What’s Good for Big Oil is Good for the Banks
The New York Federal Reserve Bank president William Dudley is frustrated by the “…deep-seated cultural and ethical failures at many large financial institutions.”
The Financial Times reported July 27 that Fed officials have asked banks to see what they might learn from other sectors “that have gone through crises or reputational issues”…wait for it…”such as the oil industry.”
It is sound advice.
Both the oil and banking industries tend to attract “cowboys” for whom rules are only guidelines and risk is a stimulant. Both industries also have a history of socializing the consequences of risk– massive spills with black goo or financial implosions with black holes.
And some oil companies have emerged from crises learning how to better control their cowboys and manage society’s expectations to become exemplary managers of reputation.
ExxonMobil, commemorating this year the 25th anniversary of the largest oil spill in history (until BP’s disaster in 2010), could be the NY Fed’s poster child.
ExxonMobil’s risk management processes came of age after its oil tanker, the Valdez, ran aground on a reef, puncturing the ship’s hull and spilling oil into Prince William Sound, Alaska. The event garnered broad media attention and led to a long series of lawsuits and legislative changes—what is politely termed in reputation management circles as the pile on of litigators, legislators and bloggers.
A jury in Anchorage, Alaska, topped an award against Exxon of millions of dollars in damages with $5 billion in punitive-damages.
Today, ExxonMobil believes risk management is a direct responsibility of line management. Like other engineering firms, its risk management models were once only quantitative.
Empowered by the post-Valdez culture, line executives expressed concern that computer models were missing local nuances that might lead to negligent or criminal behavior, leaving the company exposed to moral hazards.
The company supplemented its quantitative models with strong, direct workforce and line management experience models involving no statistics on failure rates.
While reputation risk management would be nowhere without the right culture, governance, and operational controls, there’s more to it—stakeholder expectation management.
As Jonathan Salem Baskin described in Forbes, ExxonMobil tells stakeholders “that oil is here to stay, we need to accept how vitally useful it is, and improvements in its use are lots more realistic than any fantasies about alternative energy substitutes.”
In its 10K, the company tells shareholders that its success depends on management’s ability to minimize the “inherent risks” of the industry and “the potential for human error.” Moreover, ExxonMobil actually describes many of the management processes it uses to minimize risk.
According to an analysis published by Consensiv, the reputation controls company, based on reputation value metrics we use at Steel City Re, ExxonMobil’s reputation premium, a measure of additional value arising from favorable stakeholder expectations, is at the 96th percentile within its peer group.
ExxonMobil’s 113 percent 10-year return is more than double that of every other oil major excluding Chevron’s 173 percent.
The object lesson for financial institutions is self-evident.
Read all of Nir Kossovsky’s Risk Insider contributions.
Banks Face New Threat
Banks have been caught off guard by what experts say is the first major mobile banking security threat to hit the United States.
It is a modification of the mobile Trojan called Svpeng, which has been used to steal money from Russian mobile bank accounts, said Dmitry Bestuzhev, head of global research and analysis team, Latin America, at Kaspersky Lab, a Woburn, Mass.-based antivirus software company that discovered the malware.
The malware, which emanates from Russia, has been termed “ransomware,” because the hackers demand a payment in exchange for not destroying the victim’s reputation, claiming there is child pornography and other prohibited content on the cell phone.
“Nobody wants to be a victim of such image reputation damage.” — Dmitry Bestuzhev, head of global research and analysis team, Latin America, at Kaspersky Lab.
“It takes a picture of the victim and then says it will send it with the child pornography findings to all of the victim’s contacts,” Bestuzhev said. “Nobody wants to be a victim of such image reputation damage.”
Cyber criminals are already taking steps to steal online banking credentials from mobile devices, Bestuzhev said.
Previous versions of Svpeng were used to steal money from several banks in Russia, by displaying a fake log-in window in front of the real one, which asked users to input their credentials.
This new malware is deeply integrated and is almost impossible to remove from an infected device, he added. His company found Svpeng through “proactive Internet exploring.”
Better software is needed to protect against malware, said Chris Keegan, a managing director at Beecher Carlson, in New York.
For now, banks rely on warning their customers against social engineering attempts by fraudsters, and usually that means, “Don’t press the button or answer the email.” Banks must warn their customers not to download any applications not found on the iPhone store, Google Play or other verified websites, he said.
Banks Ran Out of Time
Avivah Litan, a Gartner Inc. vice president and analyst in Potomac, Md., said the malware should serve as a wake-up call for many banks, as a fair number of them have not developed security measures for mobile banking that are as robust as those used in online banking.
Ensuring that customers use secured browsers doesn’t apply when they use mobile apps.
Giants like Chase Bank and U.S. Bank and others are developing tougher measures specific to mobile, but the industry has a whole need to step it up, Litan said.
“Everybody knew it was coming, but they thought they would have had more time.” – Avivah Litan, vice president, Gartner Inc.
“They’ve just been slow to put measures in place specific to mobile because there hasn’t been any mobile malware,” she said. “Everybody knew it was coming, but they thought they would have had more time. But now it’s here and they have to think about it now.”
Matt Krogstad, head of mobile banking at Bank of the West in San Francisco, said the bank’s fraud prevention department works with his department to combat mobile malware and other types of mobile banking fraud.
“It’s an ongoing process since the mobile security space is constantly evolving,” Krogstad said.
Bank of the West also tries to protect customers against unofficial third-party services that try to access apps or put themselves between the customer and the apps, after customers download them, he said.
Bank of the West also diligently educates customers about the latest threats, Krogstad said.In cases like Heartbleed, communications to customers were to reassure them that the bank had done its due diligence to ensurethat their accounts were safe.
“With other malware like this randomware, it’s more about reinforcing certain behaviors, such as not downloading apps from unofficial app stores or not clicking on links from people you don’t know,” he said. “Don’t jailbreak your phone or put your banking passwords in your contacts.”
Keeping up with all types of cyber crime continues to challenge the industry. Indeed, computer crime and malicious codes ranks as No. 5 as a top risk for banks, according to Aon’s 2014 U.S. Industry Report: Financial Institutions.
However, there is a disconnect at most banks that hampers risk mitigation, said Michael O’Connell, managing director, financial institutions practice at Aon Risk Solutions.
The disconnect occurs because one group traditionally is responsible for purchasing insurance, while another group is responsible for assessing exposures, including technology that may pose an operational enterprise risk, said O’Connell.
“We strongly recommend linking the two groups together, to assess ‘what-if scenarios’ and develop mitigation strategies that include insurance,” he said.
Kevin Kalinich, Aon’s global practice leader for cyber/network risk, said that recent court decisions have ruled that if fraudsters are able to steal customer identities or money, it is the bank’s obligation to help their customers, even if the fraud is out of the bank’s control.
“So if a customer gets fooled on their mobile devices, then the bank has the responsibility to monitor usage of their bank accounts,” Kalinich said.
A Modern Claims Philosophy: Proactive and Integrated
According to some experts, “The best claim is the one that never happens.”
But is that even remotely realistic?
Experienced risk professionals know that in the real world, claims and losses are inevitable. After all, it’s called Risk Management, not Risk Avoidance.
And while no one likes losses, there are rich lessons to be gleaned from the claims management process. Through careful tracking and analysis of losses, risk professionals spot gaps in their risk control programs and identify new or emerging risks.
Aspen Insurance embraces this philosophy by viewing the data and expertise of their claims operation as a valuable asset. Unlike more traditional carriers, Aspen Insurance integrates their claims professionals into all of their client work – from the initial risk assessment and underwriting process through ongoing risk management consulting and loss control.
This proactive and integrated approach results in meaningful reductions to the frequency and severity of client losses. But when the inevitable does happen, Aspen Insurance claims professionals utilize their established understanding of client risks and operations to produce some truly amazing solutions.
“I worked at several of the most well known and respected insurance companies in my many years as a claims executive. But few of them utilize an approach that is as innovative as Aspen Insurance,” said Stephen Perrella, senior vice president, casualty claims, at Aspen Insurance.
“We do a lot of trending and data analysis to provide as much information as possible to our clients. Our analytics can help clients improve upon their own risk management procedures.”
– Stephen Perrella, Senior Vice President, Casualty Claims, Aspen Insurance
Utilizing claims expertise to improve underwriting
Acting as adviser and advocate, Aspen integrates the entire process under a coverage coordinator who ensures that the underwriters, claims and insureds agree on consistent, clear definitions and protocols. With claims professionals involved in the initial account review and the development of form language, Aspen’s underwriters have a full sense of risks so they can provide more specific and meaningful coverage, and identify risks and exclusions that the underwriter might not consider during a routine underwriting process.
“Most insurers don’t ever want to talk about claims and underwriting in the same sentence,” said Perrella. “That archaic view can potentially hurt the insurance company as well as their business partners.”
Aspen Insurance considered a company working on a large bridge refurbishment project on the West Coast as a potential insured, posing the array of generally anticipated construction-related risks. During underwriting, its claims managers discovered there was a large oil storage facility underneath the bridge. If a worker didn’t properly tether his or her tools, or a piece of steel fell onto a tank and fractured it, the consequences would be severe. Shutting down a widely used waterway channel for an oil cleanup would be devastating. The business interruption claims alone would be astronomical.
“We narrowed the opportunity for possible claims that the underwriter was unaware existed at the outset,” said Perrella.
Risk management improved
Claims professionals help Aspen Insurance’s clients with their risk management programs. When data analysis reveals high numbers of claims in a particular area, Aspen readily shares that information with the client. The Aspen team then works with the client to determine if there are better ways to handle certain processes.
“We do a lot of trending and data analysis to provide as much information as possible to our clients,” said Perrella. “Our analytics can help clients improve upon their own risk management procedures.”
For a large restaurant-and-entertainment group with locations in New York and Las Vegas, Aspen’s consultative approach has been critical. After meeting with risk managers and using analytics to study trends in the client’s portfolio, Aspen learned that the sheer size and volume of customers at each location led to disparate profiles of patron injuries.
Specifically, the organization had a high number of glass-related incidents across its multiple venues. So Aspen’s claims and underwriting professionals helped the organization implement new reporting protocols and risk-prevention strategies that led to a significant drop in glass-related claims over the following two years. Where one location would experience a disproportionate level of security assault or slip & fall claims, the possible genesis for those claims was discussed with the insured and corrective steps explored in response. Aspen’s proactive management of the account and working relationship with its principals led the organization to make changes that not only lowered the company’s exposures, but also kept patrons safer.
World-class claims management
Despite expert planning and careful prevention, losses and claims are inevitable. With Aspen’s claims department involved from the earliest stages of risk assessment, the department has developed world-class claims-processing capability.
“When a claim does arrive, everyone knows exactly how to operate,” said Perrella. “By understanding the perspectives of both the underwriters and the actuaries, our claims folks have grown to be better business people.
“We have dramatically reduced the potential for any problematic communication breakdown between our claims team, broker and the client,” said Perrella.
A fire ripped through an office building rendering it unusable by its seven tenants. An investigation revealed that an employee of the client intentionally set the fire. The client had not purchased business interruption insurance, and instead only had coverage for the physical damage to the building.
The Aspen claims team researched a way to assist the client in filing a third-party claim through secondary insurance that covered the business interruption portion of the loss. The attention, knowledge and creativity of the claims team saved the client from possible insurmountable losses.
Modernize your carrier relationship
Aspen Insurance’s claims philosophy is a great example of how this carrier’s innovative perspective is redefining the underwriter-client relationship. Learn more about how Aspen Insurance can benefit your risk management program at http://www.aspen.co/insurance/.
Stephen Perrella, Senior Vice President, Casualty, can be reached at Stephen.email@example.com.