Defense Guide: Cyber Threats Spiked 70% in 2021

/in /by

Ransomware payments by victims spiked 70 percent YoY in 2021; ransomware continues to hammer healthcare and education, but all industries are at risk (Holdeman, 2022). “Ransomware is a type of malicious software designed to block access to a computer system until a sum of money is paid” (Oxford). It is one of the many cyber threats plaguing U.S. businesses as of late.

Defense Guide for Commercial Cyber Risk:

 

Purchase cyber insurance

The only failsafe against cyber risk is protecting businesses with guaranteed indemnity when a loss arises. It is vital to structure an adequate risk financing plan with properly set limits and retentions.

Do you have a security awareness training program for employees?

Coalition recommends implementation as a vital defense mechanism.

Increase email security

A mail proxy can filter malicious emails (2021 Coalition).

Implement Multi-factor Authentication (MFA)

Google Authenticator can be used, for example. “Approximately 80% of email intrusion incidents happen because of weak or stolen passwords. One of the most effective methods to mitigate the risk of an email-based cybersecurity incident is to enable Multifactor Authentication” (2021 Coalition).

Maintain good data backups

Developing a contingency plan:

  • “What data should be backed up, and where it should be stored;
  • How frequently data backups should occur;
  • How quickly you could restore your data from that system in the event of an incident and at different times;
  • How you can test and iterate on your backup solution to ensure it’s working as intended and accommodates changing business needs” (2021 Coalition).
4 final tips:
  • Encrypt your data;
  • Update your software;
  • Use a password manager;
  • Scan for malicious software (2021 Coalition).

References

 

2021 Coalition Cybersecurity Guide. (n.d.). Retrieved May 24, 2022, from https://info.coalitioninc.com/rs/566-KWJ-784/images/DLC-2020-12-2021-Coalition-Cybersecurity-Guide.pdf

 

Holdeman, E. (2022, May 20). Hacking and ransomware remain a significant challenge. Continuity Professionals Pulse. Retrieved May 2022, from https://www.continuityprofessionalspulse.com/edition/weekly-authentication-benchmark-2022-05-14?open-article-id=21617021&article-title=hacking-and-ransomware-remain-a-significant-challenge&blog-domain=govtech.com&blog-title=disaster-zone

 

Oxford languages and google – english. Oxford Languages. (n.d.). Retrieved May 24, 2022, from https://languages.oup.com/google-dictionary-en/

 

Total Cost of Risk (TCOR): Are you measuring it?

/in /by

Published February 25th, 2022 by Kyle Langan

Focus of TCOR: Profitability

It is vital for the financial health and longevity of an entity to account for, and understand the effect of all expenses on its profitability.

Companies may assume they understand and measure their expenses and profitability correctly, right?  This is commonly untrue.

Learn How to Measure: TCOR explained

Inherent in all company’s operations are risks, and with risk comes cost.

Here’s what TCOR is and what you need to know about it in order to prevent lost profits within your company:

Total Cost of Risk (TCOR) is the cost of managing risks and incurring losses. [1] Total cost of risk is the sum of all aspects of an organization’s operations that relate to risk, including retained (uninsured) losses and related loss adjustment expenses, third party / administrative costs, transfer costs, risk control costs, and indirect costs. [2]

Third-Party Costs include the expenses associated with buying insurance (premiums, taxes, and fees). These costs are determined by your effective policy types and claims experience. [3]

Losses are the largest source of commercial profit erosion. They are controllable with the placement of proper risk control mechanisms. Direct costs stem from losses through retained costs, deductibles, and uninsured losses. [4]

Indirect loss costs are the unbudgeted expenses of loss events caused by business interruption, disruption and/or reputational loss. They are calculated through an indirect loss cost factor – specific to industry group and risk category. This part of the equation is the most challenging – it is not commonly measured.

With the right risk control plan in place, there are significant opportunities to reduce your TCOR by working to mitigate losses.

TCOR, an example:

Ransomware attacks increased in 2021; evolving tactics of cybercriminals demonstrated their growing sophistication and threat to organizations globally. [5] These criminals increasingly expanded methods to extort money from mid-sized businesses. They threaten to publicly release stolen information and/or disrupt victims’ internet access.

A commercial victim of a cyber extortion loss will incur significant indirect costs, thereby increasing its TCOR. This results from stolen money, access disruption, or loss of data, time, and human capital.

Scenario: Large Addiction Treatment Center Faces Cyber Extortion

2,500 records of Personal Health Information (PHI) are hacked. This was the only loss it faced in 2021. The treatment center has a cyber risk policy insured by Lloyd’s of London. It offers protection with a $1,000,000 aggregate limit and a $10,000 deductible.

Third Party Costs

  • Risk Financing Premiums, Taxes, Fees = $7,500

Losses (Paid by Lloyd’s of London) [6] 

  • 1st party crisis services median loss = $564,930
  • 1st party legal costs = $48,185
  • 1st party regulatory costs = $13,292
  • 3rd party costs = $74,770
  • 1st party business interruption = $126,279 (Lloyd’s of London will have a specific policy language regarding business interruption indemnity)

Direct Costs: Deductibles, Retention, Uninsured Losses

  • $10,000 deductible

Indirect Loss Cost Factor:

  • Indirect Loss Cost factor for cyber risk in this industry = 1.00
    • The indirect loss cost factor measures wasted time, energy, and resources spent on the claim process and recovery from the loss. Indirect losses erode EBITDA margins, which is why your risk manager should provide a strategy for how to measure, and ultimately recapture them.
  • Initial loss = $827,456

Theoretically, a factor of 1.00 would mean the indirect losses would total an additional $827,456, equating to a total impact of $1,654,912.

