Risk Insider: Peter Taffae

Excess Follow Form? The Problem

By: | August 23, 2016 • 3 min read
Peter R. Taffae, is managing director of ExecutivePerils, a national wholesale broker. He can be reached at [email protected]

Imagine a $100 million D&O (or E&O, EPL, Cyber) program made up of 10 insurance companies each providing a $10 million limit. The market standard dictates that each insurer use its own “excess follow form.”

Shortly after the CEO is briefed that his company has secured $100 million “state of the art” D&O program, a securities class action is filed, followed by parallel derivative litigation. The litigation progresses and ultimately the Insured resolves the litigation costing $70 million (defense and settlement).

During the litigation process, the insurance companies on the program reserved their rights each referencing provisions of their excess policies. Now that the insured seeks to collect on the insurance, one by one each Insurer sites a provision that is different than the primary and underlying Insurers. It may be the definition of Insureds, or different Reporting Provisions, or even differences in the Insuring Clauses.

Reality sets in and the CEO finds out that the “state of the art” $100 million D&O program Is not state of the art and has inherited numerous obstacles.

This scenario is not imagined. Despite the name, “excess follow form” policies do not completely follow the primary policy’s wording. Although the differences might seem small at the time of binding they can have significant consequences at the time of a claim.


Qualcomm, Inc. v. Certain underwriters at Lloyd’s London, 161 Cal. App. 4th 184, 73 Cal. Rptr. 3d 770 (ct.App, 4th Dist. 2008) is a clear example why it is necessary to have true follow form excess wording.

AIG wrote Qualcomm’s primary D&O policy with $20 million limit, followed by a Lloyd’s excess “follow form” policy. After incurring $28 million in defense and indemnity, Qualcomm sought insurance recovery for the loss.

Despite the name, “excess follow form” policies do not completely follow the primary policy’s wording. Although the differences might seem small at the time of binding they can have significant consequences at the time of a claim.

Qualcomm settled a coverage dispute with AIG for $16 million (AIG’s policy has a $20 million limit). Lloyd’s refused to pay anything towards the $28 million because Lloyd’s “excess follow form” policy included a provision stating: “underwriter shall be liable only after Insurer(s) under each Underlying Policies have paid or been held liable to pay the full amount of the Underlying Limit of Liability”. Qualcomm sued and the court held in favor of Lloyd’s.

This is a clear example how “excess follow form” policies are not. Or as some would say “Excess Policies Matter.”

Another example of an “excess follow form” myth, is the arbitration provision that is in each policy.

Most D&O (E&O, EPL, and Cyber) policies require coverage disputes to be resolved by arbitration. Remember our $100 million D&O program with 10 insurers? The primary policy requires AAA arbitration in the laws of New York, the first excess may require that resolution be in London under the Arbitration Act of 1996, the next layer require may require arbitration under the laws of Bermuda, and so on.

Not only do these inconsistencies require different venues for resolution, but it is also likely that each arbitration location could have different results, thus compounding an already serious problem.

Hopefully, we can all agree that “excess follow form” policies are not excess follow form policies. Insureds need to recognize that not all excess programs are the same and there is a need to place significant importance on all the contractual wordings, not simply the primary.

I’ve now presented you with the problem. In my next post I’ll discuss the solution.

Share this article:

Risk Insider: Phil Norton

The New World of Global D&O Insurance – Part 2

By: | August 22, 2016 • 3 min read
Phil Norton is President, Professional Liability for the retail brokerage division of Arthur J. Gallagher & Co., and is regarded as one of the world’s leading authorities in his field. He has been named a Risk and Insurance® Power Broker® seven times. He can be reached at [email protected]

Note: This is the second of a two-part Risk Insider look at D&O.

As indicated in my previous Risk Insider post on Aug. 16, it’s been 10 years since the advent of the first local foreign D&O policies. Since then, many carriers have fine-tuned their process for underwriting and issuing local policies in foreign countries.

So, how should companies determine what countries have significant risk for them, and what are the key factors that should be examined in assessing the local exposure to D&O risk – whether from claims or from regulatory or tax concerns?

Not surprisingly, many multinationals have no interest in acquiring foreign local D&O coverage in countries where they believe their D&O exposure is negligible. After all, no exposure should translate into no premium allocation from the carrier, and thus no taxes or other compliance issues.


