critical business insurance 2015

CRITICAL BUSINESS

INSURANCE

GUIDEDirectorInspiring business·

DirectorInspiring business·

A practical guide for board members

OFC Airmic guide_2015_Covers_V6.indd 2 07/10/2015 12:13

CRITICAL BUSINESS INSURANCE

2015

Group Editor, Director Publications Ltd: Lysanne CurrieConsultant Editor: Tom NashCreative Director: Chris Rowe

Production Manager: Lisa RobertsonPublishing Director: Vivien Cotterill-LeeCommercial Sales Director: Jo McGraw

Director General: Simon Walker

Cover: Getty Images

Published for the Institute of Directors, Airmic, ACE, PwC and Willis by Director Publications Ltd, 116 Pall Mall, London SW1Y 5ED

020 7766 8910www.iod.com

©Copyright Director Publications Ltd, November 2015A CIP record for this book is available from the British Library

ISBN 978-1904520-87-0Printed and bound in Great Britain

The Institute of Directors, Airmic, ACE, PwC, Willis and DirectorPublications Ltd accept no responsibility for the views expressed by

contributors to this publication. Readers should consult their advisers before acting on any issue raised.

A practical guide for business leaders

1_Airmic guide_2015_Title page V5.indd 1 07/10/2015 12:05

Critical Business Insurance 2015

AIRMIC

ACE

PwC

WILLIS

INSTITUTE OF DIRECTORS

Airmic represents corporate risk managers and insurance buyers. Its membership includes two-thirds of the FTSE 100, as well as many smaller companies. The association organises training for its members, seminars, breakfast meetings and social occasions. It regularly commissions groundbreaking research and its annual conference is the leading risk management event in the UK. It has previously published the widely acclaimed risk management reports Roads to Ruin and Roads to Resilience.

Visit www.airmic.co.uk

ACE Group is one of the world’s largest multiline property and casualty insurers, with operations in over 50 countries and a global network spanning around 200 countries in total. In the UK and Ireland, it serves clients and their brokers through 12 offices across five regions. ACE provides commercial and personal property and casualty insurance, personal accident insurance, supplemental health insurance, reinsurance and life insurance to a diverse group of clients. It offers particular experience in multinational programmes for organisations of every size. ACE is distinguished by its broad product and service capabilities, exceptional financial strength, underwriting and claims handling expertise, and local operations globally.

Visit www.acegroup.com

As the UK’s leading provider of integrated governance, risk and regulatory compliance services, PwC specialises in helping businesses and their boards create value in a turbulent world. Drawing from a global network of specialists in risk, regulation, people, operations and technology, PwC helps its clients to capitalise on opportunities, navigate risks and deliver lasting change through the creation of a risk-resilient business culture.

Visit www.pwc.co.uk

Willis Group Holdings plc is a global risk advisory, re/insurance broking, and human capital and benefits firm. With roots dating back to 1828, it now operates on every continent, with more than 18,000 employees in over 400 offices. Willis offers its clients superior expertise, teamwork, innovation and market-leading products and professional services in risk management and transfer. Its experts rank among the world’s leading authorities on analytics, modelling and mitigation strategies at the intersection of global commerce and extreme events. Across geographies, industries and specialisms, Willis provides its local and multinational clients with resilience for a risky world.

Visit www.willis.com

The IoD is the leading organisation supporting and representing business leaders in the UK and internationally. One of its key objectives is to raise the professional standards of directors and boards, helping them attain high levels of expertise and effectiveness by improving their knowledge and skills. It has previously published Business Risk: A practical guide for board members, produced in collaboration with Airmic, PwC and Willis.

Visit www.iod.com

IFC_Airmic guide_2015_Sponsors V6.indd 1 07/10/2015 12:12

2015 Critical Business Insurance

TAKE INSURANCE ON BOARD

FOREWORD

3

Simon WalkerDirector General, Institute of Directors

Insurance matters to businesses and to the directors who run them. If there is one overriding message in this Director Guide, it is that if you fail to understand the importance of business

insurance as a key part of your risk management oversight, then you are failing in one of your key roles as a board member.

There are at least four powerful reasons why insurance should be a recurring item on the board agenda of every company, large or small. First, today’s risk environment is continually evolving – and the challenges facing businesses are larger and more diverse than ever before. While traditional risks such as fire and flood have not gone away, they have been joined by new, emerging and growing risks such as cyber crime, terrorism and political violence, along with the risks born of doing business internationally, such as supply chain interruptions and legal and regulatory setbacks.

Second, insurance policies are among the largest commercial contracts many companies enter into. Their size and complexity alone means that they demand board-level scrutiny to ensure that cover is ‘fit for purpose’ and that it also represents good value.

Third, the recently passed Insurance Act 2015, which has significant implications for business, will kick in from August 2016. In essence, the new law aims to provide greater safeguards for policyholders, but it will also place them under new obligations and all boards will need to be aware of these changes.

Fourth, insurance goes far beyond protecting and supporting a business in a crisis – vital though this function is. The right business insurance acts as a strategic enabler, underpinning companies’ ambitions and allowing them to seize new opportunities.

Learn, question and challenge For some directors, insurance may traditionally have been a ‘grudge purchase’ – something they felt obliged to spend money on, but did so reluctantly, at the lowest possible price and with little understanding of the cover acquired. If so, the dynamic nature of today’s business environment demands a new approach.

Clearly, it is not feasible or desirable for directors to know every detail of the insurance buying process. But the onus is on them to know enough to be able to ask pertinent questions around the boardroom table, and to challenge other executives and insurance professionals. This guide provides them with many of the necessary insights to do so, as well as checklists of relevant questions to raise.

How many have you asked?

