s current enterprise risk management organization in addition to all facets of enterprise security and investment risk management” (n.d.V). He has been in this role for over a year now, and he is an officer on Vanguard’s Board of Directors. Brennan says this is a position “where your decisions get scrutinized, and risks come with every decision. However, value doesn’t come without taking risk. We cannot manage everything because of so many moving parts, but we are still ultimately responsible.” Large public companies need a culture that will get them almost all the way there. Brennan believes the best method of control over these exposures is great ethics and an enforced culture that limits risky behavior. These exposures occur more often in looser cultures, so that is why ethics should be at the front of directors’ and officers’ minds. Sound operation and compliance with tight procedures also prove critical. Tesla, Quintus, and Boeing – here are your solutions! Set the tone by doing the right thing, then a lower frequency and severity of losses will follow. Litigious people in our world love hunting big targets; therefore, it makes sense to have viable coverage in a role like Brennan’s. He’s dealt with nothing internally at Vanguard, but he’s seen many different companies use D&O coverage all the time.

Beyond enforcing a stable culture, Brennan utilizes lots of different types of coverage to combat strategic risk, fraud, cyber risk and various more that he manages for his team of 850 employees. His coverage financing ranges from Vanguard’s reserves, insurers underwriting Vanguard, self-insurance, to captives with associations such as Investment Company Institute. This diverse set of insurance methods displays Brennan’s ability to adequately assess risks proactively and with a purpose. Although many directors and officers in public companies do in fact overlook the risks they face, Mr. Brennan is a perfect example of an officer taking the necessary steps to manage the often-underestimated loss exposures of a large organization.

Conclusion:

Do directors and officers of public companies face too much pressure or scrutiny? Mr. Brennan asserted that “the rules are pretty clear. The SEC has made them very clear actually… we are no longer in the 1970s or 80s, so we can look up what can and can’t be done.” When disaster strikes, it is meaningless whether key executives were oblivious to exposures or did know of exposures and didn’t care to act. The result will be undesirable both ways because they either didn’t know what was happening or neglected it; this causes damaged parties to pursue litigation. Brennan stated “it’s not a pressure. It’s pretty easy for [Vanguard] officers to deal with the things happening. These exposures usually stem from ignorance or poor choice.” Brennan is obviously not one of the officers in a public company ignoring the importance of proper exposure control for public companies, but he still acknowledges the dangerous level of risk that comes with high-profile key executives.

Works Cited

Chicago Tribune. (2019, October 14). Timeline: Boeing 737 Max jetliner crashes and aftermath. Retrieved

November 14, 2019, from https://www.chicagotribune.com/business/ct-biz-viz-boeing-737-max-crash-timeline-04022019-story.html.

Marshall, A. (2019, March 19). SEC: Elon Musk Fully Ignored a Key Term of Settlement. Retrieved

November 14, 2019, from https://www.wired.com/story/elon-musk-tesla-sec-lawsuit-twitter-court-filing/.

(n.d.SEC). Retrieved from https://www.sec.gov/news/press/2002-71.htm.

(n.d.V). Retrieved from https://institutional.vanguard.com/web/c1/our-experts/.

 

Contacts:

Shannon Tornoe – Coast to Coast Insurance Brokers (Owner)

Joseph Brennan – Vanguard (Global CRO)

Strategies that may help limit rising property insurance cost

Edited January 30th, 2024

The acquisition of adequate property policies remains expensive and complex. [1] Many insurers have “struggled to maintain profits in recent years, leading to increased premiums and even withdrawals from certain markets, such as Florida and California.” [2] For consumers, “understanding how its factors can affect homeowners is crucial for accurately assessing and addressing coverage needs.” [3]

Failing to carry an adequate policy could leave even the most responsible and diligent homeowners without the capacity to repair or rebuild their homes or otherwise manage the aftermath of a loss. [4]

Strategies for securing affordable property insurance:

1. Weather protection — “This may include upgrading a roof, installing storm shutters, trimming or removing trees and brush, and making use of nonflammable building materials.” [5]

2. Security upgrades — “By protecting their property from potential criminal acts, homeowners may also be able to reduce their perceived risk levels and access lower coverage costs. Installing smart technology, such as water leak detection systems, fire alarms and security cameras, could help lower premiums.” [6]

3. Tailor protections — “For example, increasing a policy’s deductible may reduce regular payments, although homeowners will need to pay more out of pocket in response to covered incidents before submitting a claim for financial aid.” [7]

4. Arbitrage — “Many homeowners can garner lower overall insurance costs by purchasing multiple types of coverage from the same insurance carrier. For example, an insured may package property, auto, and liability together. In addition, bundling policies may make it less likely for an insurance company to decline renewal or cancel policies in response to claims.” [8]

5. Discount possibilities — “There may be several ways to qualify for homeowners insurance discounts. Many insurance companies may offer lower rates if a homeowner has not filed a claim against their policy for a certain amount of time (three to five years). In addition, retired people, military personnel and members of various organizations and associations may be eligible for reduced premiums.” [9]

6. Credit score — Underwriters may use credit scores as an important factor; “keeping up with bills, limiting debts and balances, and maintaining a diverse credit portfolio, homeowners may enjoy lower premiums.” [10]

