Sharing Knowledge and Experience
While attending San Diego RIMS 2016, I met a lawyer who had been appointed risk manager for her company. I told her that involving myself with RIMS and professional risk management organizations was instrumental in my personal and professional development.
Risk managers who are new to the function or wish to develop their skills may see the same benefits I did.
I attended a chapter meeting and was hooked! I served on chapter committees. I applied to speak at RIMS national and Canadian conferences. I took advantage of RIMS’ new officer training.
I then served on RIMS national education and conference committees. This gave me a broad view of the spectrum of issues important to risk managers as well as some effective ways to respond.
I was invited to serve on RIMS executive council as treasurer (two terms), VP conference, first VP audit and investments, president and past president.
During this time, I received invaluable executive training on many topics that help me in my professional career, including media, nonprofit board operations, budgeting, public speaking, dispute resolution, and so much more.
I learned from the best – my risk management colleagues and expert RIMS staff.
I also had the pleasure of serving on the Spencer Education Foundation Board and the International Federation of Risk and Insurance Management Associations (IFRMA). Representing RIMS worldwide, I traveled to Britain, France, Tasmania, and Japan, and attended chapter meetings and conferences throughout Canada and the U.S.
Getting Company Support
Getting the support of my company was very important. I took great care to ensure the senior executives understood and supported my involvement. I completed a trip report for every meeting … detailing location, attendees and agenda. I sent it to my director, CFO and board chair. These reports helped demonstrate the value of participation and the lessons I learned.
I used vacation and overtime to offset time out of office.
I copied every magazine article that named my employer, highlighting the publication and reference, and sent it to my CFO, board chair and mayor of Kitchener, Ontario. I facilitated greetings between the mayor and officials in Japan, which helped substantiate the benefit of RIMS membership and participation.
My involvement with RIMS enabled me to meet many influential people including Gen. Colin Powell, Sen. Robert Kennedy Jr., Lord Peter Levene, former chairman of Lloyd’s, U.S. Rep. Newt Gingrich, and U.K. Prime Minister John Major … to name a few.
Some other highlights included:
- Socializing with some of the most senior insurance industry executives during a private, no-agenda breakfast at the Saint Regis Hotel in New York;
- Meeting New York Insurance Commissioner Greg Serio during the contingency fee controversy;
- Joined other risk managers for “RIMS on the Hill” in Washington to meet with U.S. senators and representatives;
- Dined with representatives of the (then) newly formed Department of Homeland Security; and
- Was the first woman and first risk manager to ever be invited to speak on a panel with Lord Levene.
These experiences gave me more insights and connections than I ever imagined. My advice for those entering risk management is to get involved with professional organizations. Get to know your risk management colleagues. Volunteer on a committee, or moderate or speak at a conference. Share experiences and put the best of them to use in your own organizations.
Manage Expectations, Manage Reputation
The art of managing reputation risk really comes down to shaping the expectations of shareholders, customers, vendors, creditors and investors.
“Not an easy thing to do,” said Nir Kossovsky, chief executive officer, Steel City Re, speaking at the annual RIMS conference in San Diego on April 12.
“Managing expectations involves behavioral economics – shaping what people expect from you and then meeting those expectations.”
He said expectations typically revolve around six key areas: safety, ethics, quality, security, sustainability and innovation. Failing to meet any of those expectations creates vulnerability for a company, opening up an opportunity for shareholders or special interest activists to come after the board of directors as the culpable party.
Increasingly, directors and officers are the true casualties of reputation damage.
Dissatisfied customers or partners know that “the court of public opinion is much more effective than the court of law,” Kossovsky said, so they will bring allegations against the board and force a public response.
“Managing expectations involves behavioral economics – shaping what people expect from you and then meeting those expectations.” – Nir Kossovsky, chief executive officer, Steel City Re
The best way to mitigate reputation risk, then, is to proactively communicate the board’s awareness of a company’s exposures, and acknowledge its duties to deliver on expectations related to the six key areas.
“Communication is critical,” said Todd Marumoto, director of risk management, Mattel, Inc. “There needs to be some sense of a plan for how the board will respond to a reputation event.”
Without a quick response, the silence is filled by the white noise of unsubstantiated opinion, Kossovsky said. That weakens the board’s credibility.
“Facts are available without much of a down payment. Allegations brought against the board don’t necessarily have to be true and can’t always be validated.”
Conflicting expectations make reputation risk management even harder.
Customers expect, for example, near impossible standards of quality and customer service, while shareholders expect strong profit and growth, and creditors expect swift payment.
While many believe that marketing and press coverage can be the tool for the messaging needed to mold expectations through public perception, the most effective way to mitigate reputation risk is through enterprise risk management that strives for excellence, the speakers said.
In other words, expectations should be set by a company’s performance.
Kossovsky offered the example of BP, which claimed to be “beyond petroleum.”
Despite impressive initiatives to use cleaner energy, BP was still, in fact, heavily reliant on petroleum. The Deepwater Horizon spill of 2010 sparked so much anger because people expected BP to be above such environmentally dangerous accidents.
ExxonMobil, on the other hand, acknowledged to its shareholders that a spill was always a real threat, but demonstrated the steps it was taking to minimize the risk. Shareholders thus had more realistic expectations of the company and are harder to disappoint.
Presenting to the C-Suite
Risk managers can bring the importance of reputation risk to the C-suites’ attention by demonstrating its financial impact.
“Expenses could come from having to replace a vendor, from a government penalty, litigation and class action lawsuits, or having to implement a new management process,” Marumoto said.
Overall, costs associated with remediating a reputational event can be two to seven times higher than costs related to the operational failure that caused the reputation damage in the first place.
“With reputation risk, it’s not always about right or wrong, but about getting the right outcome to satisfy shareholders and customers.” — Todd Marumoto, director of risk management, Mattel, Inc.
“It affects every line item of the P&L,” Kossovsky said.
The impact on D&O effectiveness will also certainly grab senior management’s attention.
“A typical board member makes about $250,000 per year to sit on the board for a term usually of about three years, and he’s usually sitting on three different boards,” Kossovsky said.
“He’s looking at a personal loss of over $2 million” if a reputational hit leads to him being asked to step down from those boards.
According to Marumoto, risk managers can influence outcomes of a reputational event by working internally with investor relations and marketing to ensure the company is sending a consistent message, and to develop a coordinated response plan.
“Ultimately, you have to be responsible for all things that pass in front of you,” he said. “Partner with vendors you trust, be transparent in your efforts to mitigate risks, and develop relationships with government agencies.
“With reputation risk, it’s not always about right or wrong, but about getting the right outcome to satisfy shareholders and customers.”
Cyber: The Overlooked Environmental Threat
“Cyber breach” conjures fears of lost or ransomed data, denial of service, leaked corporate secrets and phishing scams.
But in a world where so many physical operations are automated and controlled by digital technologies, the consequences of cyber attacks extend far beyond the digital realm to include property damage, bodily injury, and even environmental pollution.
Industrial companies that deal with hazardous materials — like power plants, refineries, factories, water treatment facilities or pipelines — are heavily dependent on automated technology to maximize their efficiency. Other sectors use technology to control HVAC systems, power and utilities, placing their properties at risk as well.
Cyber risks like theft of personally identifiable data have been highly publicized in recent years, but physical risks like pollution sparked by a cyber breach may not be as obvious.
“It’s significant to lose 100,000 customers’ Social Security numbers,” said William Bell, Senior Vice President, Environmental, Liberty International Underwriters, “but can you imagine if a waste treatment facility’s operations get hacked, gates open, and thousands of tons of raw sewage go flowing down a local river?”
In many industrial complexes, a network of sensors gathers and monitors data around machinery efficiency and the flow of the materials being processed. They send that information to computer terminals that interpret the data into commands for the hardware elements like motors, pumps and valves.
This automation technology can control, for example, the flow of pipelines, the level of water or waste held in a reservoir, or the gates that hold in and control the release of vast quantities of sewage and other process materials. Hackers who want to cause catastrophe could hijack that system and unleash damaging pollutants.
And it’s already happened.
In 2000, a hacker caused 800,000 liters of untreated sewage to flood the waterways of Maroochy Shire, Australia. In 2009, an IT contractor, disgruntled because he was not hired full-time, disabled leak detection alarm systems on three off-shore oil rigs near Long Beach, Calif.
Just last year, cyber attackers infiltrated the network of a German steel mill through a phishing scam, eventually hacking into the production control system and manipulating a blast furnace so it could not be shut down. The incident led to significant property damage.
According to a leading industrial security expert and executive director of the International Society of Automation, “Today’s operational technologies—such as sensors, SCADA systems, software and other controls that drive modern industrial processes—are vulnerable to cyber attack. The risk of serious damage or compromise to power and chemical plants, oil and gas facilities, chemical and water installations and other vital critical infrastructure assets is real.”
“The hacks could come from anywhere: a teenager looking for entertainment, a disgruntled worker, or more sophisticated criminals or terrorists,” Bell said. “There are certainly groups out there with political and ideological motivations to wreak that kind of havoc.”
“We are working to bring the cyber component of environmental risk to the forefront. Cyber security is not just an IT issue. Industry executives need to be aware of the real-world risks and danger associated with an industrial cyber attack as well as the critical differences between cyber security and operational technology security.”
— William Bell, Senior Vice President, Environmental, Liberty International Underwriters
The cleanup cost of an environmental disaster can climb into the hundreds of millions, and even if a cyber breach triggered the event, a cyber policy alone will not cover the physical and environmental damage it caused.
The risk is even more pointed now, as resource conservation becomes increasingly important. Weather related catastrophe modeling is changing as both flooding and drought become more severe and frequent in different regions of the U.S. Pollution of major waterways and watersheds could have severe consequences if it affects drinking water sources, agriculture and other industrial applications that depend on this resource.
Managing the Risk
Unfortunately, major industrial corporations sometimes address their environmental exposure with some hubris. They trust in their engineers to remove the risk by designing airtight systems, to make a disaster next to impossible. The prospect of buying environmental insurance, then, would be superfluous, an expression of doubt in their science-backed systems.
Despite the strongest risk management efforts, though, no disaster is 100 percent avoidable.
“We are working to bring the cyber component of environmental risk to the forefront,” Bell said. “Cyber security is not just an IT issue. Industry executives need to be aware of the real-world risks and danger associated with an industrial cyber attack as well as the critical differences between cyber security and operational technology security.”
The focus on network security and data protection has distracted industry leaders from strengthening operational technology security. Energy, manufacturing and other industrial sectors lack best practice standards when it comes to securing their automated processes.
After the Homeland Security Act of 2002, the Department of Homeland Security began comprehensive assessments of critical infrastructure’s cyber vulnerability, working with owners and operators to develop solutions. It also offers informational guides for private companies to do the same. The National Institute of Standards and Technology also continues work on its cyber security framework for critical infrastructure. Although this helps to establish some best practices, it does not completely mitigate the risk.
Many businesses don’t see themselves as a target, but they need to look beyond their own operations and property lines. They could be an attractive target due to their proximity to densely populated areas or resources such as waterways and highways, or nationally or historically significant areas. The goal of a cyber terrorist is not always to harm the target itself, but the collateral damage.
The Role of Insurance
“Environmental liability is still by and large viewed as a discretionary purchase,” Bell said, “but the threat of a cyber attack that can manipulate those systems and ultimately lead to a pollution incident is added incentive to buy environmental coverage.”
Liberty International Underwriters’ environmental coverage could respond to many pollution conditions set off by a cyber breach event.
“Property damage, bodily injury and cleanup of any pollution at or emanating from a covered property would likely be taken care of,” Bell said. “The risk is not so much the cyber exposure but the consequence of the attack. The resulting claims and degradation to the environment could be severe, especially if the insured was a target chosen because of their unique position to have a large effect on the local population and environment.”
LIU also offers dedicated Cyber Liability insurance solutions designed to manage and mitigate the cost of responding to a cyber attack and any resultant loss of data and associated liability. Coverage includes proactive data breach response services designed to help organizations comply with regulatory requirements and prevent data breaches.
LIU’s loss control managers are also on hand to conduct assessments of insureds’ properties and facilities to examine potential environmental impacts. They can educate brokers on the importance of enhancing cyber security to prevent an environmental accident in the first place.
“People are relying more and more on their systems, automaton is increasing, and the risk is growing,” Bell said. “We’re all focused on protecting data, but the consequences of a cyber breach can be much farther reaching than data alone.”
To learn more about Liberty International Underwriters’ environmental coverages and services, visit www.LIU-USA.com.
Liberty International Underwriters is the marketing name for the broker-distributed specialty lines business operations of Liberty Mutual Insurance. Certain coverage may be provided by a surplus lines insurer. Surplus lines insurers do not generally participate in state guaranty funds and insureds are therefore not protected by such funds. This literature is a summary only and does not include all terms, conditions, or exclusions of the coverage described. Please refer to the actual policy issued for complete details of coverage and exclusions.
This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Liberty International Underwriters. The editorial staff of Risk & Insurance had no role in its preparation.