2-3_Airmic guide_2015_Contents_Intro V6.indd 2 07/10/2015 12:05


CONTENTS CONTRIBUTORS2

Chapter 1

4 When risks become real John Hurrell, Chief Executive, Airmic, highlights why companies must not

overlook critical business insurance

Chapter 2

7 Wake-up call for the board Alpesh Shah, Partner in the Actuarial Risk Practice, PwC, explains why critical

business insurance demands board-level attention

Chapter 3

10 Insurance as a strategic enabler Ailsa King, Head of Sales, Willis GB, describes how the right insurance not only

offers businesses protection, but also helps them to fulfil their ambitions

Chapter 4

13 Counting costs PwC’s Alpesh Shah discusses the potential financial impact on your business of a

flawed insurance strategy – and the value of scenario planning

Chapter 5

16 A buyer’s guide Phil Sharpe, Chief Operating Officer, UK and Ireland, ACE Group, presents a

rigorous approach to acquiring the right insurance cover at the right price

Chapter 6

19 Going global Karen Gorman, Head of International Programme Management, Willis GB,

outlines key considerations when coordinating insurance programmes globally

Chapter 7

22 Fast forward Andy Macfarlane, Regional Manager for Scotland, ACE Group, considers emerging

risks and explains the part that insurance can play in mitigating them

Questions for your board

John Hurrell has been Chief Executive of Airmic since 2008, following a career of almost 30 years in the Marsh and McLennan Group of companies, where he was Chief Executive of Marsh’s risk consulting business throughout Europe and the Middle East

Alpesh Shah is a Partner at PwC, where he leads the corporate risk analytics practice, developing innovative risk analysis solutions to provide boards with the tools to manage risk better

Ailsa King has over 23 years’ experience at Willis. Prior to her current role as Head of Sales for Willis GB, she led the business’s risk solutions client segment in the UK, delivering broker services to major clients with complex risk exposures

Phil Sharpe has worked in the London insurance market for over 30 years and, since 2012, he has been Chief Operating Officer of ACE Group’s retail property and casualty business in the UK and Ireland. Prior to his current role, he was Director of Casualty and Major Risks for the UK and Ireland region

Karen Gorman has 25 years’ experience in the insurance industry. Prior to her current role as Head of International Programme Management for Willis GB, she was a Partner within the global service risk practice at JLT

Andy Macfarlane has 25 years’ experience in the commercial insurance market in Scotland and in Bermuda. He joined ACE Group in 2010 and was appointed Regional Manager for Scotland in 2012. He currently serves as President of the Insurance and Actuarial Society of Glasgow

2-3_Airmic guide_2015_Contents_Intro V6.indd 1 07/10/2015 12:05


CHAPTER ONE WHEN RISKS BECOME REAL

and how it relates to the risk exposures identified in their risk register, before a crisis occurs. It is particularly vital for directors to appreciate the true financial implications of business-critical insurance – or the lack of it – by understanding key metrics and crisis scenarios.

Think value, not costOne of the recurring themes of this guide is that, when purchasing business-critical insurance, companies should negotiate their policy based on its efficacy – its ‘fitness for purpose’ – and not on price alone.

In a recent review of claims handling for small and medium-sized enterprises (SMEs), the Financial Conduct Authority noted “a gap between the claims service received and the SMEs’ expectations”. It went on to highlight “a number of instances where the sum insured was inadequate to cover the loss”.

This problem is entirely avoidable, but will require companies to understand that not all insurance is the same. As with most buying decisions, you get what you pay for. Indeed, if a contract is designed to provide cover against events that could lead to serious balance sheet damage, or even threaten the survival of a business, boards should be wary of false economies. Remember, having an insurance policy that will pay out as and when you expect it to is the most important criterion. This may, in some instances, result in paying more for the insurance policy, but ultimately paying the right premium for the right cover will benefit the business financially in the long term.

Few companies have an in-house insurance expert, so it is also essential that senior decision-makers have access to professional advice before authorising the purchase of insurance cover. For example, where insurances relate to critical assets and facilities, getting independent legal advice on the coverage of the policy is best practice. Insurers are increasingly using lawyers in the event of a claim, so it is prudent to acquire your own legal advice at the outset: once the loss has occurred, it is too late.

5

4-6_Airmic_2015_Chapter 1_Overview V6.indd 2 07/10/2015 12:06


Insurance is business criticalInsurance policies are often the largest and most complex commercial contracts that a company enters into. The successful payment of a claim may well underpin the continuing financial success of the company – or even its survival. And, as the following chapters make clear, when approached in the right way, insurance is also a key strategic enabler and potentially a means of taking carefully calculated risks to achieve competitive advantage.

But how often is insurance on the board agenda? In no other area of business would a contract worth potentially hundreds of millions of pounds fail to receive board-level scrutiny. Despite its importance, many company directors have little understanding of their company’s insurance requirements. All too often, insurance is viewed simply as a necessary cost overhead without much consideration of its scope or effectiveness – they assume that policies will pay out when needed. While most policies do indeed pay out, such complacency can be costly, especially regarding larger and more complex claims.

When a large risk materialises that is uninsured, or where a claim against it is delayed, unpaid or only partially paid, it can seriously threaten the financial viability of the business. The consequences can be disastrous. Many companies would face a huge challenge to finance an uninsured loss or payment delay involving, say, their largest physical asset or a liability claim that might equate to pre-tax earnings.

Boards, therefore, must be asking important questions about their insurance programme

4 WHEN RISKS BECOME REALJohn Hurrell, Chief Executive, Airmic, highlights why today’s directors must not overlook business insurance

• The risk environment is continually evolving – and the challenges facing businesses are more diverse than ever

• Insurance policies are among the largest and most complex commercial contracts

• A new legal framework will govern commercial insurance from August 2016

• Business insurance cover must be ‘fit for purpose’, as well as good value

• Insurance alone will never be enough to protect a business from all risks

Summary



WAKE-UP CALL FOR THE BOARDAlpesh Shah, Partner in the Actuarial Risk Practice, PwC, explains why insurance demands board-level attention

CHAPTER TWO WAKE-UP CALL

A vital toolInsurance is critical to protect and grow a business. It is often also one of the most complex and financially significant contracts organisations enter into. Yet insurance is seldom discussed seriously at board level.

Insurance is a vital tool to help almost all companies manage key aspects of risk they face. There will be implicit reliance on insurance to mitigate the impact of some of the most material risks that businesses face, providing quiet confidence that, should the worst happen, the financial costs will be covered by a third party. In short, insurance is a strategic enabler, allowing risks to be actively taken in the pursuit of a strategy that would otherwise not be palatable.

On a more practical, operational level, insurance may be critical to a business’s licence to operate. There are many situations that require insurance to be in place in order to allow business to continue operations, ranging from regulatory or legal obligations and debt covenants through to market requirements due to competitive pressures and industry norms. In these situations, the existence of appropriate insurance is often taken as given around the boardroom table, and assumed to have been put in place by those tasked with procuring it. But such complacency in these business critical situations is a potentially serious mistake. The failure or non-performance of insurance could have a catastrophic effect on the business’s ongoing ability to operate.