“Often, increases over a certain threshold are subject to government approval. Bureaucracy can slow the rate increase process, meaning insurers may be unable to charge an appropriate price for coverage. This may seem like good news to consumers, but it can actually lead to more issues—namely, scarcity of insurance options and higher prices for more limited coverage. Insurance companies are legally required to remain solvent. If they risk losing profitability, they may limit the scope of their coverage or withdraw from an area entirely. This is the cause behind a lack of affordable insurance options.” [11]

References:

2024 Zywave, Inc. (2024). 2024 Homeowners Insurance Market Outlook. Zywave. cms.zywave.com

Higher Exposures and Shrinking Risk Appetite

Edited December 22nd, 2023 by Kyle Langan

Exposure Growth and Global Reinsurance Capital: 2022 Results

After Hurricane Ian, traditional and alternative capital declined by around 20-25% at 2022’s close, compared to 2021’s close. [1] After adjusting for the interest rate impact of mark-to-market losses on fixed income securities, Swiss Re estimated a “decline in capital of around 5%. [2] However, exposures – proxied by GDP – continue to rise fast. [3] This has created a gap between supply and demand.” [4] Exposure refers to the “state of being subject to loss because of some hazard or contingency.” [5]

With these conditions, what is the impact on the insurance market?

“Higher exposures and shrinking risk appetite typically result in rising prices, higher retentions and tighter terms and conditions.” [6] The prospect of still-elevated catastrophe losses and constrained capacity come as geopolitical, economic and environmental uncertainties remain omnipresent.” [7] Analysts may downgrade financial ratings, like Scottsdale Insurance Company, which A.M. Best lowered to ‘A’ on December 7, 2023. [8]

Tail risk from infectious diseases should remain a risk management priority; a lurking systemic cyber event with destructive potential is another tail exposure to monitor. [9]

Capital (GAAP Reporting)

2021 = 116.3

2022 = 96.6

Decrease = 17%

Capital (Solvency Reporting)

2021 = 113

2022 = 108.1

Decrease = 4.3%

Exposure (~GDP)

2021 = 112.2

2022 = 122.1

Increase = 8.8%

Source: AM Best, Swiss Re Institute

References

[1-4]; [6-7] Continued high losses from natural catastrophes in 2022: Swiss re. Continued high losses from natural catastrophes in 2022 | Swiss Re. (2023, November 14). https://www.swissre.com/institute/research/sigma-research/sigma-2023-01/5-charts-losses-natural-catastrophes.html

[5] Exposure. IRMI. (n.d.). https://www.irmi.com/term/insurance-definitions/exposure#:~:text=Exposure%20refers%20to%20the%20state,of%20some%20hazard%20or%20contingency.

[8] Scottsdale Insurance Company – Ratings.ambest.com. (2023, December). https://ratings.ambest.com/disclosurepdf.aspx?ambnum=3292

[9] Cirillo, P., & Taleb, N. N. (2020, May 25). Tail risk of contagious diseases. Nature News. https://www.nature.com/articles/s41567-020-0921-x

Why Older Driver Safety Awareness Week Matters

December 4-8, 2023 is Older Driver Safety Awareness Week. It serves as a critical reminder of the importance of road safety for our aging population (NHTSA).

With longer life expectancies, older adults are more likely to continue driving into their 70s, 80s and beyond. Recognizing challenges such as slower reaction times and medical conditions is crucial to ensuring road safety (NHTSA).

Factors like increased vehicle ownership increase the difficulty to navigate complex traffic situations (NHTSA). Decisions about your ability to drive should never be based on age alone; however, changes in vision, physical fitness and reflexes may cause safety concerns. By accurately assessing age-related changes, you can adjust your driving habits to remain safe on the road (NHTSA).

Resources:

Driving Safely While Aging Gracefully is a resource developed by the USAA Educational Foundation, AARP and NHTSA to help you recognize warning signs and pick up useful tips on what you can do to remain a safe driver.

How to adapt a motor vehicle to accommodate the unique needs of an older driver and discussing it with your loved one.

 Find out whether your state defines “Older Drivers” at a certain age, and what that means for driver’s license renewal and restrictions, including tests: KEY PROVISIONS OF STATE LAWS PERTAINING TO DRIVER LICENSING REQUIREMENTS 

 how medical conditions can impact your ability to drive safely

References

Keeping our older drivers safe on the road. NHTSA. (n.d.-a). https://www.nhtsa.gov/older-drivers/keeping-our-older-drivers-safe-road

Older drivers. NHTSA. (n.d.). https://www.nhtsa.gov/road-safety/older-drivers

 

Strategies for Employment Practices Risk Mitigation

Edited November 30th, 2023 by Kyle Langan

Accommodation and avoidance of adversarial relationships

In the event of a complaint filed against an employer alleging wrongful termination, what are employers’ options to finance this loss? The matter may resolve at mediation, where a settlement is negotiated.  Still, wrongful termination is difficult to resolve in low financial ranges, with many above $120,000.  Improper documentation can act as a hazard for employers. A contemporaneous method of documentation and compliance, along with adversarial avoidance are best practices for employment practices risk mitigation. Accommodation is a key strength for avoiding litigated claims, for which the “average jury award is about $250,000; if a case settles, the judgment averages $75,000. And the cost of defense averages about $120,000 per claim. If a business loses its case, it must also pay for the claimant’s legal fees – averaging $200,000” (the Hartford). Luckily, Employment Practices Liability Insurance exists for employers to strategically transfer this risk to an insurance carrier.

Scenarios:

  • Elk Grove, California: Chevy dealership settled a religious discrimination lawsuit against an employee. The dealership failed to accommodate the employee, who was instead harassed, disciplined, and discharged. The settlement = $158,000 loss for the employer (US EEOC, 2013).
  • Tulsa, Oklahoma: a woman won an age discrimination dispute after she was fired, and the CEO characterized her as old and ugly. The settlement = $140,000 loss for the employer (US EEOC, 2013).

If an event caused a suit like one of these to arrive, how would a company finance it? What are the best ways to avoid them arriving in the first place? For help, the author can be reached at kylel@conreyins.com.

References

EPL Insurance: Risks and Exposures scenarios | the Hartford. (n.d.). https://www.thehartford.com/business-insurance/strategy/epli/risks-exposures-scenarios

Kanbar property management to pay $140,000 to settle Eeoc Age Discrimination Lawsuit. US EEOC. (2013, September 6). https://www.eeoc.gov/newsroom/kanbar-property-management-pay-140000-settle-eeoc-age-discrimination-lawsuit

Maita Chevrolet settles EEOC Religious Discrimination Suit. US EEOC. (2013, September 27). https://www.eeoc.gov/newsroom/maita-chevrolet-settles-eeoc-religious-discrimination-suit

Employment Practices Liability Risk: New Outcome

Curious to learn new data about the possible outcomes within an entity’s employer-employee relationship? What happens when an employee sues for wrongful termination, and what is your entity’s plan to finance the defense against an allegation like this?

Risk domain: Employment Practices Liability

Winner: Citibank

Loser: Employee

Following a hearing in September, Employment Judge Caroline Illing ruled in favor of the employer, saying the employee failed to “make a full and frank disclosure” (Croft, 2023). Regarding an expense report may have been submitted in error, the judge said “I am satisfied that a dismissal in relation to the misrepresentation allegation alone would fall within the band of a reasonable response by a reasonable employer” (Croft, 2023).

References

Croft, J. (2023, October 16). Citibank analyst dismissed for lying about meals expenses claim under €100 limit. Financial Times. https://www.ft.com/content/a7934111-fd57-4bbd-bd39-6c295236175d

What is digital risk and why should you care?

Published November 10th, 2023 by Kyle Langan

Connectivity in the world brings digital risks manifested by the use of technology. [1]  Risk takers should consider more than just the implementation of technology. Bruce Carnegie-Brown, Lloyd’s chairman says “the global interconnectedness of cyber means it is too substantial a risk for one sector to face alone and therefore we must continue to share knowledge, expertise and innovative ideas across government, industry and the insurance market to ensure we build society’s resilience against the potential scale of this risk” [2].

What is resilience?

Resilience means having features in place for the preparation, prevention, protection, and response after an accident or disaster [3]. For example, the U.S. relies on the National Security Council to instill ideas and actions of resilience in their national strategy for a crisis scenario; the U.S. is advanced terms of economy and insurance penetration, meaning there is capital in the U.S. to fund response and recovery to a disaster. [4] Conversely, a society with low income, that lacks public bodies and infrastructure, will struggle to achieve crisis management and damage limitation. [5] In a highly resilient society, the shocks of disasters are less severe, there are more preventive measures in place, and all key functions are up and running again after a short time [6].

Data, within organizations reporting a lack of resilience:

“44% are at the point of assessing digital risk with quantitative and/or qualitative metrics

19% are still defining digital risk

12% do not manage digital risk.” [7]

Preparation, prevention, protection, and response are important for creating a high level of resilience. For digital risk, it seems more preparation is needed.

Please reach out to Conrey’s risk manager, Kyle Langan (kylel@conreyins.com) to help proactively strategize on the components of resilience before you experience a loss.

Source: https://www.auditboard.com/resources/ebook/digital-risk-report-2023/

 

References

[1, 7-8] Wheeler, J. (n.d.). Digital Risk Report 2023. AuditBoard. https://www.auditboard.com/resources/ebook/digital-risk-report-2023/

[2] Lloyd’s Systemic Risk Scenario reveals global economy exposed to $3.5trn from major cyber attack. Homepage – Lloyd’s. (2023, October 18). https://www.lloyds.com/about-lloyds/media-centre/press-releases/lloyds-systemic-risk-scenario-reveals-global-economy-exposed-to-3.5trn-from-major-cyber-attack

[3-6] Resilience – More than just a buzzword . MunichRe TOPICS GEO 2016 . (2016). https://www.munichre.com/en/insights.html

COPYRIGHT © CONREY INSURANCE BROKERS & RISK MANAGERS, INC. 2019. ALL RIGHTS RESERVED.