In 2014, Risk & Insurance® will be featuring Q&As with risk management professionals. Our first installment is with Kurt Leisure, who serves as the vice president of risk services with The Cheesecake Factory Inc.
R&I: What was your first job?
I sold life and disability insurance as my first job. It was financially lucrative but the cold call sales were a challenge for me and I wanted to be on a different side of the business.
R&I: How did you come to work in risk management?
I was working in the benefits department of a large restaurant company (not The Cheesecake Factory) and was asked if I wanted to make sense out of the company’s workers’ compensation and liability claims. At the time, the company viewed these claims as an unmanageable cost of the business. I jumped into the claims to better understand what was driving them, then initiated safety programs to prevent the claims. There was an immediate impact and the company added risk management to my title. As the business grew, I eventually dropped my benefits responsibilities and focused on the risk side of the business.
R&I: What about the profession of risk management do you find the most fulfilling or rewarding?
This industry brings new daily challenges and I am exposed to almost every part of our business because there is a certain level of risk in everything. With the push to technology, and the speed at which technology is advancing, it is a constant challenge to keep up with the new risks that are emerging in this area. I love the challenge and am very motivated by my desire to identify and mitigate risk.
R&I: What is the risk management community doing right?
I have been in the risk management profession for 26 years and am excited to see this profession emerge as a recognized profession that companies value.
R&I: What could the risk management community be doing a better job of?
There are not enough universities that offer risk management programs. This makes it difficult for the industry to recruit from colleges and universities because students have not been exposed to the profession as part of their curriculum.
R&I: What emerging commercial risk most concerns you?
Cyber risk and the ability of businesses to protect the public’s confidential information.
R&I: Who is your mentor and why?
Matt Clark, senior vice president of Strategic Planning for The Cheesecake Factory Inc. He understands enterprise risk management and allows me the flexibility to apply innovation to my risk programs. This support and Matt’s strategic vision has allowed us to drive our results in a positive way.
R&I: What have you accomplished that you are proudest of?
I love to drive innovation and constantly push my staff to develop new programs and “pioneer” a solution that no one has thought of. I am also very passionate about risk management and am very visible in the Los Angeles RIMS chapter as well as other industry risk management forums.
R&I: What do your friends and family think you do?
I have a 5- and 3-year-old that consistently ask me what flavor of cheesecake I baked. The rest of my family and friends love having me over so they can hear about the latest crazy claim I have been working on. Most people who know me have a general understanding of what I do, but have no idea how many different pieces of the job there are.
R&I: What is your favorite book or movie?
My current favorite book is called “Start With Why” by Simon Sinek. I love reading about great companies and leaders and what allows these companies to survive over time. The Cheesecake Factory falls into this category and our leadership team consistently understands why we exist and what place we have in the restaurant industry.
R&I: What is the most unusual/interesting place you have ever visited?
The Crater Lake area in Southern Oregon is fascinating to me. It is the deepest lake in Oregon and not a spot that a lot of people have visited.
R&I: What is the riskiest activity you ever engaged in?
On my 40th birthday I rode a mountain bike down Mammoth Mountain (in the summer) with absolutely no safety gear at all — it was a spontaneous adventure. I ended up hitting a non-visible tree stump and cracked some ribs. I don’t always practice what I preach.
R&I: If the world has a modern hero, who is it and why?
Jeff Bezos, the founder of Amazon. He launched e-commerce and has truly changed the way consumers shop.
Coping with Cancellations
Airlines typically can offset revenue losses for cancellations due to bad weather either by saving on fuel and salary costs or rerouting passengers on other flights, but this year’s revenue losses from the worst winter storm season in years might be too much for traditional measures.
At least one broker said the time may be right for airlines to consider crafting custom insurance programs to account for such devastating seasons.
For a good part of the country, including many parts of the Southeast, snow and ice storms have wreaked havoc on flight cancellations, with a mid-February storm being the worst of all. On Feb. 13, a snowstorm from Virginia to Maine caused airlines to scrub 7,561 U.S. flights, more than the 7,400 cancelled flights due to Hurricane Sandy, according to MasFlight, industry data tracker based in Bethesda, Md.
Roughly 100,000 flights have been canceled since Dec. 1, MasFlight said.
Just United, alone, the world’s second-largest airline, reported that it had cancelled 22,500 flights in January and February, 2014, according to Bloomberg. The airline’s completed regional flights was 87.1 percent, which was “an extraordinarily low level,” and almost 9 percentage points below its mainline operations, it reported.
And another potentially heavy snowfall was forecast for last weekend, from California to New England.