Insurance governanceRevisions to the Corporate Governance Code in the UK place increased emphasis on the board’s duty to ensure the effective management of risk. Given the importance

7

• Insurance is critical to protect and grow a business, but it is often absent from the board’s agenda

• Boards have a duty to ensure that insurance cover is appropriate and effective, but many are failing in it

• It is not acceptable for boards simply to abrogate responsibility by ‘outsourcing’ insurance purchase

• Insurance should play a major role in supporting a business in a crisis

• Businesses face an increased legal obligation to provide insurers with robust information

Summary

7-9_Airmic guide_2015_Chapter 2_PWC V6.indd 1 07/10/2015 12:07

WHEN RISKS BECOME REAL CHAPTER ONE

those that ‘keep directors awake at night’ but, despite this, research suggests that boards often incorrectly assume they have cover for them.

Insurance solutions are developing for these emerging risks. But no matter how thorough and well designed your insurance programme is, in today’s dynamic business environment insurance alone will never be enough to protect a business from all the risks it faces.

So, while boards must ensure they are asking the right questions about insurance, the conversation must not stop there. Businesses must still establish crisis management and business continuity plans to respond to adverse events and potentially uninsured losses.

Insurance should never replace the need to look at today’s top business risks and consider how these can best be managed holistically.

If the first step is to use the corporate risk map to undertake due diligence into business-critical insurance, the second must be to ask how the risk map can inform a company’s wider risk management strategy and processes, with a view to making the business truly resilient to the challenges of the 21st Century.

6


It is also best practice for senior management to test the insurance programme against specific scenarios, such as those at the top of the corporate risk map, with their insurance advisers. This will demonstrate how the policies would respond in the event of a claim, and flush out any gaps in cover. Changing risk environmentThe risk environment is continually evolving – and the challenges facing businesses today are more diverse and complex than ever before.

Many risks are non-physical and harder to define than in previous business eras – covering areas such as cyber, reputation and intellectual property. This is particularly true of emerging risks. Strategically, these can be the most important risks for businesses because they are often by-products of new business opportunities. Emerging risks tend also to be

Insurance Act 2015

A new legal framework will soon govern commercial insurance contracts. The Insurance Act 2015 is one of the most significant legal reforms for decades and affects all businesses. Boards need enough understanding to question relevant executives.• The act will apply to the placement of all UK commercial

insurance policies from 12 August, 2016• The reform is largely for the benefit of the insured party,

putting in place greater safeguards for policyholders• However, insured businesses will also be subject to new,

more specific rules about the information they disclose to insurers, including information known by senior management. Companies should therefore be prepared for greater due diligence and a more legalistic approach from insurers

• Businesses must not be complacent: even with the new safeguards in place, insurance can still fail to perform as expected in the event of a claim.

Many company directors have little understanding of their company’s insurance requirements”


circumstances, disputes regarding liability and simply delays in understanding the extent of the loss, often lead to delays in claim payment or disputed compromise settlements.

The failure of insurance to respond fully as expected when risks materialise is a business risk in itself. Does your corporate risk register recognise this?

Cover in a crisisInsurance should play a major role in financially supporting businesses at times of crisis. When the worst happens, the first port of call for the board will typically be to address any immediate threats to people or assets, understand the emerging risk scenario, and manage communications with stakeholders. Business recovery plans will come into play in an attempt to ‘steady the ship’ and ensure that the business disruption from insured events is contained and immediate adverse consequences are managed.

Soon after, however, attention will turn to insurance as a means to start rebuilding and remediating. At this point, the strength of the relationship between the insured and the insurer can be tested. The mark of a strong, symbiotic relationship with insurers and brokers is the immediate support of the business, often around the implementation of short-term, practical actions to contain damage and rapidly establish the parameters of any potential claim. If there has been clarity around the nature of the insured risk at the time the cover was purchased, there will be less scope for challenge from, and dispute with, insurers when it comes to making claims.

Too often, however, it is at the point of claim that the nature of the risk is really investigated to find out if such clarity exists. Before a crisis or a setback occurs, boards should ask how well their company’s risks have been articulated to, and understood by, their insurers. By acting with foresight and rigour in this way, support from insurers is much more likely to be forthcoming when it is really needed.

New obligationsFrom August 2016, the Insurance Act 2015 will place an increased requirement on insured businesses to ensure that the information they provide to insurers at the time cover is purchased is suitably robust and controlled. Boards should ask how well controlled insurance risk information flows are within their organisation, as it is often separate from financial information and, as such, may not be as accessible or well maintained.


CHAPTER TWO WAKE-UP CALL

9

As well as managing business risks and insurance, board members should also consider risks they face in a personal capacity. Often, the two are linked.The exposure of directors and officers (D&Os) to lawsuits is on the increase, as regulators and shareholders focus on high standards of corporate governance and legal and regulatory compliance, and look to hold individual executives personally liable for failures. Pitfalls come in a variety of forms and the cost of defending claims is rising rapidly.D&O insurance is a key safeguard. Insurers offer specific cover to address the needs of individual board members, most importantly protecting their personal assets. Key areas of cover available to individuals include:• Special excess protection for non-executive directors• Lifetime run-off for retired insured persons• Investigation cover• Extradition cover• Environmental cover• Public relations cover to mitigate the adverse effect on an individual’s reputation.

This is personal

Key questions for the board• How often does insurance feature on the board agenda?

When was the last time the board approved the corporate insurance strategy or renewal?

• Does the non-performance of insurance feature on your corporate risk register? What plans do you have in place if claims are challenged and settlements are delayed or partial?

• How well controlled are the processes used to provide corporate risk information to the insurance market? When were these last tested?


8

that insurance plays in the ability of a business to operate, and the financial significance of insurance contracts, this should include the mitigation of risk through insurance. The board has a duty to ensure that coverage is appropriate and effective.

In reality, when it comes to insurance, many boards are falling short of the required standard. Consider, for example, the amount of board scrutiny likely in raising £100m of debt or equity or transacting a £100m merger, compared with placing £100m-worth of insurance coverage. As the illustrative chart above shows, in most cases there will be a significant disparity in the level of board focus.