However, because this is a single large ‘shock’ loss, we would cap the indirect losses at perhaps $200,000. That way, the friction is conservatively limited to $200,000. Most experts agree that there is an amount involved with handling the claim and the frictional costs, but there is usually a cap.

In conclusion, the addiction treatment center has an $827,456 loss — $817,456 that is covered by Lloyd’s of London, and a $10,000 self-insured deductible.

Additionally, it faces $200,000 in indirect losses that are eroding its bottom-line profitability. This is unaccounted for on an income statement, unless it is measured and quantified by your risk manager. Although it is uncommon, Conrey has this capability – email me at kylel@conreyins.com to have this calculated for your business.

Total loss with indirect loss cost factor = $1,027,456 (only $817,456 is covered by Lloyd’s of London)

Total Cost of Cyber Risk for the Addiction Treatment Center in 2021:

  • $217,500: 2021’s total cost of cyber risk for this addiction treatment center. Keep in mind, this number only accounts for cyber risk, but it still serves as a useful demonstration for calculating TCOR.
    • Risk Financing Premium = $7,500
    • Deductible = $10,000
    • Indirect Losses = ~ $200,000

Note: Separate from TCOR, is Existential Cost of Risk (XCOR) — existential cost of risk is the “premium” that would be charged by an insurer if a company insured all of its risk exposures. This can be considered the cost a company incurs to finance the risk of its continued existence. Not all business risks can be reasonably called “insurable,” but XCOR provides a proxy for such a cost. [7]

 

References

[1] — [2]

Cost of risk. Cost of Risk | Insurance Glossary Definition | IRMI.com. (n.d.). Retrieved February 28, 2022, from https://www.irmi.com/term/insurance-definitions/cost-of-risk

[3] — [4]

Data-driven client outcomes for the insurance industry. TCORCalc. (2019, July 28). Retrieved February 28, 2022, from https://tcorcalc.com/

[5]

Zank, A. (2022, February 11). Officials saw more ‘professional’ cybercriminals, more infrastructure attacks in 2021. Advisen – Risk Manager FPN. Retrieved February 28, 2022, from https://www.advisen.com/tools/fpnproc/fpns/articles_new_24/P/422217002.html?rid=422217002&list_id=24

[6]

Cyber overvue. (n.d.). Retrieved February 28, 2022, from https://cyberovervue.advisen.com/search

Existential cost of risk xcor. Existential Cost of Risk (XCOR) | Insurance Glossary Definition | IRMI.com. (n.d.). Retrieved February 28, 2022, from https://www.irmi.com/term/insurance-definitions/existential-cost-of-risk-xcor

 

COVID Court: Lakers’ Split Decision

/in /by

Published March 30th, 2022 by Kyle Langan

LA Lakers vs. Chubb

In 2021, the Lakers sued Federal Insurance Co., a Chubb subsidiary. The team alleged losses in the tens of millions ($) in revenue due to closure of the Staples Center in March 2020 resulting from COVID stay-at-home orders issued by LA and California (Ayers, 2022). “The Lakers also incurred additional costs by installing new air filters, touchless bathroom fixtures, coverings for high-touch surfaces, and plexiglass dividers to prevent the spread of the virus” (Ayers, 2022).

The Western Division of the U.S. District Court for the Central District of California dismissed the Los Angeles Lakers’ “pandemic-related business interruption and civil authority claims, but allowed the team to pursue coverage for cleaning or repairing alleged property damage” (Ayers, 2022).

The Lakers successfully alleged a claim for property damage, based on “physically altered surfaces … that required cleaning or replacement before the Covered Properties were safe again” (Ayers, 2022).

The claims for business interruption or civil authority coverage were dismissed. Since 2020, insurers have frequently denied coverage for pandemic-related business interruption; this is due to the lack of property damage, or contract language that excludes viruses. For this ruling, precedent was heavily based on a case decided by the California Court of Appeals in late 2021 (Inns by the Sea v. Cal. Mut. Ins. Co.). It was ruled that repairing property damage alone did not dictate whether the team’s arena could reopen. Even with the repairs and alterations, “the Staples Center still could not have reopened until the State of California allowed it to reopen on April 15, 2021,” the Court noted (Ayers, 2022).

What is Civil Authority Coverage?

The team’s claims for civil authority coverage also failed – the Lakers argued that closures of nearby Metro stations constituted ‘prohibition of access’ but the Court found the orders “were aimed at limiting viral spread in the community, not at mitigating property damage at any specific facility” (Ayers, 2022). Civil authority coverage is included within business income/extra expense insurance forms; income losses arising as a direct result from actions of local police, fire, etc., may be covered (IRMI). “Orders made by civil authority must be the cause of the lack of access to insured premises (or the reason that normal operations cannot continue) due to damage caused by a peril covered under your policy. There must be an act of civil authority for coverage to apply; blocked access to a location alone is insufficient to trigger coverage” (IRMI). The International Risk Management Institute provides clarity on civil authority coverage, and why the court ruled against the Lakers. In this case, orders made by LA civil authority were not deemed the cause of loss because the orders were not aimed at mitigating property damage. Instead, the goal was public safety. More on business interruption coverage: commercial property insurance covering loss of income suffered by a business when damage to its premises by a covered cause of loss causes a slowdown or suspension of its operations (IRMI). It is vital for the financial health and longevity of companies (all sizes) to put this protection in place.

