INTERRUPTION LOSSES RELATED TO STANDALONE CYBER POLICIES

Transcription

1 A GUIDE TO CALCULATING BUSINESS INTERRUPTION LOSSES RELATED TO STANDALONE CYBER POLICIES By Peter Hagen, Co-Founding Partner and CEO of HSNO

2 It is now possible to purchase standalone cyber coverage that either combines first-party business interruption insurance coverage with data breach liability or includes only first-party business interruption. Business interruption (BI) coverage is now being offered in a high percentage of standalone Cyber insurance policies (Cyber Policies). One of the significant developments in cyber insurance in recent years has been the addition of more meaningful business interruption insurance for cyber-related events. It is now possible to purchase standalone cyber coverage that either combines first-party business interruption insurance coverage with data breach liability or includes only first-party business interruption. It can cover partial or complete business interruption following a cyber-attack or technical failure. This paper addresses computing the amount of Business Interruption (BI) value to insure and the most common and material BI measurement issues. Businesses must decide how much of their resources they direct towards strengthening their Cyber Security versus resources towards insuring against a breach. Many of the measurement issues with Property Policies will be common with Cyber Policies; some will be unique to Cyber. 2

3 History of Insurance Lloyd s of London, the birthplace of insurance, had its start in a coffee shop. Although the first informal gatherings of shippers and investors around 1688 were not intended to produce an insurance mechanism, Edward Lloyd s coffeehouse on London s Tower Street witnessed the first days of what was to become the world s best known insurance underwriting society. Financial protection contracts initially emanating from Lloyd s coffeehouse were dedicated to ships and their cargo. Before a merchant or other financially interested party would entrust his goods to a sea captain, he wanted to assure them there would be some financial guarantee if the cargo ended up at the bottom of the ocean. Investors visiting the coffee shop would contractually agree to indemnify the owner, in exchange for a premium, if the goods did not make it to their destination due to the ravages of the sea. If nothing happened to the ship, the investor/guarantor kept the premium. When ships and cargos were lost, the investor had to make good on his promise and pay the assured. No single investor was willing to insure the total value of a ship and its cargo. A detailed description of the ship, its captain, the cargo, its route and destination was prepared and circulated among the participating investors. Each investor indicated how much of the total value of the risk they were willing to insure by writing his name and the percentage under the description thus the creation of underwriters From

4 EPL 1850S S B&M CYBER Fast Forward - New Insurance Markets The insurance market has developed immensely since the days of Lloyd s coffeehouse in London, diversifying far beyond traditional property policies. What do Boiler & Machinery (B&M), Employment Practices Liability (EPL) and Cyber coverage have in common? The three insurance lines were new categories of insurance that traditional property policies did not fully address. B&M: Up until the 1850s in the United States, a great deal of manufacturing was carried on by small plants located in rural areas. Water from streams and rivers was the source of power for equipment. However, water power had reached the limits of its industrial capacity. Manufacturers turned to steam boilers and engines. The Industrial Revolution was underway. The advent of steam power created a new industrial hazard disastrous boiler explosions. These tragedies occurred with increasing frequency and resulted in loss of life and property. Though the potential of steam power seemed infinite, controlling the power and safely harnessing it was crudely developed. And, as applications for steam power became more complex, the dangers became more acute. Hence, Hartford Steam Boiler (HSB) was born. 4

5 EPL: In the early 1990s Employment Practices Liability CYBER: While Cyber was incorporated into some General Insurance (EPL) covered companies against claims or Liability (GL) policies in the 1980s, the first cyber standalone lawsuits filed by employees, former employees and policy is believed to have been written in 1997 through employment candidates regarding their relationship with an AIG. Though groundbreaking, as it was the first to address employee. This type of coverage protects the company, its cyber security, it was a third-party liability policy only and directors and officers, and current and former employees. A was basically a hacker policy. Today, standalone Cyber company can use this type of insurance to cover expenses Policy premiums are anticipated to grow to $10.0 billion by involved in defending against claims or lawsuits related 2020 and are currently at $2.4 billion in premiums. To put to employment (regardless of the outcome). The market this in perspective, the property colossus FM Global realized for EPL insurance coverage began to expand with large premiums last year totaling $5.5 billion (per annual report). companies in 1991 and grew rapidly as employmentrelated lawsuits exploded in the wake of the passage of two important pieces of legislation: the Americans with Disabilities Act of 1990 and the Civil Rights Act of

6 Business Interruption - Noun 1. - insurance that provides protection for the loss of profits and continuing fixed expenses resulting from a break in commercial activities due to the occurrence of a peril promise of reimbursement in the case of loss; paid to people or companies so concerned about hazards that they have made prepayments to an insurance company. source: vocabulary.com BI Values to Insure Business Interruption in this paper is considered to equal the loss of net income plus continuing costs not earned. There is a common saying in cyber security: It s not if you ll be a victim of a data breach, but when. The experts espouse 100% security is not possible. So, how much of the risk should one transfer to insurance? The cyber coverages available in the marketplace related to cyber risks are far from standard. There is a vast array of cyber products, each with its own terms and conditions, which may vary quite dramatically from insurer to insurer, even from policy to policy underwritten by the same insurer. The experts espouse 100% security is not possible. So, how much of the risk should one transfer to insurance? 6

7 Three Steps to Completing a BI Analysis Step 1: Determine annual, monthly and daily BI exposure. The first step, for most companies, is taking the budgeted revenues for the next twelve months and deducting saved (avoided) costs. These costs, discussed in more detail in a later section, are expenses that will be avoided with the reduction of sales and/or operating at a level below normal. This will represent exposure for one year. However, as simple as it may sound, what should not be done is dividing by 12 to compute a monthly exposure or dividing by 365 to compute a daily exposure. Currently, the vast majority of Cyber policies are not written for a full year. Some may be written in terms of days, some in terms of hours. For example, terms can range from 120 hours to 30, 90, or 120 days, with waiting periods. Avoided costs per day will vary greatly as a result of a 5 day outage (120 hours) as compared to a 120 day outage. As a general rule, saved (avoided) costs per day will vary contingent upon both the length of the period down and whether it is a total outage or a partial outage. Lowest saved costs per day to highest saved costs per day, by scenario, are as follows: Scenarios: 1. Partial Outage for a short duration (lowest saved per day). 2. Partial Outage for a long duration. 3. Total Outage for a short duration. 4. Total Outage for a long duration (highest saved per day). In determining BI values, a business needs to evaluate the impact that both labor and seasonality have on the operations. Labor: Labor costs are the most prevalent variable driver of the saved costs. Depending on the severity of the partial outage, #2 and #3 could flip. Businesses are not likely to lay off employees in scenario #1, but it is more probable they will lay off employees in scenario #4. Each business should run all four scenarios in determining a daily value. Seasonality: While not all businesses are intensely seasonal, nearly all businesses have a seasonality component. For example, Neiman Marcus (who was breached) will have a daily BI value that is 40%-75% higher in December than it is in January. 7

8 Step 2: How many days will a breach impact business and will there be lingering effects? Based on my analysis of 10Q s, Home Depot had very little impact to revenues from their breach, while Target experienced significant lasting effects, most likely from a loss of trust from customers. An insurance broker or underwriter will be able to tell you if extended period of indemnity (EPOI) is available. EPOI covers business losses after the period of restoration (system repairs have been made, data has been recovered). Once you have completed step 1, multiply the four scenarios by the days a negative impact is expected to continue. This results in a range of BI insurance that is needed. Step 3: Cost of coverage vs. probability of risk. This is the expertise of actuaries ; however there is limited data for actuaries (carriers) to have full confidence that risks are priced properly. Compare the limits, cost and probability of a BI loss in your property policy with the limits, cost and probability of a BI loss in a standalone Cyber policy as a sanity check. The broker/underwriter will need to help you with how they are rating the BI exposure, as this is just one piece of the exposure along with third party exposure, etc. in a Cyber standalone Policy. Alternative Step: If steps #1- #3 seem overwhelming, take solace; many of the Cyber insurance carriers provide this service at either no cost or a nominal cost given a policy is purchased. BI Measurement Issues When conducting BI seminars it is common for me to discuss the top 10 BI issues. This white paper condenses the top three. Based on a sampling of over 2,500 business interruption losses, the top three measurement issues between claimed and calculated BI issues in order of frequency are: 1. Sales Projections 2. Period of Indemnity 3. Saved Costs-Ordinary Payroll The initial overall measurement differences as a percentage of the claim were as follows: Difference Files <10% 52% 10%-50% 40% >50% 8% Sales Projections The first step for a forensic accountant in a BI computation is to determine the But For sales. In other words, But For the event, the sales would have been X amount. The policy wording is similar in many Cyber policies when compared to Property Policies, but not 8