It is often argued that insurance contracts are complex, and therefore difficult for directors who are focused on running their business to understand and challenge. But it is

not acceptable for boards simply to abrogate responsibility by ‘outsourcing’ insurance purchasing to the company’s specialist insurance buyer or external broker. Whilst the skills of a dedicated insurance buyer, coupled with the advice received from brokers and other risk consultants, form a valuable basis for the placement of insurance, it remains the board’s duty to ensure the coverage entered into is appropriate and effective. Given its business-critical nature, insurance and its purchase require a level of challenge around the boardroom table.

Simply having an insurance programme in place should not imply that the financial costs of risks the business thinks are covered will always be so. There are many reasons why insurance may not provide the cover expected at times of crisis. Legal challenges to claim

Before a crisis occurs, boards should ask how well their company’s risks have been articulated to, and understood by, their insurers”


Illustration of board prioritiesInvestment of time and money on arranging £100m equivalent

Diligence on company Raising equity Loan Insurance

Source: PwC client experiences



CHAPTER THREE A STRATEGIC ENABLER

rises to 90% for small businesses that suffer a data loss incident.

This highlights the importance of a business having the right incident management plans and insurance in place to get back on its feet. Appropriate insurance cover can help with everything, from rebuilding destroyed physical assets to providing compensation for business interruption; ensuring companies survive and thrive after what can be a catastrophic event.

The risks faced by companies, both large and small, are constantly changing and increasing in number, diversity and complexity. This trend is demonstrated by the growth in the digital economy and increasing reliance on sophisticated data, exposing businesses to potential cyber attack and loss of customer data.

In several high profile cases this has led to significant reputational damage accompanied by severe financial loss, much of which could have been avoided by businesses understanding the risks they face, how they might change in the future and implementing the correct risk mitigation strategies.

The importance of the right insurance and risk advice is clear.

Enabling tomorrowIf the purchase of insurance and risk management advice is not a key strategic decision, a business cannot make fully informed choices about its future.

Forward-looking businesses understand that having the correct insurance and risk management strategies in place has a positive

11

Research finds 90% of small businesses that suffer a data loss incident fail within two years”

10-12_Airmic_2015_Chapter 3_Willis V8.indd 2 07/10/2015 12:08


INSURANCE AS A STRATEGIC ENABLERAilsa King, Head of Sales, Willis GB, describes how insurance not only offers businesses protection, but also helps them to fulfil their ambitions

Thinking strategicallyUnderstanding where a company wants to be in the future, identifying risks that might stop it getting there, and working with risk advisers and insurers to get the right risk management, transfer and mitigation strategies in place, all help build a resilient and sustainable business.

To realise this ambition, businesses should be asking their risk advisers and insurers to look beyond the existing insurance programme and examine the company’s short and long-term objectives, together with its risk register, to fully understand the wider range of risks it faces.

Protecting todayInsurance can be seen as a tactical purchase, with the decision on what insurance to buy (and from whom) sometimes coming down to cost and minimum compliance with legal requirements, as opposed to the quality of the cover. This is particularly true in the current competitive economic environment, where companies are squeezed and cost savings need to be made.

This approach, while appearing expedient in the short term, ignores the fundamental value of good quality insurance and its strategic importance in building resilience for the future.

Research around the world (including recent studies by the UK government and US audit and accountancy practice McGladrey) shows that 70-80% of businesses that suffer a major loss, and which do not have an effective business continuity plan (and adequate insurance), are no longer trading two years after the incident took place. This number

10

• Insurance is sometimes seen as a tactical purchase, with the decision based on cost rather than quality of cover

• The right insurance can help overcome a crisis – but this is only part of the story

• Insurance and proactive risk management is a ‘strategic enabler’, providing certainty and ultimately helping companies to achieve their goals

• Strategic ambition will bring increased risks. Boards should strive to identify where risks will arise and ensure the right protection is in place

Summary



COUNTING COSTS PwC’s Alpesh Shah considers the potential financial impact on your business of a flawed insurance strategy

CHAPTER FOUR COUNTING COSTS

No ordinary overheadIt is often at times of crisis, when insurance losses are triggered, that board and senior management attention really focus on the value and performance of the corporate insurance programme. But the true value of business-critical insurance to the organisation should be considered when insurance strategy is set and cover purchased. Comparing the amount of cover required, the size of potential losses and the financial consequences of not having cover, or insurance not responding as expected, against other key financial metrics is a way of creating appropriate focus on insurance.

Metrics matterAround the board table, most significant business decisions will be based on an analysis of relevant financial metrics. These might include, for instance, the potential impact of a new product on gross revenue or operating profit, the consequences of rationalising back-office functions on business expenses or the impact of a proposed merger on shareholders’ equity. The reason for this is simply that metrics provide a common language in which to measure business success, both internally and with external stakeholders, such as financial analysts and lenders. Strategic outcomes, whether positive or negative, are often expressed in terms of these metrics. Similarly, the impact of risk, whether insured or not, can

13

• The true value of business-critical insurance should be considered when insurance strategy is set and cover purchased

• The impact of risk can be measured through established financial metrics, providing a consistent strategic view of risk and reward around the business

• If the business suffers a significant loss, the board must consider its short and longer-term financial implications

• There may be an expectation that insurance will respond, but claim circumstances can affect payouts

• Boards should consider possible loss scenarios, enhancing the corporate risk register, recovery plans and insurance cover in light of them

Summary

13-15_Airmic_2015_Chapter 4_PwC V6.indd 1 07/10/2015 12:09

A STRATEGIC ENABLER CHAPTER THREE

12


Key questions for the board

Insurance as a strategic enabler

Understanding your risk exposures

Protecting today• Do you understand the full range of risks you currently face and the different

strategies available (including insurance) to help mitigate them?• Has your current insurance responded to previous claims as you expected?• Are you buying enough cover and retaining the right amount of risk, or

would it be better to transfer more of your exposures using insurance?• Have you considered the changing claims environment and how this

impacts your loss history?• Have you considered alternative risk mitigation and transfer solutions to

insurance?