The sheer amount of cancellations this winter are likely straining airlines’ bottom lines, said Katie Connell, a spokeswoman for Airlines for America, a trade group for major U.S. airline companies.
“The airline industry’s fixed costs are high, therefore the majority of operating costs will still be incurred by airlines, even for canceled flights,” Connell wrote in an email. “If a flight is canceled due to weather, the only significant cost that the airline avoids is fuel; otherwise, it must still pay ownership costs for aircraft and ground equipment, maintenance costs and overhead and most crew costs. Extended storms and other sources of irregular operations are clear reminders of the industry’s operational and financial vulnerability to factors outside its control.”
Bob Mann, an independent airline analyst and consultant who is principal of R.W. Mann & Co. Inc. in Port Washington, N.Y., said that two-thirds of costs — fuel and labor — are short-term variable costs, but that fixed charges are “unfortunately incurred.” Airlines just typically absorb those costs.
“I am not aware of any airline that has considered taking out business interruption insurance for weather-related disruptions; it is simply a part of the business,” Mann said.
Chuck Cederroth, managing director at Aon Risk Solutions’ aviation practice, said carriers would probably not want to insure airlines against cancellations because airlines have control over whether a flight will be canceled, particularly if they don’t want to risk being fined up to $27,500 for each passenger by the Federal Aviation Administration when passengers are stuck on a tarmac for hours.
“How could an insurance product work when the insured is the one who controls the trigger?” Cederroth asked. “I think it would be a product that insurance companies would probably have a hard time providing.”
But Brad Meinhardt, U.S. aviation practice leader, for Arthur J. Gallagher & Co., said now may be the best time for airlines — and insurance carriers — to think about crafting a specialized insurance program to cover fluke years like this one.
“I would be stunned if this subject hasn’t made its way up into the C-suites of major and mid-sized airlines,” Meinhardt said. “When these events happen, people tend to look over their shoulder and ask if there is a solution for such events.”
Airlines often hedge losses from unknown variables such as varying fuel costs or interest rate fluctuations using derivatives, but those tools may not be enough for severe winters such as this year’s, he said. While products like business interruption insurance may not be used for airlines, they could look at weather-related insurance products that have very specific triggers.
For example, airlines could designate a period of time for such a “tough winter policy,” say from the period of November to March, in which they can manage cancellations due to 10 days of heavy snowfall, Meinhardt said. That amount could be designated their retention in such a policy, and anything in excess of the designated snowfall days could be a defined benefit that a carrier could pay if the policy is triggered. Possibly, the trigger would be inches of snowfall. “Custom solutions are the idea,” he said.
“Airlines are not likely buying any of these types of products now, but I think there’s probably some thinking along those lines right now as many might have to take losses as write-downs on their quarterly earnings and hope this doesn’t happen again,” he said. “There probably needs to be one airline making a trailblazing action on an insurance or derivative product — something that gets people talking about how to hedge against those losses in the future.”
Searching for Stability in Cyber Space
As headline-grabbing breaches crack systems and tarnish reputations of major retail, healthcare and financial companies, the need for cyber insurance has become increasingly apparent.
Given the constantly changing nature of cyber risk and the market landscape, creating a stable, sustainable cyber insurance business demands a prudent approach, with an eye on the long road.
“We’ve seen carriers jump in and out, wanting to take advantage of a new opportunity, but perhaps underestimating the risk,” said Danielle Librizzi, Senior Vice President, Head of Professional Liability, Berkshire Hathaway Specialty Insurance (BHSI).
“As cyber exposure became more tangible to carriers, in-force coverage was tested and many made radical changes to pricing and availability of coverage. BHSI is committed to entering the cyber market in a thoughtful and sustainable way. We want to be there for our customers as the risks continue to evolve.”
Diverse, Evolving Risks
Cyber exposure – and coverage — have been evolving, posing different risks and underwriting challenges for different industries. The technology, financial services and healthcare industries illustrate the diverse issues that must be considered in order to provide effective, financially sustainable cyber solutions.
The technology sector was the first cyber battleground, and technology E&O forms included some cyber coverage by virtue of the nature of the risk. “There’s inherent cyber coverage for third party liabilities in E&O,” Librizzi said.
While coverage is widely available, tech companies pose challenges to underwriters because of their unique position in the cyber “supply chain.” These companies provide software, hardware and cloud services; virtually every organization in the world is dependent on a tech provider of some stripe. If an insurer is covering both the provider and its clients, the aggregate risk should be monitored closely.
Think of a DOS attack on a cloud provider that prevents all of its clients – which could include anyone from a bank to a retailer or transportation company — from accessing stored customer or corporate data or running cloud-based service apps. That single attack could bring business in multiple industries to a grinding halt, potentially causing business interruption and E&O losses.
The tech industry hasn’t seen a large scale event like this yet, but it isn’t waiting around for one to strike before addressing the underlying risk. Controlling and accounting for the aggregate exposure will mold the direction that coverage development takes.
“Our combined form, introduced in October, 2015, is a comprehensive solution that includes first and third party cyber coverage as well as traditional E&O coverage,” Librizzi said.
However, that approach may not be appropriate for other industries. Financial Institutions, for example, may seek a dedicated cyber only policy which does not include traditional E&O coverage.
While banks typically have strong protocols for network security and privacy, they also have a much greater exposure in massive stores of customer data. Financial Institutions are looking to address liability in the form of class action lawsuits or heavy regulatory investigations and fines emanating from cyber, and may not want to compromise their traditional E&O limits.
“Additionally, given the increased reliance on outsourced providers for technology solutions, we have started to see the introduction of sub-limited coverage for dependent business interruption and payment card industry (PCI) fines and assessments as enhancements to coverage,” Librizzi said. “We might see those sub-limits go to full coverage as competition gets heavier.”
Other industries, which may not be as advanced as financial institutions in addressing cyber threats, have suffered more from a lack of robust cyber coverage that can keep up with increasing exposure.
Healthcare, for example, has seen a surge of cyber attacks since hospitals and other health systems went electronic. To a hacker, healthcare providers represent a warehouse of valuable personal identifiable and protected health information.
Email addresses from healthcare systems typically are white-listed and less likely to get caught in a spam filter, giving hackers incentive to obtain access and gain control of a healthcare provider’s network in order to launch phishing attacks.
After some high-profile breaches in 2015, Human Health Services and the Office for Civil Rights came under scrutiny for not doing enough enforcement of HIPPA. Fines imposed by regulators increased dramatically over the past decade, and seem poised to only get higher.
“They’ll be ramping up enforcement of regulations in 2016, and that’s only a peek of what’s on the horizon,” Librizzi said.
The burgeoning of healthcare’s cyber exposure has challenged the insurance industry to better understand the nature of the risk and how best to secure hospital systems. Coverage for this sector remains the most difficult to write effectively.
BHSI understands the need for different customers to have different solutions. Some customers desire a dedicated cyber policy that does not include traditional E&O coverage. BHSI’s Network Security and Privacy stand-alone policy is designed to address the needs to those customers.
“The cyber exposures and coverages needs of healthcare, financial services and technology are on different timelines and will look very different in the future,” Librizzi said.
Even in more mature markets, the conflation of commercial and personal cyber risk will challenge insurers going forward. Most existing cyber products don’t cover property damage and personal injury; as the risks emerge and the Internet of Things becomes more pervasive, the coverage will have to evolve as well.
“We must always be thinking about what is on the horizon from a risk and coverage perspective – our technology driven society demands it,” Librizzi said.
Anticipating challenges and adapting to each industry’s needs has been a cornerstone of BHSI’s approach to cyber. It’s careful and measured approach has also helped the specialty insurer build an arsenal of experts and ancillary services to help clients better grasp and mitigate their exposure.
“We know the importance of really understanding the risk and communicating it clearly to our customers,” Librizzi said. “We don’t bury our coverage in a pile of definitions, and we provide the expertise to help insureds stay ahead of the next big breach.”
To learn more about BHSI’s professional liability products, visit http://www.bhspecialty.com/.
Berkshire Hathaway Specialty Insurance (www.bhspecialty.com) provides commercial property, casualty, healthcare professional liability, executive and professional lines, surety, travel, programs, medical stop loss and homeowners insurance. The actual and final terms of coverage for all product lines may vary. It underwrites on the paper of Berkshire Hathaway’s National Indemnity group of insurance companies, which hold financial strength ratings of A++ from AM Best and AA+ from Standard & Poor’s. Based in Boston, Berkshire Hathaway Specialty Insurance has offices in Atlanta, Boston, Chicago, Fort Lauderdale, Houston, Los Angeles, New York, San Francisco, San Ramon, Stevens Point, Auckland, Brisbane, Hong Kong, Melbourne, Singapore, Sydney and Toronto. For more information, contact [email protected].
The information contained herein is for general informational purposes only and does not constitute an offer to sell or a solicitation of an offer to buy any product or service. Any description set forth herein does not include all policy terms, conditions and exclusions. Please refer to the actual policy for complete details of coverage and exclusions.
This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Berkshire Hathaway Specialty Insurance. The editorial staff of Risk & Insurance had no role in its preparation.