9 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ $$$$$$$$$$$$$$$$$$ $$$$$$$$ $$$$ identical. The common wording in Cyber Policies includes due consideration shall be given to the prior experience of the business and the Insured s business before the beginning of the Security Failure and to the probable business an Insured could have performed had no Security Failure occurred. The policy goes on to state the insured shall not profit from favorable business conditions caused by the event (paraphrased). An example of favorable business conditions after the loss: American Airlines and Delta. They both run at 84% load factors (passengers divided by seats) before the loss, which is the proxy by which they each measure themselves. A hacker targets the airlines. Delta has a security breach and flights are offline for 6 days. American has a breach and they are offline for 4 hours. American Airlines load factor goes from 84% to 93% and their rate per PAX jumps 22%; favorable business conditions for them. Delta accountants should not claim a 93% load factor and the jump in PAX rate. The increase in load factor at American is a result of the extended period of the Delta breach. This may seem obvious to many, even without the specified wording, but not to all. With sales projections related to Cyber, forensic accountants will likely be looking at the entire company as opposed to just one particular location or region, which is usually the case with a fire or hurricane. It should be noted the online lost sales will likely have a different margin than the brick and mortar (stores) sales. Sales and margins need to be analyzed individually by business group. $ 210 MILLION HOME DEPOT Additionally, with a Cyber sales projection across the entire business of the following breached companies, a 1.0% difference in projecting revenue trending would result in the above difference in revenue projections for a threemonth period: While it is akin to finding a needle in a haystack, it can be done, especially considering the vast amount of revenue data that is tracked by a large retailer. A 1.0% difference in revenue trending between two accountants during a partial outage will likely result in a claim difference of greater than 10%. $ 181 MILLION TARGET $ 45 MILLION EBAY NEIMAN MARCUS Historically, the majority of property BI losses will be a total shutdown or a significant outage at one location. Based on the sampling of 2,500 BI files, the following reflects the $ 13 MILLION 9

10 percentage of files with non-material and material revenue projection differences: Files with <10% difference in sales projection equaled 71% of the total population Files with 10%-25% difference equalled 15% of the total population Files with > 25% difference equaled 14% of the total population It is not uncommon for accountants to differ when calculating projected normal sales. In most cases the differences are manageable and a compromise is reached. Outside of litigation, what is the protocol to take if the projections are vastly different? For the files with a major difference of >25% in Projected Normal Sales (assuming the same period of restoration, POR), it appears the main drivers of the projection differences are a result of the following: 1. With certain files it was a new business, a vastly changing market or a new product. Protocol: Wait 3-5 additional months after the period of restoration to determine the rate the market/sales were growing or declining. 10

11 2. An accountant takes an unreasonable position or made a mistake. The unreasonable and unsupportable position was either due to a lack of competence from the accountant or the client demanded the accountant to take the position. Protocol: Continue to gather enough facts to support the more correct projection. Have another set of independent CPA eyes look at it from both sides. The forensic accountant society which specializes in BI calculations is a relatively small community. Before hiring an accountant, ask brokers and carriers about the reputation of the accountant. Period of Indemnity The focal point of determining the period of indemnity (POI) is usually the claims adjuster and construction expert in a property policy. With a Cyber loss it is the claims adjuster, the insured and the Cyber technical experts determining the POI. The accountants may have an ancillary role but are not the lead actors. The period of indemnity denotes the time period for which indemnity or compensation is payable under a business interruption policy. The period of indemnity is typically one of the most critical components of quantifying the business interruption loss. The Cyber policies differ in their wording defining the POI. The insured s technical expert may differ in opinion with the carrier s technical expert regarding the POI. For example, if one believes 30 days were materially interrupted and the other believes 60 days were materially interrupted, the 11

12 accountants measures could be identical per day but off by 50% in quantum. In first party BI losses it is not uncommon to measure the period of indemnity based on a theoretical period of restoration. This is necessary when an insured decides to make improvements and betterments or not rebuild. Cyber losses realize a similar scenario. Frequently the insured will choose to enhance their security network after a breach. The beefing up of the network may take additional time which is not recoverable under the BI time period. There is potentially a difference in opinion as to how long it would ve taken to go back as was. The technical experts will debate and the CPAs will let their clients know what each additional day is worth in BI dollars. Large property losses will retain building and engineering consultants. Cyber losses will retain technical experts to determine the appropriate period of restoration and the number of occurrences. Similar to property losses, it could be a material measurement issue. Saved Costs - Ordinary Payroll Saved (avoided) costs are required to be computed to determine the lost net income. Frequently the most significant decision made by a business owner is whether they continue to pay nonproductive employees during the outage period or have a layoff. The Cyber BI coverage may or may not cover the cost of these employees. In traditional coverage, ordinary payroll is identified as non-essential payroll. This has largely been adopted by the insurance market to mean hourly payroll. There is often debate over who is ordinary payroll. Most nurses at hospitals are paid hourly. Are they non-essential? A BI worksheet is typically filled out and completed by an insured when applying for insurance. The BI worksheet is an identifier of whom the insured considers as Ordinary Payroll. With that said, the BI worksheet is not a road map for calculating the loss. Payroll is not the only debatable saved expense; there are others. Depreciation is a significant topic on its own. Think of a turbine in a cogen plant. The basic question is whether the equipment and machinery is depreciated by time or usage. If depreciated by usage, many would suggest there is a saved cost component. If depreciated by time, likely not. Another potential issue is duplication of continuing operating costs in other sections of the claim (repair costs or third-party claim) and not deducting as a saved cost in the BI. This would lead to a duplicated claim. 12

13 Conclusion Completing a BI analysis related to a Cyber loss is a combination of science and art. Identify the period of indemnity, compute lost sales and deduct saved costs. As simple as it may sound, each BI file will likely have a unique twist that the previous one did not. As mentioned previously, seeking referrals and locating a reputable accountant is key. Good accountants will make the mechanics of the computation appear simple by: Understanding the insured s business, how it makes money and the business cycles. They will also know what records to ask for without making a burdensome request. Three Points to Remember: 1. The technical experts, the insured and the claim personnel need to identify the period of indemnity covered by the policy. 2. The CPAs determine lost sales within the period of indemnity. When dealing with the same deck (financials) there should not be a 25% difference in projections, with the exception of a new company and/or a new product. Getting a handle on potential exposure early in the process and managing expectations of both the carrier (reserves) and the insured (expected reimbursement). Cyber coverage represents a new insurance market. Much like Boiler & Machinery and Employee Practices Liability insurance the Cyber Policy is here to stay. BI is not a new concept, but BI coverage within a standalone Cyber policy is. 3. Calculating saved (avoided) costs is a mechanical exercise combined with common sense. Peter Hagen, CEO, CPA, CFF is with HSNO in Dallas. HSNO specializes in measuring BI losses, litigation support and other financial damages throughout their 16 offices across the U.S., London and Mexico City. If your company would like a complimentary BI seminar presented by HSNO please contact phagen@hsno.com or go to to identify a partner near you. 13