Enabling tomorrow (strategic planning)• Are you considering how insurance may help strategic decision-making?• Do you understand what risks your company’s medium to long-term

strategies may create?• Do you understand how the ability to insure certain risks can positively

influence strategic decision-making?• How can insurance help mitigate new areas of risk, such as international

expansion, new markets and new products and services?• How might insurance form part of your value proposition to customers? (For

example, have you considered affinity/reinsurance options?)• Does your risk adviser look beyond today to understand what risks you may

face tomorrow?• Is your risk adviser keeping you up to speed with benchmarking and how

your competitors are mitigating risk?• Is your risk adviser making recommendations on risk management and

insurance that clearly are directly relevant to YOUR business strategy?• Is your risk adviser keeping you informed on trends in the legal and

regulatory environment as it relates to risk in your business?

impact on the delivery of a company’s short, medium and long-term ambitions. Most businesses have a clear vision about where they would like to be in one, three or five years’ time, and will have strategic plans in place to help them achieve their aims.

These objectives can be diverse, ranging from new product launches, international expansion, moving into fresh distribution channels, or growth through merger or acquisition.

Achieving any of these goals will involve some element of increased business risk, for example, greater exposure to cyber crime, or risks associated with the ownership of overseas assets, the management of international supply chains, or the need to comply with unfamiliar legislation.

The importance of understanding these risks and how they might affect a business cannot be overstated and successful companies are those that place risk identification and mitigation, now and into the future, at the heart of their business’s strategic planning process.

Research confirms that while the circumstances and macro dynamics of businesses are quite different, the challenges and risks they face can be surprisingly common.

This insight has led to the development of an analytical framework that businesses and their advisers can use to build a deeper understanding of key performance areas and the risks relating to each.

This insight looks beyond traditional risks, highlighting areas that would not be apparent in traditional strategy and risk planning processes.

The main elements of this framework are:

Helping to attract talent If a business is expanding, perhaps into a new territory or an area of potential political instability, it may face a challenge in attracting and retaining the best people. Insurers can offer a range of products to help companies attract the necessary talent, including employee benefits such as pensions, healthcare and, in the case of overseas workers, repatriation insurance in the event of a crisis.

Market developmentOffer development

Margin developmentAcquisition

Human capitalRelationship capitalBrand capitalPhysical capital/IP

Impact on societyCorporate identity

GROWTH VALUE

CITIZENSHIP


board considers what the short, medium and long-term financial implications of dealing with it may be. Whilst the risk resulting in the loss may have been on the corporate risk register, and the stated mitigation may have relied on insurance cover, the live business impact of such losses is often more financially complex.

Short-term costs relating to immediate business recovery costs, dealing with stakeholder communications and eliminating any immediate threats to people or assets will have to be met out of the business’s free cash resources or agreed short-term credit facilities. Beyond that, any immediate impact on business operations may result in additional business continuity costs, either as revenue shortfall due to failure to supply customers or remain

open for business, or as additional expense, for example from keeping staff employed when production has ceased. In the case of liability claims, legal costs will also start to mount up.

Longer term, there may be an expectation that insurance cover will respond to these costs. But insurers will still need to complete appropriate diligence on the claim circumstances before approving payments and, where disputes arise around the admissibility of the claim, the financial recovery from insurers may be delayed or diminished by compromise settlements. Sources of finance to bridge the gap between loss expense and insurance payout, such as bridging loans, are increasingly rare, and access to additional credit financing at times of business distress can be difficult to secure.

It is within the context of these financial challenges that boards should consider how well prepared the company is to cope with potential losses. Running through possible loss scenarios, enhancing the corporate risk register, business recovery plans and insurance provision in light of them, will help to get the business on the front foot.


CHAPTER FOUR COUNTING COSTS

15Running through possible loss scenarios, enhancing insurance provision in light of them, will help get the business on the front foot”


• What are the financial implications of not insuring or insurance not responding as expected? How do these compare with the financial metrics the business is assessed against?

• Which financial metrics and targets are most critical to your business and its success? What risks does the business face that threaten their achievement? Does insurance feature as a response to these threats?

• Do you understand the short and long-term financial consequences of various loss scenarios to the business? How effectively do insurance, business recovery plans and other emergency financing arrangements interface in light of these scenarios?


14

also be measured in terms of these metrics to provide a consistent strategic view of risk and reward around the business.

Considering insurance limits and potential losses in the context of these key financial business metrics will help raise the discussion of insurance up the board agenda, enabling appropriate attention to be given to insurance decisions that may be just as important, in terms of their financial implications, as other board-level business issues.

The chart above provides an illustrative example of a range of financial business metrics against which proposed insurance limits or potential loss sizes can be plotted.

The chart can be used to plot individual insurances versus financial consequences in the event of the insurer failing to meet the customer’s expectations of a claim. Clearly, while this particular chart relates to a ‘generic’ organisation, companies can easily prepare their own version using readily available data. When preparing their own chart, insurance managers should consider:• The financial metrics listed on the ‘y’ axis

will not be relevant to all organisations, or a variation may be more appropriate. For example, ‘business-critical expenditure’ may refer to R&D, marketing or other costs

• The values for each financial metric listed on the ‘y’ axis should be readily available from the annual report and accounts, or from the company’s finance department

• Thorough, robust loss-forecasting data is required when plotting the ‘x’ axis. Companies should consider the types of loss likely to affect the business, the expected value of each type, and whether the loss would need to be financed within one financial period or could be spread

• The financial and corporate structure of the organisation will affect the consequences of financing an uninsured loss. Specific considerations could include the company’s liquidity, leverage and borrowing facilities.

The chart can form a practical basis for describing the financial and accounting strain that would be placed on the company in the event of a significant loss where insurance does not respond as needed. Drawing comparisons helps to provide clarity. For example, the chart shows that losses incurred from a potential product recall would be larger than annual dividend payments, putting those payments at risk. Similarly, a third-party liability exposure, if unmitigated, could wipe out shareholder equity.

Financing losses in a crisisWhen the worst happens and the business suffers a significant loss, it is essential that the


Relationship between financial losses and key financial business metrics

Size of insurable loss (£)

Gross revenue

Shareholders’ equity

Long-term debtBusiness-critical

expenditureOperating cash flow

Undrawn overdraft & short-term loansOperating profit

Interest payments

Total annual payroll

Profit after tax

Dividend payments

Short-term debt

Cash & cash equivalents

Product recallsignificant loss

Finance businessmetrics (£)

PDBIsignificant loss

Third partyliability

Source: Business Critical Insurance, report by Airmic and PwC, June 2015



CHAPTER FIVE A BUYER’S GUIDE

17

What could impact your business and prevent you from delivering your goods or services to your customers?

2 Evaluation

What measures and prevention can you put in place to protect your balance sheet and ensure you survive if the worst happens?How will you ensure that these measures are robust and provide value?

3 Control

What do you need to protect?Some risks will threaten the survival of your business whilst others, although undesirable, will have less impact. During this stage, you should establish what assets – both tangible and intangible – you must ensure are protected.It is important to:• Understand the business’s requirements – now and in the

future• Consider assets beyond buildings and stock, such as key

personnel, reputation and brand. Think through: the potential impact of a loss of data; your ability to relocate or replace plant and machinery; how robust your suppliers are; and the strength of your relationship with key customers

• Review or create a risk register, which will inform your decision-making and provide a checklist for your final programme.

Stage 1: Identification phase

What are the threats to your business?Once you have established what you need to protect, you can begin to consider what threatens those assets.It is important to:• Evaluate the risks. Identify the real risks and threats, which

will go beyond traditional fire, flood and theft• Evaluate risk appetite. What risks can your business

potentially manage and how would an impact here affect your strategy?

• Consider risk mitigation. What are the available options?

Stage 2: Evaluation phase

What are the potential solutions to the threats your business faces?This phase is about ensuring that you have coverage and mitigation for risks, without gaps or overlaps.It is important to:• Consider both insurance and non-insurance solutions• Assess the credentials of professional partners• Demand more from insurers• Know your risk mitigation programme• Own relationships with insurers and other partners• Take a proactive approach to claims.

Stage 3: Control phase

16-18_Airmic_2015_Chapter 5_ACE V8.indd 2 07/10/2015 12:10


A BUYER’S GUIDE Phil Sharpe, Chief Operating Officer, ACE UK & Ireland, presents a rigorous approach to ensuring insurance programme efficacy

Price versus valueAs previous chapters have noted, insurance is one of the most significant purchases a company can make. Insurance is about protecting a company’s balance sheet by transferring risk to a secure partner. In addition, insurance may be required by law, or by other parties, in order for a business to trade. Ensuring that the correct provision is in place could ultimately determine a company’s very survival, as well as opening up new strategic opportunities, underpinning growth by mitigating known business risks and allowing investment risk elsewhere.

But for all this to hold true, an insurance programme must be robust, fit for purpose and meet the real-world needs of the organisation – which is why programme efficacy is ultimately a board-level responsibility. Yet, in many instances, there is insufficient engagement at board level into the design of insurance programmes, as well as a poor perception of their worth. For board members, a good approach to ensuring programme efficacy is to consider the policy, not merely in terms of its chargeable cost, but as having a value equal to the limit of the indemnity being purchased. This approach should help the board to recognise insurance cover as the valuable asset that it is.

As investment guru Warren Buffet has famously observed, “Price is what you pay; value is what you get.”

Programme efficacy In order to ensure that your insurance programme is fit for purpose and offers your business value and protection, insurance purchase decisions must be part of a broader risk management review, as the accompanying model and its adjacent commentary illustrate.

16

• The process for ensuring that an insurance programme is fit for purpose can be split into three key stages:

Stage 1: Identification phase

What are you trying to protect?

Stage 2: Evaluation phase

What are the threats to your business?

Stage 3: Control phase

What are the solutions to these threats?

• There is no ‘one size fits all’ template for ensuring an insurance programme meets every requirement

• Board engagement and intervention at key stages will ensure that the ultimate solutions are more resilient and underpin an organisation’s survival and growth

Summary

What do you need to protect to ensure your business survives in the event of a disaster?

1 Identification

The three phases of ensuring programme efficacy



GOING GLOBALKaren Gorman, Head of International Programme Management, Willis GB, highlights key issues in global insurance

CHAPTER SIX GOING GLOBAL

A complex worldThe connected digital economy enables companies of all sizes to trade globally, offering them significant new opportunities. Yet this new paradigm also creates a far more complex operating environment.

Success in the global economy is about understanding and managing that complexity, whether it is unfamiliar local laws and regulations, cultural differences or complicated global supply chains. And that requires excellent local and international knowledge, communication and organisation.

Companies should be fully aware of the impact international exposures may have on their business, and ensure they have intelligent and comprehensive insurance programmes that meet international requirements and provide them with the right level of protection.

Local variationsBusinesses should be aware of, and adjust to, local practices and insurance requirements as these can vary dramatically between the different countries in which they operate.

Examples include:• Local tariff premiums or

minimum filed rates• Mandatory local insurance

retentions where there is a requirement to retain risk in the local insurance market

19

• Globalisation creates a far more complex operating environment from an economic, political, technological and cultural perspective

• Companies should be aware of their international exposures, and ensure they have comprehensive insurance programmes in place as protection, either globally or locally

• Local practices and regulations can vary dramatically between the different countries in which businesses operate

• A well-managed, centralised programme streamlines the management of diverse stakeholders, ensuring their efforts are aligned

• Businesses should regularly review their international insurances to ensure they meet their ongoing needs

Summary


A BUYER’S GUIDE CHAPTER FIVE

18


The board should embrace the following actions and challenges to ensure the company is correctly covered and, therefore, that any claim will be paid:• Are you engaging with your insurer in pre-loss planning?• Is all the information you provided your broker/insurer

accurate? • Do you have a mechanism for updating changes about your

business to your broker outside of renewal time?• Do you have clarity on which covers are critical?• Have you been realistic about the cover you can achieve with

your budget?• Have you thoroughly reviewed all documentation and

challenged where appropriate?• Have you and your colleagues met your insurer’s claims team

(pre-loss)?• Do you know what the claims culture of your insurer is?• Are you familiar with your insurer’s claims processes?• If you are partnering with more than one insurer, have you

undertaken a gap analysis between covers?• Have you documented where necessary?• Have you, as a management team, considered all reasonable

threats to your business – particularly emerging risks?


A three-stage process As a minimum, boards should be discussing the three key stages in the model, as such debate can often anticipate risks and help avoid damage to the business. Preventing losses in the first place is ultimately far preferable to compensation after an adverse event.

Although there are three clear stages involved in achieving programme efficacy, ensuring your organisation is adequately protected from risk is a continuous cycle, and board members should be aware that different elements of a programme can co-exist in different stages at the same time. External factors can also shift components to a different place in the cycle without warning, so you must be prepared to revisit any area at any time.

Key interventions for the boardThere is no ‘one size fits all’ template for ensuring an insurance programme meets every requirement for every business. Experience tells us, however, that the board’s full engagement and decisive intervention at key stages of the process will ensure that the ultimate solutions are more resilient, helping to underpin an organisation’s ongoing survival and future growth.

The board should be actively involved in:• Shaping risk strategy. What are the key drivers, risk

appetite and strategy?• Appointing someone internally to be responsible for

insurance procurement• Reviewing the big picture of what assets to protect and

how• Broker selection• Risk transfer strategy. The board should have regular,

thorough insight into the process• Meeting proposed and incumbent insurers and

challenging their capabilities. Good insurers will rise to the challenge

• Monitoring the programme – receiving regular updates and reviews

• Responding to change. Today’s dynamic, interconnected world requires the board to be proactive in adapting its risk management and insurance strategy.

The board’s full engagement and decisive intervention will ensure that solutions are more resilient”


Enhancing effectiveness Businesses can make managing their insurance programme easier by being aware of the types of information insurers, brokers and regulators may require.

More may be needed than just underwriting information in order for insurers to calculate premiums and taxes in different countries, and this may vary depending on the class of insurance. To issue or price a local policy, any relevant legislation – for example anti-money-laundering rules and sanctions – must be adhered to. Information such as the following will also be required:

• Local legal entity names and addresses, and fiscal codes


CHAPTER SIX GOING GLOBAL

21• Proposal forms or financial statements for financial lines

• Any additional insured under local policies• Business descriptions.

Getting it right first time This maximises global transparency and efficiency, and can be facilitated by:• Treating problem countries as a priority• Documenting commonly raised problems • Working with the broker or risk adviser on

how to mitigate them• Clearly formulating communication

channels and eliminating duplication• Establishing information requirements early

in the renewal process• Incorporating action points relating to global

programme administration into the renewal timetable

• Planning ahead.

Go global, be flexibleBusinesses should regularly review their international insurances to ensure they meet their needs as they grow, particularly into specific markets or new, untested territories. An international programme should also be flexible enough to adapt to changes in the wider business environment, such as new legislation or amendments to local regulations.


• Do you have clear documentation that sets out reporting guidelines, communication and escalation channels, and the insurance framework (a consistent service platform and tangible objectives)?

• Do you have a robust renewal process with a quality management system in place and consistent processes across all network offices, covering areas such as compliance?

• Do you have a communication schedule that ensures regular communication with all of your territories to ensure clarity, with no duplication of effort? Is information escalated to the relevant stakeholders or disseminated quickly and effectively?


Where required, a company’s risk adviser should align its network to the local offices of its client’s business.

• Cost-effectiveness Buying an insurance programme centrally

– as opposed to buying cover locally – helps to control cost through the economies of scale and purchasing power of the business.

• Broader coverage Purchasing insurance centrally often

means a company can leverage more comprehensive cover. This may also include non-standard covers that it may not be possible to purchase in some countries.

20 • Cash before cover/other premium payment rules

• Compulsory covers or those aligned with local market practice

• Local capacity (including sharing of limits, aggregation)

• Scope of cover locally (including awareness of tariff wordings)

• Exchange controls.

Managing risk and connecting stakeholdersEven for relatively small companies, purchasing international insurance cover involves many diverse stakeholders, including insurers and other local service providers.

A well-managed insurance programme streamlines the management of all of these stakeholders, ensuring their efforts are aligned and focused on delivering the right solutions.

Businesses can manage their risks efficiently by having a centralised approach, rather than allowing local offices to make standalone insurance purchasing decisions. However, an effective programme should be benchmarked against the cost of insurance bought locally, to confirm that the benefits of a centralised programme prevail.

Realising the benefits • Consistency Best practice is more easily shared through

centralised programme management across all the territories a business operates in, allowing for greater control and enabling standardisation of insurance and risk management processes.

• Compliance A centralised programme assists with

corporate governance and helps ensure compliance with local laws and regulations.

Businesses can manage their risks efficiently by having a centralised insurance programme”




CHAPTER SEVEN FAST FORWARD

management attention as the chief obstacle to effective emerging risk management. Specifically, managers may wish to maintain a ‘risk radar’ database of emerging risks, and each time they look at the company’s risk register, review it to consider whether any are worthy of elevation.

• Collaborate Managing emerging risks requires a

multidisciplinary effort, with different functions working together. A piecemeal approach is unlikely to work well and, by making it everyone’s responsibility, boards can help ensure that it does not become a siloed activity. By setting the right tone and expectation from the top, business leaders will help to build the right culture of emerging risk awareness throughout the company. Cyber risks, for example, cannot be the responsibility of the IT function alone, just as supply chain risks should not solely be the concern of the operations team.

• Take skilled advice ACE’s research identifies a lack of human

resources and skills as a major obstacle to good emerging risk management, particularly within smaller companies. This does not mean companies have to provide all of the solutions in-house, but it does mean careful attention should be given to the choice of external partners – including insurance partners. The board must be confident it can call upon specialist emerging risk skills and experience when needed.

• Access additional services Many SMEs are increasingly taking

advantage of insurance market solutions that go beyond the traditional insurance

policy. This may include practical benefits such as automatic access to specialist legal advice in the area of employer’s liability or D&O claims, information security audits, or incident management or crisis PR support for environmental, cyber or export liability incidents, for example.

• Provide full information Comprehensive insurance solutions are

still a work in progress in some areas of emerging risk. Especially where there is limited historical information on which to base pricing decisions, underwriters may also require more information than usual in order to calculate exposures. This typically includes areas such as supply chain and cyber risk where, the better the risk management processes in place and the information available, the more productive any insurance discussion is likely to be. Reputational risk is recognised as being particularly difficult to insure. Indeed, in ACE research, two-thirds of companies said that they feel inadequately covered for reputational risk. Nevertheless, the increasing number of practical crisis management and incident response

23

By setting the right tone from the top, business leaders will help to build the right culture of emerging risk awareness”



FAST FORWARDAndy Macfarlane, Regional Manager for Scotland, ACE Group, considers emerging risks and explains how insurance can help mitigate them

Emerging risk and insuranceThe risk environment for businesses continues to evolve. Some risks, such as cyber, are relatively new. Others, such as D&O liability and environmental and reputational risk, have been around for a long time, but have taken on a new dimension due to social, economic and regulatory change. Compounding this increasing complexity, risks today are often interconnected, with loss events no longer respecting the neat categories they may have fitted in the past.