Therefore, when determining which countries are candidates for a foreign local D&O policy, it is critical to at least consider the following:

  • Local exposures based on size, stock ownership, and brand.
  • Types of local operations or business activities and status of the local management.
  • Local regulations, including whether local non-admitted D&O coverage is permitted and recognized in country, and any potential taxes or penalties.
  • Potential indemnification constraints for each country of concern.
  • An assessment of local market conditions, purchasing patterns and claims activity.

Ultimately, each multinational client company [in the U.S., for example] should prioritize its international D&O risks from both a claims and compliance perspective. By assessing “regulatory risks,” such as compulsory requirements, admitted paper, indemnification constraints, tax, regulatory, local market viability, enforcement and local D&O claims history, we have built a “Regulatory Score” for each country.

Not surprisingly, many multinationals have no interest in acquiring foreign local D&O coverage in countries where they believe their D&O exposure is negligible.

Against that very substantial analysis, we have also created a simple “Business Trends” score for each country by measuring how often multinationals do business in these countries, and the extent of such business in each country in terms of the size (revenues or assets) and complexity of their operations.

By substituting your own data on country by country exposures, a customized heat map can be drawn that will help you prioritize the countries which require the most attention from a D&O insurance perspective. A sample graphic for some of the more popular countries follows:

Gallagher’s Global Reach: Owning your Network is a thing of th




Implementing International D&O coverage through the use of locally issued D&O policies is both important and challenging. Brexit does not help. Although “Freedom of Services” (FOS) policies were never very popular, it was helpful in some cases to place a single U.K. policy to obtain coverage for all European Union countries. And while innovative responses to Brexit have already emerged, we continue to favor local policies in each of your countries of interest.

Finally, we recognize that implementing a strong International D&O strategy puts a large administrative burden on the corporate risk manager and corporate offices in general. A large amount of information is required, which may include the collection of application materials from local operations.

However, the trade-offs are worth the trouble in high-risk countries. Sound advice, patience and persistence are critical to a successful process.

See Part I here.

Share this article:

Sponsored: Liberty International Underwriters

Cyber: The Overlooked Environmental Threat

Environmental businesses often don't see themselves as a target, but their operations are just as vulnerable to the threat of an industrial cyber attack.
By: | August 3, 2016 • 6 min read

“Cyber breach” conjures fears of lost or ransomed data, denial of service, leaked corporate secrets and phishing scams.

But in a world where so many physical operations are automated and controlled by digital technologies, the consequences of cyber attacks extend far beyond the digital realm to include property damage, bodily injury, and even environmental pollution.

Industrial companies that deal with hazardous materials — like power plants, refineries, factories, water treatment facilities or pipelines — are heavily dependent on automated technology to maximize their efficiency. Other sectors use technology to control HVAC systems, power and utilities, placing their properties at risk as well.

Cyber risks like theft of personally identifiable data have been highly publicized in recent years, but physical risks like pollution sparked by a cyber breach may not be as obvious.

“It’s significant to lose 100,000 customers’ Social Security numbers,” said William Bell, Senior Vice President, Environmental, Liberty International Underwriters, “but can you imagine if a waste treatment facility’s operations get hacked, gates open, and thousands of tons of raw sewage go flowing down a local river?”

In many industrial complexes, a network of sensors gathers and monitors data around machinery efficiency and the flow of the materials being processed. They send that information to computer terminals that interpret the data into commands for the hardware elements like motors, pumps and valves.

This automation technology can control, for example, the flow of pipelines, the level of water or waste held in a reservoir, or the gates that hold in and control the release of vast quantities of sewage and other process materials. Hackers who want to cause catastrophe could hijack that system and unleash damaging pollutants.

And it’s already happened.

In 2000, a hacker caused 800,000 liters of untreated sewage to flood the waterways of Maroochy Shire, Australia. In 2009, an IT contractor, disgruntled because he was not hired full-time, disabled leak detection alarm systems on three off-shore oil rigs near Long Beach, Calif.

Just last year, cyber attackers infiltrated the network of a German steel mill through a phishing scam, eventually hacking into the production control system and manipulating a blast furnace so it could not be shut down. The incident led to significant property damage.

According to a leading industrial security expert and executive director of the International Society of Automation, “Today’s operational technologies—such as sensors, SCADA systems, software and other controls that drive modern industrial processes—are vulnerable to cyber attack. The risk of serious damage or compromise to power and chemical plants, oil and gas facilities, chemical and water installations and other vital critical infrastructure assets is real.”