Is your broker providing guidance on business interruption and civil authority coverage? If the answer is no, shoot me an email at kylel@conreyins.com.

Turning Point?

Insurers continue to prevail in the majority of COVID-19 business interruption lawsuits, including on appeal. However, the Lakers’ look to gain a partial win in this case (which is much needed – the team is currently 11th in the West). The Lakers are rightfully exercising their right to pursue indemnity through timely purchased coverage. In doing so, courts are allowing them to proceed with the property damage and bad faith claims against Chubb, even though the NBA team’s business interruption claim was dismissed.

References

Ayers, E. (2022, March 21). La Lakers can pursue Covid property damage claim, court rules. Risk Manager FPN. Retrieved April 1, 2022, from https://www.advisen.com/tools/fpnproc/fpns/articles_new_24/P/426417879.html?rid=426417879&list_id=24

IRMI: The next level of business income coverage. The Next Level of Business Income Coverage | Expert Commentary | IRMI.com. (n.d.). Retrieved April 1, 2022, from https://www.irmi.com/articles/expert-commentary/the-next-level-of-business-income-coverage

Caution: Climate Risk in California

/in /by

Published December 17th, 2021 by Kyle Langan

Although Southern California is famous for its mild winters, it does face unique risks of flooding, wind damage, and rain. This risk can lead to landslide and or infiltration from the outside to the inside of buildings.  Let’s first identify the root cause of why the upcoming winter season will be more severe than typical. Once understood, loss control recommendations can be made.

Good News and Bad News: Increased Snowpack

In August 2016, the Environmental Protection Agency warned of decreasing snowpack in California’s climate.[1] This problem is one of the endless negative impacts of climate change.

As the climate warms, less precipitation falls as snow. As a result, more snow melts during the winter, which decreases snowpack — the amount of snow that accumulates over the winter. Since the 1950s, snowpack has declined in California.[2]

However, 5 years later (December 2021), breaking news suggests a much-needed increase in snowpack for the Sierra Nevada is inbound.

A powerful storm system along the West Coast is dropping heavy snow in the mountains of the Sierra Nevada, and the Cascade Range.[3] The storm systems are excellent news for the drought-plagued region and its struggling mountain snowpack; without it, a resulting decrease in the extent of alpine tundra ecosystems could threaten some species.[4]

Mountain snow will be measured in feet with this storm, with more than five feet possible in the higher elevations of the Sierras.[5] “Total snow accumulations will be tremendous,” the National Weather Service in Sacramento wrote in a forecast discussion, calling it “easily the biggest snowstorm so far this season.” [6]

Warning

Although this storm system is great for the environment, it will be met with increased risk for property owners in California. The storm will bring positive change for California’s climate, but is simultaneously disruptive because of its potential flooding and impacts on travel.[7] Substantial wind and rain will enter lower elevations from the Pacific Northwest to Southern California.[8] The lower elevations of central California have the greatest risk of flooding, which does present unique risk to dwellings in the Sacramento and San Joaquin Valleys.[9]

Risk Management Techniques

Flood vents, floodplain management, and wind mitigation are all vital aspects of a risk control strategy for climate risk.

Flood Vents:

A flood vents are a useful guard against the buildup of excess moisture or water which are not healthy for structures to endure. They are permanent openings in walls that allow for the free passage of water. Flood Vents protect houses and buildings during floods by preventing hydrostatic pressure buildup that can destroy walls and foundations. This mitigation technique, allows floodwater to freely flow through an enclosure such as a crawlspace or garage.[10]

Characteristics of effective flood vents:

  • Free passage of water flows automatically in both directions without human intervention
  • Minimum of two openings
  • No higher than one foot above grade

Flood vents are useful for allowing for the automatic entry and exit of flood waters for an at-risk property. It is a “wet floodproofing” technique is required for residential buildings. Commercial buildings have the option to wet floodproof, which can be more cost-effective compared to dry floodproofing.[11] Dry floodproofing includes measures that make a structure watertight below the level that needs flood protection to prevent floodwaters from entering.  This type of floodproofing is often used to protect non-residential structures, water supplies, and sewage systems.[12]

Mitigation + Floodplain Management:

Further, property owners should also transfer risk to an insurer.

  • Purchase flood insurance
  • Look into Flood Hazard Areas (SFHA)
  • Look for Flood Insurance Route Maps (FIRM) near your area
Wind Mitigation:

Windstorm is normally a covered peril whether an organization purchases “named peril” or “all risks of loss” coverage.[13] Alternative options include a supplemental parametric insurance policy that pays out pre-agreed funds based on wind speeds.

Wind and water can cause damage to exterior walls, roofing as well as glass breakage and interior water damage.[14] In addition, damages to other insured property are at risk: docks, piers, landscaping, swimming pools, golf courses, tennis courts, outdoor restaurants/bars, etc. Damages to these areas drastically increased the amount of a potential claim.[15] Therefore, insurance policies that cover these exposures are important to consider. This way, indemnity is available if losses are present. If you are not certain if your assets are protected, contact Conrey.

[1-2] EPA

[3] Leonard

[4] EPA

[5-9] Leonard

[10-11] Smartvent.

[12] FEMA

[13-15] IRMI

References

EPA – What climate change means for California. (2016, August). Retrieved December 17, 2021, from <https://www.epa.gov/sites/production/files/2016-09/documents/climate-change-ca.pdf>

FAQs. SmartVent. (n.d.). Retrieved December 17, 2021, from <https://smartvent.com/resources/faq>

FEMA: Dry Floodproofing. Dry floodproofing. (n.d.). Retrieved December 17, 2021, from <https://emilms.fema.gov/IS321/HM0103040text.html>

Leonard, D. (2021, December 13). Storm blasting California with massive mountain snow and flooding rain. The Washington Post. Retrieved December 17, 2021, from <https://www.washingtonpost.com/weather/2021/12/13/california-rain-snow-atmospheric-river/>

Global Climate Change Causing Increased Fire Risk

/in /by

Published January 14th, 2022 by Kyle Langan

Recent Wildfires

Recent wildfires in Colorado and California highlight concerning macro issues regarding climate change. According to NASA, 90 percent of biomass burning is human instigated; this contradicts a common perception that most wildfires are caused by acts of nature, such as lightning. [1] According to Dr. Joel Levine, a biomass burning expert at NASA, humans are at fault for macro-level harsher weather events. [2] The devastating Colorado wildfire from December 30, 2021, may cause $1 billion in insured losses. [3] The late-season wildfire destroyed nearly 1,000 buildings and homes as it swept through Boulder County, CO. The fire was fueled by months of unusually warm, dry weather and intense winds. [4] It ranks as the most destructive wildfire in the Colorado history — it burned 6,000 acres and nearly doubled the amount of damage and insured losses caused by Colorado’s October 2020 fire. [5] In Colorado, the wildfire season does not typically extend into the winter, as snow cover and cold temperatures prevent fire spread. Fire is part of a general trend of a lengthening fire season and drier fuels in the Western US due to climate change. [6]

This video below displays historic temperature changes visually with NASA data driven heat maps.

Video: Global Warming from 1880 to 2021 (NASA)

Inadequate Coverage?

In Colorado, insurers have opened a mobile insurance village to assist affected residents. [7]

Unfortunately, rebuilding costs for many policyholders may exceed their insurance limits. Labor shortages, supply chain disruption, and inflation have pushed construction costs to the upside. [8] For example, a property owner, whose home was destroyed in Colorado’s October 2020 wildfire, told the Wall Street Journal his policy limits of $900,000 and $700,000  for the dwellings fell short of the approximately $2 million in rebuilding and required upgrade costs. [9] Homeowners should check with their risk manager to confirm their homes’ replacement cost valuation is accurate and that coverage is adequate. In order to effectively manage the exposure they face, property owners must ensure protection is as adequate as believed. To verify this, and to seek a broad range of expert risk advisory, consult with Conrey.

California: PG&E Gets Blamed

In California, the even larger ‘Dixie Fire’ stripped forests and forced thousands from their homes after it began on July 13, 2021. [10] It burned a total of nearly 1 million acres through Northern California and destroyed 1,329 structures. [11] Sadly, it also caused one fatality. The Pacific Gas and Electric (PG&E) utility company has been blamed for the fire, after a tree fell on PG&E owned electrical distribution lines. [12] The blaze was the second-largest in California’s history; 963,000 acres is an area larger than New York City, Chicago, Dallas and Los Angeles combined. [13]

Current Levels of Atmospheric Carbon Dioxide (NASA):

Fire Harm Reduction

Cal Fire urged Californians to “remain vigilant and be prepared for wildfire,” after climate change continues to “turbocharge severe storms, floods and extreme weather across the United States.” [14]

PG&E said they will continue to be tenacious in their efforts to stop fire ignitions from its equipment and to ensure safety [15] In July of 2022, “the company plans to bury 10,000 miles of California power lines in an attempt to prevent its equipment from sparking wildfires, a project that would probably cost tens of billions of dollars and take well over a decade to complete”. [16]

Indoor Fire Mitigation – Tragedies Strike in PA, NY

In contrast, the Philadelphia area has recently faced two devastating tragedies related to indoor fires. On Christmas morning, a house fire occurred in Bucks County, Pennsylvania. It claimed the lives of a father and his two children. Quakertown Police Chief Scott McElree said early indications were that the fire started in the family’s Christmas tree. [17] The fire took the lives of Eric King, 40, his sons, Liam, 11, and Patrick, 8, and their two dogs. Eric’s wife Kristin and their oldest son Brady managed to escape before the fire destroyed their entire home. [18] The blaze was deadly because the fire started within the walls of property after the family’s Christmas tree ignited and burned the home and its contents. The pine tree, wrapped with lights and electrical wires contributed to the increased fuel load inside the home. Fuel load is the expected amount of combustible material in a given area (what is inside a property that can burn). The house’s increased fuel load was the cause of this heart-wrenching tragedy.

To make matters worse for the Philadelphia community, on January 5, in Fairmount, a 5-year-old child accidentally ignited a Christmas tree while playing with a lighter. Three women – Rosalee McDonald, Virginia Thomas and Quinsha White – and nine of their children died in the fire, according to family members. [19] The blaze was the deadliest fire in Philadelphia in more than a century. [20] None of the six smoke alarms found in the unit were functional, and only one was still installed. This tragedy had been the deadliest fire in years at a U.S. residential building, but was surpassed on Jan. 9 by a fire in a high-rise in New York City’s Bronx borough that killed 17 people, including several children. [21] Support the King Family here; Fairmount families here; and New York here.

Risk management applies to any and all situations. It is a vital aspect of life. To prevent situations like this from happening, it is recommended to decorate a fake tree when Christmas rolls around next year. Reducing fuel load is the best way to minimize fire risk and prevent ignition. Further, frequently ensure that smoke detectors are fully functional. Verifying the functionality of smoke detectors can reduce loss of life from fires. During any time of year, take steps to acknowledge what contributes to your home’s fuel load, and have a construction professional inspect walls to certify they are as fire resistive as they can be; this will limit the spread of fire if a blaze does start.

Works Cited

1-2: Dunbar (NASA).

3-9: Ayers, 2022.

10-16: Washington Post, 2022.

17-18: Solis, 2021.

19-21: Staff 6abc, 2022.

References

Ayers, E. (2022, January 10). Colorado wildfire insured losses to reach $1b, Modeler says. Risk Manager FPN. Retrieved January 15, 2022, from https://www.advisen.com/tools/fpnproc/fpns/articles_new_24/P/418750667.html?rid=418750667&list_id=24

Dunbar, B. (n.d.). Wildfires: A symptom of Climate Change. NASA. Retrieved January 15, 2022, from https://www.nasa.gov/topics/earth/features/wildfires.html

NASA. (2022, January 12). Climate change evidence: How do we know? NASA. Retrieved January 15, 2022, from https://climate.nasa.gov/evidence/

NASA. (2022, January 13). Video: Global warming from 1880 to 2021 – climate change: Vital signs of the planet. NASA. Retrieved January 15, 2022, from https://climate.nasa.gov/climate_resources/139/video-global-warming-from-1880-to-2021/

Solis, G. (2021, December 27). Christmas Day house fire kills father, 2 children in Quakertown, PA.. 6abc Philadelphia. Retrieved January 15, 2022, from https://6abc.com/quakertown-house-fire-father-and-sons-killed-eric-king-christmas-pennsylvania-tragedy/11390602/

Staff, 6abc D. (2022, January 12). ‘near certainty’ Fairmount Fire ignited when Christmas tree set ablaze, Philadelphia officials say. 6abc Philadelphia. Retrieved January 15, 2022, from https://6abc.com/fairmount-fire-atf-philadelphia-firefighters-north-23rd-street-investigation-philly-blaze/11454578/

Washington Post. (2022, January 5). PG&E equipment blamed for Dixie Fire that burned nearly 1 million acres in California . Risk manager FPN. Retrieved January 15, 2022, from https://www.advisen.com/tools/fpnproc/fpns/articles_new_24/P/418388483.html?rid=418388483&list_id=24

TRAGEDY PREVENTION: Surfside Condo Collapse

/in /by

Published November 29th, 2021 by Kyle Langan

Within the walls of the beachfront condominium development, Champlain Towers South, abundant cracking and crumbling on columns, beams, and walls of the parking garage existed.   In 2018, a hired engineer warned of major structural damage to concrete slab below the building’s pool deck.  So, how did this not get corrected in the 3-year window of time leading up to the collapse and tragedy that ensued?

Board of Directors’ Failure to Employ Basic Risk Management Principles

Champlain’s board of directors was responsible for maintaining and repairing common elements including buildings, pools, and parking garages. Reserve studies accomplish this – an engineer can adequately advise of all elements, along with maintenance and replacement. At Champlain, the condo’s association had only $706,460 in reserves, which was well short of the $10M needed for structural repairs.

The Business Judgement Rule has extreme significance for the prevention of another occurrence like the tragic one in Surfside.  Boards must follow the advisory of the professionals; i.e., engineers, insurers, CPAs, and attorneys. Regular inspection of a building’s structural integrity and setting proper reserve levels are both vital. Board members need to be educated individuals that listen to expert business judgment from qualified professionals.  More importantly, directors must follow the recommendations to prevent losses. Additionally, had business judgement been followed at Champlain, it would have provided a strong defense to litigation coming from a unit owner’s family or third party affected by the loss.

D&O coverage offers litigation protection for individuals on the board and the responsible entity for a loss of this nature. To read more about the importance of D&O risk financing, click here. With this in place, personnel on the board and the entity itself will both experience financial protection from any economic losses. Champlain Towers South only had $49 million in total coverage, which was not sufficient because of the litigation that ensued after the obvious negligence.

Preventing Another Surfside Miami Condo Collapse

Risk mitigation: For commercial properties, engineers must file copies of safety inspections with local governments. This is vital for the longevity and structural health of the property, and it is now a requirement by Florida statute.

Education: An essential part of the public sector’s mitigation strategy is the increasing education requirements for board members and property managers. Directors on any board must be nuanced in the ways of how to properly and timely maintain an entity and its assets. Also, increased education can help achieve an essential goal for housing associations: balancing reserve funding with reasonable assessment for owners. This is significant because it introduces elements of Enterprise Risk Management, which holistically addresses loss exposures, mitigation, and financing of an entity. For the design of a risk financing & mitigation plan that will increase the profitability and valuation of your entity, contact kylel@conreyins.com.

With a strategy that implements the risk mitigation techniques above, negligence can be identified and solved. Negligence from the board of directors was the root cause of what led to the Champlain Towers South collapse in Miami; it is now being addressed reactively to prevent another similar tragedy.

Recommendation: A board of directors should follow the strategies above, avoid negligence, and purchase D&O insurance. That way, in case a catastrophic loss does occur, directors’ personal assets are not lost in defense costs during litigation. Risks should be financed up to the level of the industry group median, at a minimum. Then, directors should identify what percentage of losses go over this median, and determine how much coverage they want to purchase based on the risk appetite of the entity. Coverage medians and maximum losses within industry groups of a company should be analyzed by your risk manager. If they are not, contact me.

References

Surfside Condo Collapse Webinar – Hosted by USLI <https://www.usli-events.com>

Various ideas coming out of the State of Florida concerning how to handle the collapse <https://www.floridabar.org/>

What is Your Strategy for this Overlooked Liability Protection?

/in /by

Published October 1st, 2021 by Kyle Langan

Negligent actions or inactions of a company’s officers or board of directors resulted in record high settlements in 2020. Private companies are at risk – not just publicly traded firms.

Example: A wrongful act results in the individuals who serve as directors and officers being sued for the breach of their corporate duties at a mid-sized company.

Privately held companies facing losses like these report an average loss of $387,000, and a maximum loss of $17 million. [1] How would your company fund a loss like this?

The only policy that would cover the exposure in the example above is directors and officers liability.

Does your current risk management strategy only account for property, auto, and general liability losses? General Liability policies do not pay for financial losses of a company, but management liability insurance can. Management liability policies include three main types: directors and officers, employment practices liability, and fiduciary liability.

There is an often-misunderstood coverage that will defend and finance this type of exposure: directors and officers. It is an available safety net that your company’s risk manager may have overlooked, or never considered.

What is D&O?

Directors and Officers (D&O) is a type of management liability insurance covering directors and officers for claims made against them while serving on a board of directors and/or as an officer of a company [2]. Policies cover managerial decisions that result in adverse consequences for both large and small companies alike [3]. This line of management liability protection is not solely applicable to publicly traded companies. Additionally, it should not be viewed as an expense, but as an asset to any company. An effective risk manager will break down the cost structure of this protection and implement a plan to prevent economic losses of this nature. Lastly, entity coverage covers claims made directly against the organization, and it can be added as an extension to a D&O policy.

Status of the D&O Market Price?

In a ‘hard market,’ insurance carriers exhibit a decrease in risk appetite. During a hard market, insureds must be presented as an attractive risk because underwriters have strict conditions for coverage. Insurers are focused on underwriting performance and the portfolio management of the businesses competing for cover. The D&O market has achieved hard-market pricing increases since Q4 of 2018 [4]. However, increases are slowing; insurers are experiencing new capacity for D&O risk in 2021. [5]

Prices continued to rise as of July 1, 2021, but at a lesser rate than in recent renewals; some experts believe rates may be flat by this time next year. [6]  2021 has seen significantly lower rate hikes than in 2020.

What’s Driving D&O Rates?

Mergers and Acquisitions (M&A) played a role in the hardening D&O insurance market. Insurers responded to this with higher retention levels and expensive rates [7]. Companies should eliminate and avoid the following D&O hazards that have been the subject of recent M&A litigation:

  • Misconduct and investigations regarding the actions of directors and officers [8]
  • Failing to disclose internal or external investigations related to a company’s actions or the broad actions of its officers and directors [9]. This causes investor retaliation, which is a D&O exposure for private and public entities.
  • Anything that can be determined as false or misleading information [10]
  • Omissions and statements like the ones causing recent SPAC lawsuits [11]
  • Overstating of financial prospects. Misrepresentation has always been an exposure to D&O Risk (either willfully or inadvertently) [12]

YOY price trend analysis:

Businesses have been competing for coverage in a difficult D&O market since 2019 (See graph below). It is clear that the hard market started in Q4 of 2018 with an 11.6% increase, leading into 2019, which saw a sharp price increase of nearly 20% on average in the D&O market. In 2020, it tightened up even further up to 41%. This is when some companies were potentially forced to self-fund for this management liability risk because purchasing D&O insurance was no longer economical. However, in 2021, the slower pace of increase proves there is new capacity from insurers within the D&O market. The 15% Q1 price increase average between public companies (21%) and private companies (10%) this year shows that if the current trend continues, the worst of the hard market is behind us.

Because of the clear trend, the worst of the hard market may be over. Experts like John M. Orr, D&O liability product leader for Willis Towers Watson, agree with this statement. [13]  However, it is still important to protect your business before a loss arises. Looking ahead, there is likely to be more flat renewals, potentially more frequent rate decreases, and increased competition among insurers. [14]

 

*Companies experienced an average settlement of $54.5 Million per claim in 2020 for D&O liability losses; Appendix [15]

 

With price increases trending downwards towards flat renewals, it is an excellent time to evaluate your current D&O risk management strategy. At Conrey, my team and I attack the root cause of what drives D&O rates with a proprietary system of data analytics and enterprise risk management proven to reduce total cost of risk. Contact me at kylel@conreyins.com to see how I can do this for your business.

 

—

[1] Privately-held companies and Directors & Officer’s Insurance: Why not? Summit. (2021, September 3). Retrieved October 5, 2021, from https://www.yoursummit.com/knowledge-center/privately-held-companies-and-directors-officers-insurance-why-not/

[2-3] IRMI – Directors and officers liability insurance. Directors and Officers (D&O) Liability Insurance | Insurance Glossary Definition | IRMI.com. (n.d.). Retrieved September 28, 2021, from https://www.irmi.com/term/insurance-definitions/directors-and-officers-liability-insurance.

[4] Greenwald, J. (2019, March 14). D&O pricing rises in fourth quarter of 2018: AON. Business Insurance. Retrieved from https://www.businessinsurance.com/article/00010101/NEWS06/912327297/D&O-pricing-rises-in-fourth-quarter-of-2018-Aon.

[5] AM best to join D&O-focused panel at the RE/Insurance Lounge. Business Wire. (2021, September 21). Retrieved September 24, 2021, from https://www.businesswire.com/news/home/20210921005776/en/AM-Best-to-Join-DO-Focused-Panel-at-the-ReInsurance-Lounge.

[6] Greenwald, J. (2021, August 2). D&O prices up 7.7% in second quarter: AON. Business Insurance. Retrieved September 29, 2021, from https://www.businessinsurance.com/article/20210802/NEWS06/912343627/D&O-prices-up-77-in-second-quarter-Aon.

[7] Moorcraft, B. (2021, September 16). How M&A has impacted the hard D&O Insurance Market. Insurance Business America. Retrieved September 24, 2021, from https://www.insurancebusinessmag.com/us/news/professional-liability/how-manda-has-impacted-the-hard-dando-insurance-market-310286.aspx.

[8] Barton, R. E. (2021, September 2). Caution ahead: Spac litigation trends provide a road map for directors and officers. Reuters. Retrieved September 24, 2021, from https://www.reuters.com/legal/legalindustry/caution-ahead-spac-litigation-trends-provide-road-map-directors-officers-2021-09-02/.

[9-11] Barton, R. E., 2021.

[12] Moorcraft, B., 2021.

[13-14] Greenwald, J. (2021, July 6). D&O rate hikes moderate as new capacity arrives. Printed from BusinessInsurance.com. Retrieved September 24, 2021, from https://www.businessinsurance.com/article/20210706/NEWS06/912342985?template=printart.

[15] Greenwald, 2019; Ross, 2021; Gallagher, 2021; Greenwald, 2021

Ross, H, Woleben J. (2021, May 5). D&O premiums rise 41% YOY in 2020; loss ratios hold steady. Accelerating Progress. Retrieved September 27, 2021, from https://www.spglobal.com/marketintelligence/en/news-insights/latest-news-headlines/d-o-premiums-rise-41-yoy-in-2020-loss-ratios-hold-steady-63997938.

Gallagher – 2021 Spring/Summer Market Report. (n.d.). Retrieved September 27, 2021, from https://www.ajg.com/us/-/media/files/gallagher/us/news-and-insights/insurance-market-update-spring-summer-2021.pdf.

How a Proactive Risk Control Strategy Reduces Losses

/in /by

Published September 2nd by Kyle Langan

HURRICANE IDA is commanding many of the current headlines and updates in the news. Preliminary loss estimates from the storm are approaching $25 billion in New Orleans, LA.[1] Why should catastrophic events matter to you? One important reason is controlling the risk your most cherished asset faces. For most people, this is their home, while for others, it may be a valuable commercial property. Homeowners and facilities managers alike must maintain high level awareness of their property in order to mitigate risk and prevent loss.

$14.5B Network

New Orleans employed a proactive risk mitigation investment strategy by constructing a $14.5 billion network of seawalls and levees that the Army Corps of Engineers built after Katrina.[2] New Orleans’ current infrastructure system features hundreds of levees positioned in a protective ring around the city, the longest storm surge barrier in the U.S., a floodgate at Lake Ponchartrain, and the world’s largest pumping station.[3] With this proper protection in place, the city was effectively able to avoid another Katrina. This infrastructure guarded the city well against Ida and sets a model for other at-risk cities to follow. Katrina was catastrophic because very high storm surges overtopped levee systems in New Orleans and St. Bernard Parish.[4]

New Orleans’ levee system functioned as designed, according to Kelli Chandler, regional director of the New Orleans Flood Protection Authority: in the metropolitan area, “there was no breaching or overtopping of the levee system,” she said.[5] Katrina and Ida were not identical; however, the city experienced success during a storm of similar intensity to Katrina. Ida was a category 4 hurricane, with 150 mph winds. Katrina was a category 3, with 125 mph winds, but moved faster and was larger in size than Ida.[6] The magnitude of losses that were prevented can be seen in the appendix below:

Results: New Orleans’ demonstration of effective, proactive risk control

 

Inadequate Risk Control (Katrina)
Proper Risk Control in place (Ida)
* $174.7 Billion in damages
$25 Billion in damages

* Adjusted for inflation [7]

Proactive risk control is similarly necessary to prevent structural issues for commercial properties. Buildings deteriorate gradually over time, so managing the risk of this deterioration before problems arise is key. A strategy with this in mind is how New Orleans reduced a hurricane’s damages by over $100 B. The estimated ROI from the $14.5B investment was roughly $150B in prevented damages.

As buildings age, they can lose structural integrity. If simple repairs are procrastinated, they can develop into greater issues with higher loss potential. This can cause significant damage that may increase danger and interrupt operations.[8] Structural engineering and building codes have evolved the safety of commercial properties. Still, additional loss prevention is necessary for longevity and success. Facilities managers must adequately protect commercial buildings and mitigate the risk they face. Proactive risk control helps to prevent losses. Further, risk transfer increases capacity to prepare for inherent losses.

Constant maintenance and inspections are vital to mitigate property risk. This, along with the loss prevention advice below, is your solution to commercial property risk mitigation. Risk solutions are our specialty at Conrey.

 

Loss Prevention for Commercial Properties:

 

  • How effective is your facilities manager? — Hire excellent facilities managers because they act as the first line of defense. They identify repairs that need to take place, which is a crucial role. Proactive assessment will save money and ensure buildings remain safe to occupy.[9]
  • Are you planning for repairs and maintenance? — In the long run, it is favorable to financially prepare for unexpected expenses to occur. Routine maintenance should be budgeted for in advance.[10] According to the University of Michigan School for Environment and Sustainability, 72% of commercial buildings in the United States are aged 20 years or older; it’s around this milestone that facilities managers should budget significant funds in advance for upgrades.[11]
  • When are building inspections conducted? Inspections should occur:
    • Annually;
    • After any significant event, such as wind storms, earthquakes or hurricanes;
    • Before and after any major addition or renovation.[12]
  • Who is performing inspections? — Ensure inspections are performed by qualified inspectors who have location-specific expertise. Inspectors must be familiar with indicators of damage. Structural engineers must assess the major structural components of the building to identify any necessary corrective actions. They should document inspections to allow for year-to-year comparisons of issues, with photos.[13]
  • Are local building codes known? —Building codes help maintain safety and sound structure in buildings. It’s essential to know and understand local building codes; this way, requirements are met. Regulations in harsher environments may have additional requirements.[14]
  • Are issues being dealt with swiftly? —When an issue arises, they must be acted upon as early as possible. Early action lowers costs versus allowing issues to mature and become more serious or perhaps dangerous. The safety of those who live or work in the building depends on structural issues being addressed and resolved.[15]  A failure in this loss prevention technique can result in a devastating event like the one New Orleans experienced in 2005 with Katrina.

For risk management guidance on par with New Orleans’ successful risk reduction infrastructure, consult with Conrey Insurance Brokers & Risk Managers. To speak with a member of the Conrey Team, call (714) 838-5835 or contact us and experience The Conrey Difference for yourself.

— Kyle Langan, Risk Manager at Conrey

 

[1] S&P Global.

[2] Editorial Board.

[3] Castillo, A.

[4] Levenson, E.

[5] Castillo, A.

[6] Levenson, E.

[7] Staff, U. S. I. C.

[8-15] Johnson Financial Group.

 

References

Castillo, A. (2021, August 31). Battered by Hurricane Ida, New orleans’ storm protection infrastructure holds fast. American City and County. https://www.americancityandcounty.com/2021/08/31/battered-by-hurricane-ida-new-orleans-storm-risk-reduction-infrastructure-holds-fast/.

Editorial Board. (2021, August 31). Opinion | Hurricane Ida shows the huge investments to protect New Orleans after Katrina paid Off. it’s a lesson for other cities. The Washington Post. https://www.washingtonpost.com/opinions/2021/08/31/hurricane-ida-shows-huge-investments-protect-new-orleans-after-katrina-paid-off-its-lesson-other-cities/.

Johnson Financial Group. (2020, January 24). Risk insights: Structural issues and aging buildings. Johnson Financial Group. https://www.johnsonfinancialgroup.com/resources/blogs/business-guidance/risk-insights-structural-issues-and-aging-buildings/.

Levenson, E. (2021, August 30). How hurricane Ida compares to Hurricane Katrina. CNN. https://www.cnn.com/2021/08/30/us/hurricane-ida-katrina-new-orleans/index.html.

S&P Global (2021, August 31). Hurricane Ida losses likely short of Katrina totals, could hit $25B. ProgramBusiness. https://www.programbusiness.com/news/hurricane-ida-losses-likely-short-katrina-totals-could-hit-25b?utm_campaign=dnf-2021-08-31&utm_source=dnf&utm_medium=email.

Soergel, A. (2015, August 28). From resilience to resurgence after katrina. U.S. News & World Report. https://www.usnews.com/news/articles/2015/08/28/new-orleans-economic-resurgence-after-hurricane-katrina.

Staff, U. S. I. C. (2021, August 11). Inflation calculator: Find US dollar’s value from 1913-2021. US Inflation Calculator |. https://www.usinflationcalculator.com/.

Biden’s Executive Order on Promoting Competition in the American Economy

/in /by

The American economy is finally recovering after more than a year of stagnation due to the COVID-19 pandemic. President Joe Biden’s administration wants to continue this momentum and further stimulate the economy. To help in that effort, President Biden recently signed an executive order aimed at increasing competition among businesses. This article provides an overview of these proposed initiatives.

At Conrey Insurance we want to ensure that you are up to date on all that is happening in the business world, including knowing what is changing due to Executive Orders. To speak with a member of the Conrey Team, call (714) 838-5835 or contact us and experience The Conrey Difference for yourself.

Cyber Risks & Liabilities: Ransomware Considerations for Board Members

/in , , , , , /by

In the Digital Age it is more important than ever to make sure that both you and your business are protected from Cyber Security threats. More and more we are seeing that businesses are falling prey to Cyber Attacks and worrying about whether or not they are covered for these attacks. This article discusses the questions that Board Members should consider to help make sure that their organization stays ahead of ransomware attacks.

At Conrey Insurance we want to ensure that you are covered in any instance, including if you have a Cyber loss. To speak with a member of the Conrey Team, call (714) 838-5835 or contact us and experience The Conrey Difference for yourself.