Specific insurance products are evolving as risks become more complex. However, choosing the right solution has to be about more than simply transferring risks at the best price. Companies need to ensure they have clarity about the boundaries of insurance contracts, what can and what cannot be covered, and what information and risk behaviours insurers expect of them when discussing coverage.

Identifying and managing emerging risks The identification and monitoring of emerging risks is far from straightforward. However, the dynamic nature of today’s risk environment means that it should be a growing priority for all companies to ensure they have the frameworks, capabilities (both internal or external) and processes to monitor their emerging risks, as part of a broader enterprise-wide approach to risk management:

• Pay attention Companies should ensure they give adequate

airtime to emerging risk at board and management level. In recent research by ACE with European companies from a range of industries, many small and medium-sized enterprises (SMEs) pointed to lack of

22

• Businesses face a constantly changing risk environment, with new threats, such as cyber risks, emerging

• As risks evolve, so too do the insurance products that cover them. But choosing the right solution has to be about more than simply transferring risks at the best price

• Companies must know what information and risk behaviours insurers expect from them

• Boards should take care to address known gaps in their knowledge when it comes to insuring emerging risks

Summary



Board attention to risk and insurance• How often does insurance feature on the board agenda? • How often does the board approve our corporate insurance programme or policy

renewal?• Does the board fully understand the risks we face and the different strategies

available, including insurance, to help us mitigate them?• Is the board aware of the advice received from our risk advisers on relevant legal

and regulatory issues, insurance trends and industry best practice?Board understanding of loss scenarios• Does our board understand the short and long-term financial consequences to the

business of various loss scenarios?• Does our board understand how insurance and other financing arrangements

would respond to loss scenarios, and facilitate crisis management and ongoing business recovery?

• Has our current insurance responded to previous losses as expected, and what were the financial implications?

• What plans do we have if claims are challenged, or settlements are delayed?Board understanding of future developments• Does the board understand what risks our medium and long-term strategies may

create?• Have we considered how insuring certain risks could influence our strategic

decisions on business expansion and new product development?• Could insurance form part of our value proposition to customers?• Do we look beyond our own strategic plans to understand the emerging and

growing risks and threats that we face?

QUESTIONS FOR YOUR BOARD

IBC_Airmic guide_2015_Questions_V6.indd 1 07/10/2015 12:12

FAST FORWARD CHAPTER SEVEN

solutions being made available by insurers is helpful in this area. More broadly, companies can use the expertise of insurers and brokers to help them manage more ‘traditional’ risks effectively in the first place, so the risk of reputational damage is reduced.

Mind the gapResearch suggests there are three particular areas of emerging risk where companies face confusion over the definitions, solutions, exclusions and language of their current policies, namely environmental liability, terrorism and political violence risk, and cyber risk. For example, in a study by ACE in 2013, around half of UK middle-market businesses stated they were insured for environmental liability, but the real proportion is likely to be much lower because of confusion over what is covered by different policies.

The tables set out some typical covers, and gaps in cover that companies should look out for when considering insurance for these risks in the UK market. This is a high-level summary and different policies vary, so businesses should always check with their insurance partners.

24


Environmental liability

Terrorism and political violence

Cyber risk

Risk/ policy General liability Property Environmental liability

Sudden and accidental pollution ✔ LIMITED ✔

Gradual pollution ✗ ✗ ✔

Historical pollution ✗ ✗ ✔

Statutory clean-up ✗ ✗ ✔

On-site first-party clean-up ✗ ✗ ✔

Environmental Liability Directive ✗ ✗ ✔

Environmental damage ✗ ✗ ✔

Loss mitigation ✗ ✗ ✔

Incident response ✗ ✗ OPTIONS AVAILABLE

Crisis management and PR costs ✗ ✗ OPTIONS AVAILABLE

Risk/ policy Property Terrorism Integrated PDBI terrorism and political violence

Property damage and business interruption ✔ ✗ ✔

Terrorism (including sabotage) ✗ ✔ ✔

Social unrest (riots, strikes, malicious damage and civil commotion) ✔ ✗ ✔

Uprising (civil commotion, insurrection, rebellion, revolution) LIMITED ✗ ✔

War (including civil war) ✗ ✗ ✔

Risk/policy General liability Property Cyber

Loss of income for non-physical damage ✗ ✗ ✔

Incident response ✗ ✗ OPTIONS AVAILABLE

Extortion ✗ ✗ ✔

Data breach liability ✗ ✗ ✔

Unauthorised system use liability ✗ ✗ ✔

Digital media/social media liability ✗ ✗ ✔

Crisis management and PR costs ✗ ✗ OPTIONS AVAILABLE


• Do we know the key emerging risks to our business? Do we adequately build emerging risk into our board and management-level discussions? Do we have a risk register and emerging risk radar that we review regularly and in tandem?

• Do we take a siloed approach to emerging risk management? How can we best delegate responsibilities and embed the right culture of emerging risk awareness? What processes should we put in place for our key emerging risks?

• What specialist external emerging risk skills and expertise do we need, and how can we access them? Do we make emerging risk capability a criterion when we choose our insurance partners?

• Do we understand the way our different insurance policies will perform for our key emerging risks? What gaps might we have in our coverage and could specialist policies help?


Institute of Directors

116 Pall Mall, London SW1Y 5EDwww.iod.com

Critical Business Insurance In today’s dynamic business environment, insurance matters to companies and to the directors who run them. One of the key roles of board members is to understand the vital importance of business insurance as part of their overall responsibility for, and oversight of, their company’s management of risk.

Clearly, it is not possible for directors to know every detail of the insurance buying process. But the onus is on them to know enough to be able to ask pertinent questions around the boardroom table, and to challenge other executives and insurance professionals when necessary. This guide provides them with many of the insights they need to do so.

OFC Airmic guide_2015_Covers_V6.indd 1 07/10/2015 12:13