“The hacks could come from anywhere: a teenager looking for entertainment, a disgruntled worker, or more sophisticated criminals or terrorists,” Bell said. “There are certainly groups out there with political and ideological motivations to wreak that kind of havoc.”

LIU_SponsoredContent“We are working to bring the cyber component of environmental risk to the forefront. Cyber security is not just an IT issue. Industry executives need to be aware of the real-world risks and danger associated with an industrial cyber attack as well as the critical differences between cyber security and operational technology security.”

— William Bell, Senior Vice President, Environmental, Liberty International Underwriters

The cleanup cost of an environmental disaster can climb into the hundreds of millions, and even if a cyber breach triggered the event, a cyber policy alone will not cover the physical and environmental damage it caused.

The risk is even more pointed now, as resource conservation becomes increasingly important. Weather related catastrophe modeling is changing as both flooding and drought become more severe and frequent in different regions of the U.S. Pollution of major waterways and watersheds could have severe consequences if it affects drinking water sources, agriculture and other industrial applications that depend on this resource.

Managing the Risk

LIU_SponsoredContentUnfortunately, major industrial corporations sometimes address their environmental exposure with some hubris. They trust in their engineers to remove the risk by designing airtight systems, to make a disaster next to impossible. The prospect of buying environmental insurance, then, would be superfluous, an expression of doubt in their science-backed systems.

Despite the strongest risk management efforts, though, no disaster is 100 percent avoidable.

“We are working to bring the cyber component of environmental risk to the forefront,” Bell said. “Cyber security is not just an IT issue. Industry executives need to be aware of the real-world risks and danger associated with an industrial cyber attack as well as the critical differences between cyber security and operational technology security.”

The focus on network security and data protection has distracted industry leaders from strengthening operational technology security. Energy, manufacturing and other industrial sectors lack best practice standards when it comes to securing their automated processes.

After the Homeland Security Act of 2002, the Department of Homeland Security began comprehensive assessments of critical infrastructure’s cyber vulnerability, working with owners and operators to develop solutions. It also offers informational guides for private companies to do the same. The National Institute of Standards and Technology also continues work on its cyber security framework for critical infrastructure. Although this helps to establish some best practices, it does not completely mitigate the risk.

Many businesses don’t see themselves as a target, but they need to look beyond their own operations and property lines. They could be an attractive target due to their proximity to densely populated areas or resources such as waterways and highways, or nationally or historically significant areas. The goal of a cyber terrorist is not always to harm the target itself, but the collateral damage.

The Role of Insurance

LIU_SponsoredContent“Environmental liability is still by and large viewed as a discretionary purchase,” Bell said, “but the threat of a cyber attack that can manipulate those systems and ultimately lead to a pollution incident is added incentive to buy environmental coverage.”

Liberty International Underwriters’ environmental coverage could respond to many pollution conditions set off by a cyber breach event.

“Property damage, bodily injury and cleanup of any pollution at or emanating from a covered property would likely be taken care of,” Bell said. “The risk is not so much the cyber exposure but the consequence of the attack. The resulting claims and degradation to the environment could be severe, especially if the insured was a target chosen because of their unique position to have a large effect on the local population and environment.”

LIU also offers dedicated Cyber Liability insurance solutions designed to manage and mitigate the cost of responding to a cyber attack and any resultant loss of data and associated liability. Coverage includes proactive data breach response services designed to help organizations comply with regulatory requirements and prevent data breaches.

LIU’s loss control managers are also on hand to conduct assessments of insureds’ properties and facilities to examine potential environmental impacts. They can educate brokers on the importance of enhancing cyber security to prevent an environmental accident in the first place.

“People are relying more and more on their systems, automaton is increasing, and the risk is growing,” Bell said. “We’re all focused on protecting data, but the consequences of a cyber breach can be much farther reaching than data alone.”

To learn more about Liberty International Underwriters’ environmental coverages and services, visit www.LIU-USA.com.

Liberty International Underwriters is the marketing name for the broker-distributed specialty lines business operations of Liberty Mutual Insurance. Certain coverage may be provided by a surplus lines insurer. Surplus lines insurers do not generally participate in state guaranty funds and insureds are therefore not protected by such funds. This literature is a summary only and does not include all terms, conditions, or exclusions of the coverage described. Please refer to the actual policy issued for complete details of coverage and exclusions.

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Liberty International Underwriters. The editorial staff of Risk & Insurance had no role in its preparation.


LIU is part of the Global Specialty Division of Liberty Mutual Insurance.
Share this article: