Author: rockandbloom

Incidence Planning and MFA

Home • (Page 7)

Paul Martin and Colin Rooke dive into cybersecurity and incidence planning once again, discussing the right insurance plan to protect your business from cybercrime.

Listen to the full episode here, or read the full transcript below.

Paul Martin:

Welcome to Risky Business, Commercial Insurance with Butler Byers. This is Paul Martin, the host, and also the business commentator on CKOM. You hear me every day on the airwaves here, and joining me today as always, our expert, Colin Rooke, the Commercial Risk Reduction Specialist with Butler Byers.

Colin, we’re going to talk about a topic that, well, we’ve talked about a lot, but you know, we do it because it’s always changing. It’s always updating. And we’ve got more information on the world of cyber, cybersecurity, cyberattacks, and how business needs to be taking a look at this. This has been one of those things that’s always been a presence. I guess we’ve always thought about it, we’ve talked about it, but clearly it’s getting to be much, much more important in terms of how you run your business, how you treat your customers, all that stuff. Data is now king, and protecting that data becomes ultimately important. So we’re going to talk about cyber today, and are there some things that are new on this front that we need to talk about? And that’s why we’re bringing up the subject today.

Colin Rooke:

Yeah. We have talked a lot of cyber, and really the purpose of this show is to educate businesses on what’s new and emerging, how it’s going to impact them, what preventative steps can be taken to mitigate the risk, and transfer the risk, avoid the risk altogether. And so, when you look at how rapidly cybercrime is changing, it’s pertinent to discuss, okay, well, how has the risk changed? How has the insurance market adjusted due to the increased risk? And then, what do businesses need to know so they can get ahead of what’s coming, what the requirements are, and certainly how to mitigate, as best as possible, any future losses.

By the end of 2022, about 65% of the global GDP will be digitized. It just shows that the more we push to a digital world, digital platforms, the more incentive there is for criminals to capitalize on that. And so, a big trend in cyber crime is now small business. I’ve touched on this before, but three to five years ago, you say, “Well, this is a large organization. If we put a lot of work in, we can go for the big fish, the whale, and we can extract as much data, or maybe there’s a ransomware incident, we can get as much money out as possible.”

Now the focus really seems to be on the masses. It’s small business that’s being attacked. Overall claims severity has rose by 56%. We’re seeing 40% increase in ransomware for small business, 54% increase in funds transfer fraud, and so it’s now the low-hanging fruit. It’s more profitable to cover the masses rather than the select few, and so that’s why I think this discussion is so important. And we’ve got new requirements in the market, and then we’ve got a tool that you can use that really, anyone can implement very quickly to satisfy some of those requirements.

 

Paul Martin:

I wanted to talk about that. You always had tools available. I mean, we’ve always told people on this program, give Colin a call. He’ll give you a step-by-step kind of program to help put some best practices in place. But you’ve now got one that is really related to, suppose you’ve had an incident, now what? This is kind of an easy-to-use guide, a step-by-step plan on that one.

Colin Rooke:

Yeah. We’ve talked about the value in having an incident response plan in the past, and it was really good to have, or call it a wish list item. And for those larger clients, we would really push to get that in place, and we would use that to negotiate with the insurance markets and overall just mitigate the level of risk. And with the increase in frequency and severity towards small business, and these are organizations under 25 million in revenue as a classification, our older plan or our other plans call it, are pretty involved in this one is, call it a small business incident response plan that really anyone can use and can implement it quite quickly.

What I like about it is, a lot of the hard work is done for you. All the wording around how to recognize a security incident, it’s done. You don’t have to figure it out yourselves. And for every organization, you have to have key roles. You have to have, well, who do I contact if this happens? Who’s our IT person? Who’s our information security officer? And we’ve got a great template for that. But then where businesses get hung up, the smaller enterprise, and again, under 25 million, is building out the job description, the roles, and we have that done. I mean, you can nip and tuck, you can change, really, you can do whatever you want, but we’ve taken out all the legwork. And really, I don’t want to say it’s plug and play, but you could do that, and after that, you just have to review quarterly. We can say with confidence, “This is in place. They’re following it. It’s being reviewed, and they know what to do in the event of an incident.”

Paul Martin:

And when you say, “We can, with confidence, say this,” you mean that when you’re going to talk to the insurance company about the possibility of putting a plan or a policy in place for that client, right?

Colin Rooke:

Yeah, absolutely. We spend a lot of time working with underwriters and their cybersecurity departments to say, “Okay, well, what constitutes a plan? What do you need to see? How often does it need to be reviewed? How complex does it have to be?” And so, we know this plan works. We know that it’s, from their perspective, well written. It checks all the boxes. And as long as we’re saying, “Okay, this is implemented and it’s being reviewed,” that we can say, “They’ve got a full and complete incident response plan in place designed for small business.” We do have the more involved, larger as well, but this works.

And then when we’re asked, when looking for cyber liability coverage, “Is this in place?” we can say “Yes,” or get to the point where we’re at the point now, where they’ll say, “Are you planning on using your plan?” And we can say, “Okay, it’s not done, but we guarantee by X time, it will be done.” And it’s working very well for us, and it’s not a lot of work for the end user because we’ve done all the complex portions.

Paul Martin:

Colin, I’m assuming the insurance companies are probably getting tired of these kinds of claims. And so, when you come forward representing your client as the broker, and you say, “We have this in place and it’s being reviewed quarterly,” and there’s the pre-event planning and then the post- event steps that you take, how does the insurance industry respond to that? I mean, you come forward and you say, “Here’s the case we’re making on behalf of the client.” How do they react?

Colin Rooke:

Really good point, and so due to the global increase in frequency and severity of claims, we’ve got underwriters looking for any reason not to offer the coverage. They’re looking for no, and lack of incident response plan is a big box. You don’t have it, we’re not going to look at it. And so when we say, “Look, we know what you’re thinking, and we know what you’re going to ask in advance, and we have either done that, or we’re working on it,” it provides incentive to say, “Okay, this is a good risk, and so we want to work with them. We want to even offer coverage.”

You know, it’s no longer sort of a fight to say, “Well, who’s going to offer similar coverage for the least amount of premium?” It’s reasons to offer it at all. Right now, one of the largest global cyber insurers is not taking any new business from anyone anywhere due to losses. And so, if we can go to those remaining markets and say, again, “I know what you’re thinking, it’s bad, but this client is already working on it,” you’re going to get the coverage.

Paul Martin:

All right, Colin, we’ve got to take a little break. I’m finding this really quite intriguing, so I want to pick it up after we come back. You’re listening to Risky Business, Commercial Insurance with Butler Byers. Back after this.

Welcome back to Risky Business, Commercial Insurance with Butler Byers. Paul Martin here, and joining me, Colin Rooke, Commercial Risk Reduction Specialist with Butler Byers. Colin, before the break we were talking about some of this new small business incidence response plan that you’ve got that kind of is a post-fact thing. You’ve already been attacked, and here’s how you cope with it. What is changing on the front in the preventative side, if I could do that? I mean, insurance companies, they spend, as you said, lots of money on this thing in paying out claims. They’re probably upping the bar too, in order for you to get in. What are some of the things that business owners need to know about?

Colin Rooke:

Yeah, great question. In addition to having some sort of incident response plan, I mean, we’re hearing all the time about multi-factor or two-factor authentication. Again, this used to be a sort of a wish list type item, or sometimes the markets would say, “We would like to see this happen by X amount or X day.” Now it’s a hard no for organizations of any size, other than the very small. If it’s not in place, they’re not offering terms. And if they’re offering terms, you’re paying a sizeable premium if this is not in place. And so, it’s really important that we discuss what multi-factor authentication is and why you would do that. But again, if you’re looking at cyber, if you fall into a category where there’s an exposure, which I would say, every business has one, if this isn’t done in advance, it’s just not a possibility for you.

Paul Martin:

That’s a fairly recent development, isn’t it? I mean, would we categorize that as being part of news? Here’s something new you need to be aware of as a business owner, looking to buy some insurance?

Colin Rooke:

Yeah. It started in 2021 and it was really, for the most part, around 2021. And it was all, if you were in a high risk category, they’d say, “We need you to have multi-factor.” And from there, it has expanded to, it could be a hot dog stand, and they want you to have multi-factor.

And it’s really quite simple. When it comes to password and password protection, you’ve got your username and password to get into your email, to get into your server, to get into anything. And all this does, all multi-factor does, is add one more factor, one more step, when trying to log in. In most cases, it would be a text message with a randomly generated code that you would plug in, or when trying to log in, to just show, okay, one more step that this is probably the individual trying to log in. It’s very, very simple to crack usernames and passwords. It’s a very, very simple loop that almost any hacker can develop, and therefore, this is just one more step to thwart, certainly, fishing scams, ransomware, malicious code, a lot of these sort of hot button incidents.

Paul Martin:

What kind of response are you getting from business owners now when you go and talk to them and you say, “Listen, this is now part of the requirement plan. If we can’t check this box, in all likelihood, we’re going to get declined or it won’t be very appealing, the insurance company’s response,” are they surprised to see this? I mean, these developments … Are people sort of, “Holy, I really didn’t realize this was really serious stuff, I guess.”

Colin Rooke:

Yeah. I think you get a lot of eye rolling. It sounds onerous to implement. It’s just one more thing we have to do. It’s tedious. Yeah, it’s going to take time. It’s going to be costly. And the funny thing about multi-factor, I mean, when logging in, we’re talking another three-second step, depending on which form. It could be facial recognition software, where you log in, you quickly look at your phone and you’re in, or you quickly type in a password.

But to dispel a myth out there, most multi-factor is completely free. We’re not talking about, go get a quote and add it to the budget. It is totally free. I mean, Google has free multi-factor, and anyone using Microsoft products, depending, I’ll say, on how current your software is, again, free. And so, a little bit of time to implement some … But otherwise, very, very useful, very, very beneficial, regardless of whether or not you carry the coverage. Nobody wants to go through ransomware. I can personally guarantee, nobody wants to go through ransomware, and so one little step that after two or three days becomes second nature, and that’s it, you’re done. It’s taken care of.

 

Paul Martin:

Reminiscent of that debate we had some years back about buckling your seatbelt. Now, nobody even thinks about it, right?

Colin Rooke:

Exactly.

Paul Martin:

We’ve got a couple of minutes left before we run out of time, but what we’re talking about here is insurance companies are starting to say, “Hey, I’ve got to up the standard for my client’s performance.” What’s causing that? I mean, you alluded to payouts are big. I mean, do you have some stats on that? I mean, why are insurance companies doing this stuff?

Colin Rooke:

We’ve talked about the hard markets and weather-related events and claims being paid from ’18 and ’19 sort of hitting the books in ’21 and ’22. But when it comes to cyber itself, it’s just not a profitable line of business. And there’s no end in sight. We’re in a scenario where insurers cannot collect enough premium at this point, and so anything they can do to get what they would deem bad risks off the books, they’re going to do that.

To talk about, sort of quickly, what’s going to come next, it’s going to be encryption. So, I’m going to say it now that large organizations, again, it went from a wish list to a must-have, medium and small, give it a year. And we’re going to be recording this show, and I’m going to be talking all about encryption and the fact that it’s also now mandatory.

Paul Martin:

The numbers, though, on the claims have been going up, haven’t they? I mean, it’s no longer just anecdotal. We’ve actually got stats on this stuff.

Colin Rooke:

Yeah. It is. Like I said, claims severity rising 56% for small business, so how often incidents are occurring, it’s increasing, but then the cost of those incidents are skyrocketing as well. And I’ve said this before, but I do want to say again, there’s an attitude out there that, I buy cyber liability insurance, so then therefore I’m a target. But there’s no relationship to whether or not you purchased it or not when it comes to incidents. It’s just whether or not you’re able to transfer some of your losses to an insurance company, or you’re self-insuring that in-house. I mean, that’s really the only differentiator.

Paul Martin:

Colin, as always, very insightful. I want to thank you for this. You’ve been listening to Colin Rooke, Commercial Risk Reduction Specialist with Butler Byers, and feel free to call him anytime. If you have any questions, he’d be more than pleased. Colin or any member of his team would be pleased to have a conversation with you. Thanks for joining us. I’m Paul Martin. Talk to you next time.

Inflation Alert

Home • (Page 7)

As prices rise, Paul Martin and Colin Rooke discuss the impact of inflation on the insurance industry.

Listen to the full episode here, or read the full transcript below.

Paul Martin:

Welcome to Risky Business, commercial insurance with Butler Byers and your expert with us today, Colin Rooke, commercial risk reduction specialist with Butler Byers. This is Paul Martin, the host of this program, and thanks again for joining us. Now, Colin, we’re going to maybe switch subjects and talk primarily a little less about insurance, more about economics, but boy, they are intertwined, and the topic that keeps getting all the attention these days is that of the big i-word, inflation. Prices are going up, you’re seeing right across the country, economists are telling us that’s going to trigger interest rate hikes, which will add cost to businesses, but will inflation itself have an impact on the insurance industry? I mean, end of the day, insurance is a financial product. So my guess is, yes, there is an impact. Can you walk us through that?

Colin Rooke:

Yeah, absolutely. So I think everyone’s aware that we’re seeing the highest rise in consumer prices since the early nineties. Well, you listen to any news or any web browsing, you’re sure to stumble across it, and it’s what everyone’s talking about, from the grocery store bill, right to appliances. And unfortunately, so we’ve spent a lot of time talking about, on this show, the hard market and a few episodes ago, we reported that, hey, the insurance companies are now profitable, meaning that the sharp pricing increases that we’ve seen over the last three to four years, frankly, has worked, and we talked about, we’re not necessarily expecting a softening of the market, because this was a long cycle and the insurers are not going to soon forget the spot they’re in, but certainly we’re seeing the rates level out, which is great news.

However, then we start using the i-word, inflation, and so how is this going to impact your policy? Well, just because the insurer isn’t raising the rate you’ll pay for example, every dollar in sales or every dollar in equipment owned or building values, et cetera, now what we’re having to do is re-look at the value of your building, the value of your inventory, having conversations about business interruption, with supply chain shortages, something that may have taken you 12 to 18 months, for example, new piece of equipment, now might be three to five years, so it’s a big issue, and it is unfortunately going to impact, yet again, the cost of your commercial insurance program.

Paul Martin:

So you’re saying that the hard market cured itself a little bit, and just in the nick of time along comes the next problematic challenge that business owners, in their pursuit of insurance coverage for their commercial operations, are going to be facing yet another hill to climb and saying, “yeah, we got through one, but there’s another one right in front of us.”

Colin Rooke:

Yeah. Absolutely. Again, over the last three to four years when you’re having the renewal conversation, it’s a lot around the rate, so it’s just the number applied to what you have, and so you say, the issue here is, the rate is going up, they need more rate to ensure your company. And we always skim over… Oh, and by the way, they’ve added 2% to your building equipment stock, just to keep up with inflation and most clients are totally okay with that, “yeah. Well, that’s about the rate.” We now going back to say, “look, it’s no longer 2% a year, it might be four or 5% a month.”

You really have to go back and say, “you’re selling your goods at a higher amount, that means we’re now going to have to really look at ensuring your goods for a higher amount”, and traditionally, depending on the industry, all things being equal, meaning your inventory’s totally static, as an example, you would really only look at increasing the value of your equipment or stock at renewal or leading up to renewal, but now, we might find ourselves in a position where we might have to reevaluate every 90 days depending on basically the rate of inflation, and so it’s not something that we’ve really had to do in quite some time.

Paul Martin:

That’s an interesting point, if you think about it. Most of us are conditioned, I think, probably the industry is conditioned to an annual renewal rate. You’re saying that, “be ready, this is a potential change that’s coming.” Did we see that in the high inflation environments of 30, 40 years ago say where the policy was in place for a year, but the rate was reviewed every three months or something.

Colin Rooke:

Well, it wouldn’t necessarily be the rate, but it’s the value of what you have. So if you look at, for example, the lumber industry, in six months, the cost of lumber has gone up three times. Well, anyone that didn’t say, “geez, I better adjust the policy limit for the lumber inventory I carry to reflect, again, rapid increase in pricing”, you could find yourself in big trouble in the event of a claim, and so, it’s not as much the insurer saying, “we need to make more on those goods” It’s the, “do you have the right value internally in this case?” However, that’s not the case for other lines of coverage, like commercial auto, which we’ll talk about shortly.

Paul Martin:

Yeah. I get it now. I think you’re saying that, if your balance sheet is changing, you probably need to be reviewing how much coverage you have, because these two should be moving together in lockstep. So if your inventory values are going up, you better be talking to me because we probably need to make some changes so you don’t get capped out or short changed if you do have a loss.

Colin Rooke:

Yeah, absolutely. A normal thing, again, to use the lumber example, if you traditionally always had, let’s say, a million dollars worth of lumber and you bought an additional 500,000 worth of lumber, you would call your broker and say, “Hey, my inventory level has gone up by 50%. I want to make sure I’m covered”, but in your mind, if you still have the same amount of lumber, but the cost to replace that lumber keeps increasing each and every month, what is not happening in this industry is, the conversation with the broker to say, “I haven’t necessarily purchased any more pieces of wood, but the value of that is shooting through the roof. Do I have to increase this limit?” And the answer is, “you probably do actually.”

Paul Martin:

Yeah. It’s a good reminder for everyone in business, I guess, that, if the product you have on hand is changing price, you probably need to be having a conversation with your broker, and as you say, I still have the same number of board feet, the number of pallets in my yard, but they’re way more valuable now, and we’ve seen that in really, I mean, even things like grain, I guess, have gone up dramatically, we’re seeing all the commodities that Saskatchewan produces going up in value, so this is probably not as much an aberration as the average person might think. It’s probably the norm these days.

Colin Rooke:

Yeah, absolutely. And I mentioned commercial auto. Now that’s a little different, because if you think about it, if anyone’s tried to purchase a new vehicle lately, there’s not exactly a lot of inventory lying around and really there’s no more deals. I mean, if you’re able to pay MSRP, you’re winning at this point and we’ve got often people paying 30, 40, 50% more than MSRP. Now, if you’ve tried to repair an existing vehicle, you’ll have noticed that depending on what the part is, again, significant delays, well, where that’s going to impact the business owner and frankly, in this case, the individual is, it will come down to rates and it will come down to, again, overall values, if it’s costing you more to get the vehicle, it’s costing you a lot more to fix the vehicle, and if you think about it, your 2004 Mitsubishi Lancer that was worth $5,000 three years ago might be worth 20 today, and so therefore in the event of an accident, just more money is being paid out.

Paul Martin:

Well, you’ve opened a kettle here, a kettle of fish for us to explore. We’ve got to take a little break though. We’ll come back and we’ll dig into that part just a little bit deeper. You’re listening to Colin, the commercial risk reduction specialist with Butler Byers Insurance. I’m Paul Martin. This is Risky Business. We’ll be back after this break.

Welcome back to Risky Business commercial insurance with the Butler Byers and the man who guides us through this on an ongoing basis is Colin Rooke, the commercial risk reduction specialist with Butler Byers. Colin, just before the break, you were talking about the auto industry and everybody’s cognizant, I think, of the delays and the backups in the auto industry. I notice that automotive dealers now have even changed their language.

They don’t invite you down to the showroom anymore. They invite you down to place your order, custom design your vehicle, and it might come sometime, but they’re just that far behind, and so, that’s an issue between buyer and seller, but you’re saying it’s also an issue in insurance and the implications come through, and it’s like an example of what can happen in any industry line if you’ve got these kinds of imbalances between supply and demand, it starts to impact price, it impacts service levels, it impacts everything and business owners can protect themselves or should at least have the conversation, so they’re cognizant of the challenges that’ll be facing.

Colin Rooke:

Yeah, absolutely. So when it comes to cars, again, the declared value is an issue. If you buy a truck for $75,000, it wouldn’t be unreasonable to say, well, five years later it might be worth it, $45,000. Well, now you buy a truck for $75,000, five years later, it’s worth $85,000, and so you got to make sure, again, “do I have the right coverage limit?” But from a budgetary perspective, one, again, if you are in an accident, talking about commercial auto, the cost to make you whole has increased dramatically across absolutely every type of vehicle, anything with a motor, for example.

And so values are an issue, but we are going to, in my opinion, start to see more rate on the personal auto and certainly the commercial auto side of things, just due to widespread delays, vehicle shortages, part shortages, paint shortages, labor shortages, metal shortages, you name it. And so unlike commercial property, where I’m saying, they’re okay with the rate on your limit level, but you might have to increase the limit. In this case, we might be looking at a dual, the insurance marketing wanting more rate, and then also your limits are going up as well.

Paul Martin:

Well, economists will tell you that inflation is not just prices going up. I mean, that’s the byproduct of it, but it’s effectively the value of the currency that you’re dealing with is depreciating, your buying power is declining, that translates into higher prices, but as you point out, a vehicle price today might actually go up. So, the value changes, but the value doesn’t change at the same time, because, if I have a house today, it’s worth a thousand dollars and the neighbouring house is worth a thousand, two years from now, they’re both worth 3000.

I mean, the value relative to the other product is the same, it’s just the price is different. So that’s what we’re getting at here, I think is what you’re saying is that, this is an issue of purchasing power, and you need to be able to keep that in mind that, if a business owner is having challenges in the purchasing power of buying inventory or supplies, or hard goods like a vehicle, odds are, this is going to have an impact on your insurance too, and we need to include that even though it’s not one of the products you buy or sell.

Colin Rooke:

Absolutely. And it’s a little easier to pallet when you say, “I’m going to way overpay for a Ford Raptor, but I’d sure like to drive one”, and when it comes to the insurance cost conversation, there’s always shock and awe if it’s going up, and so at a high level, it’s just keep in mind that inflation is going to directly impact your insurance policy. Now, there are steps you can take to mitigate this as well, and that’s why I want to bring this topic up. One, it’s very important to have more regular contact with your broker to spend, especially dependent on which industries you are in to say, “how is this impacting me? Do I need to increase levels?” And so more regular conversation is really important.

I mean, something that is also very important would be a complete review of all the terms and conditions of your policy, and so, as part of our risk reduction workshops, we do do this. It’s part of the analysis, it’s part of the plan presentation, but it’s very important, now more so than ever, to understand all the limits and conditions of your policy so you can make the right choices or at least educated choices for your company, and then, again, very crucial, really look at property values. If you haven’t done a building valuation in a long time or even equipment in stock, I would highly recommend you do so. So, one, you’re aware of where you’re at now, but there’s a lot of great companies out there that will provide three years worth of inflationary updates.

So you pay once and then you have this trailer, so you’re very aware of, whether up or down, the value of your building and equipment and stock, and I would say, again, if you haven’t done it in a long time, make sure that gets done, so there’s no shortfalls. I mean, at the end of the day, your broker and the insurer, it really is guesswork. I mean, a lot of the time you’re just taking the opinion from the customer to say, “well, my inventory is worth this.” That’s why it’s important to have an expert come out and say, “it’s actually worth this.” And then, again, this all plays into proper risk management and avoiding claims altogether. So working with the company like Butler Byers to mitigate losses, avoid losses all altogether, contractually transfer those losses, so it’s less of a concern in the event of a claim, having a shortfall due to an issue like rapid inflation.

Paul Martin:

Strikes me as this is more than an insurance conversation. I mean, in an inflationary environment, and it’s probably good to re-evaluate certainly the largest assets that you’re carrying on your balance sheet on an ongoing basis, because that impacts the relationship you have with a bank, if you’re a borrower, I mean, this goes well beyond just insurance, doesn’t it? Let’s face it, everybody in business has a margin account of some kind, some sort of line of credit. If the value of your assets is going up, that should impact the value of how much you can access from a bank, for example. So this is more than insurance, insurance is really just in lockstep with other financial services that a business might use on an ongoing basis.

Colin Rooke:

Yeah, absolutely. I’m not suggesting that… The real point is, when thinking about inflation, think about your insurance as well, again, this is the topic everyone’s thinking about, and it’s really important to think the value of my goods, the value of my buildings, and how does this impact my commercial insurance program?

Paul Martin:

Well, Colin this has been very insightful. And, I think for most business owners, you probably deal with things like inflation in a mode of some frustration, because it’s hard to keep up and hard to swallow the price increases you’re being handed and figure out, “how do I transfer those on to end users?” And so it’s a period of frustration and you’re saying, “come in and talk to us, we’ll walk you through this, we can’t make the pain go away, but we can show you how to deal with it. And we can show you how to take really an educated or an informed position on this so that you can sleep better at night, that you know, at least you’ve got this part in hand.”

Colin Rooke:

Yes, absolutely.

Paul Martin:

You’ve been listening to Colin Rooke, commercial risk reduction specialist with Butler Byers. I’m Paul Martin. Thanks for joining us. This is Risky Business. Join us again next time.

Market Profits Up

Home • (Page 7)

At the end of Q1 for 2022, Paul Martin and Colin Rooke look at what 2021 brought to the insurance industry?

Listen to the full episode here, or read the full transcript below.

Paul Martin:

Welcome to Risky Business Commercial Insurance with Butler Byers. This is Paul Martin, your host, and joining me today, Colin Rooke, Commercial Risk Reduction Specialist with Butler Byers, and Colin, we’re end of Q1 here in 2022. And that’s always the time for me when I look back, it’s kind of the time we start to get the economic assessments, the financial performance of last year, and at year end, you get 90 days kind of to do up the book. So what are we finding? And what did 2021 bring to the insurance industry? This has been kind of a rocky ride for the last four or five years. And what did last year do? Was it more bad or did they turn the corner?

Colin Rooke:

Yeah, so basically now, the summary of the last year, the results are in on how the Canadian insurance industry fared, and 2021 had the lowest combined ratio ever recorded, and by a significant margin. Basically meaning, all the money they took in, minus expenses, what’s left over, and it also translates into the third most profitable year for the industry, also ever recorded, and since 1975. And so again, from a loss perspective, the industry’s improving.

Now, I want to be very clear about something. So claims are still through the roof. So, for anyone saying, “Oh, okay, so there’s no more claims.” No, no, it’s as worse as it’s ever been. So our previous show about claims, I mean, that’s all true. But we’ve been talking about this hard market that we’ve been in for four or five years, and certainly in the last three big impacts of that, it shows that the rate correction, the limiting exposure, increasing deductibles, reducing capital, reducing coverage, removing coverage lines all together, is working.

Now, it’s not across all lines of business, this combined ratio. I mean, the combined ratio is representative of all lines of business. But depending on the line of business, the combined ratio is in the fifties, meaning if… Let’s say it’s 50- 50, that means 50% was available for profit. And so, there is a lot of classes that are performing very, very well, but those are some of the classes that had the largest corrections, because they needed it. And so, it’s sort of… its good news and it’s not at the same time, meaning they’re right. They needed more rate and that’s working. They needed to reduce some coverages, making insurance more difficult to get, but the result is working, and for the great companies out there, or those willing to put in the work, this will be great news for you.

Paul Martin:

I think that’s the point here, isn’t it, is that, we can’t… business owners can’t take that sort of position that, “Oh, well, the insurance industry’s back, they had a good year, so I don’t have to perform, I don’t have to be as good a customer as I used to be.” I guess we could put it that way is just say, Colin’s been pounding on me to do the work, do the work, do the work, and now the pressure’s off. That’s not the story here at all, is it?

Colin Rooke:

No, it’s not. So this cycle, this hard market is also, as far as what I can find, the longest ever recorded, meaning it just took that long to get to where the rates needed to be. I mean, some of these hardening of markets or hard markets, are 18 months, not four to five years. And again, we’re not out of the water depending on coverage line, like Cyber, we’re just getting into it. I mean, I think we’re going to see three to five more years of Cyber increases due to the rise in claims. So the insurance industry, they’re not going to forget where they came anytime soon. And that’s why I said, “It’s sort of good news, bad news.” I think they are going to continue to take a very hard stance on less desirable business.

We had a meeting earlier in the week with, I’ll say the one of the top three largest insurers in Canada, just so I don’t deliberately single them out. But they now have, in their reporting back to us, they now have new criteria. So when we submit a quote, they’ll say, we either received it, quoted, declined. They track hit ratio and they report back to us so we know how we’re doing with these markets. Well, they also have expanded their list of why they decline, and just to give us some more specific info, and there’s a lot of items, line items now, basically around quality of risk. And it just basically means, this client isn’t even good enough for us to consider it, and so therefore we won’t, we’re not going to waste our time. We took a quick look and they can be someone else’s problem, which that didn’t exist before. You know, they would say, “Oh, metal manufacturer, that’s a hit for us. We’re going to underwrite it.” Now they’re saying, “Metal manufacturer. We’re all over it, crappy business, no way.”

And so they’re not going to forget where they’ve come anytime soon. However, from what we’re seeing, all these insurers, their appetite now is increasing for new business. And so, it’s a great sign for the great businesses out there. And it’s a great call to action for those that haven’t really been working on it. You know, you can stay in that mix. I mean, if you like the hard market, if you like 20% increases year over year and decreased coverages in a huge headache at renewal, you don’t probably have to do much. Or, you can sort of switch sides, say, “There’s a benefit to me if I work on risk,” and certainly from an insurance cost perspective, but an overall in company performance.

Paul Martin:

Well, you always like to think, “What lessons did we learn through this process?” So if I’m an insurance company, I learned that, “Yes, I have to manage my book of business more diligently than I had before. So I have to be more discerning, more discriminating, charge more and just run my book much more efficiently.” From the customer’s perspective, I think we’ve learned that those who did the job well, as you advised, now have options. They managed to keep their coverage through, probably got pretty good premium treatment relative to the market, and now are in a position to be wooed away with perhaps better rates or more coverage, or just better treatment. But if you were in the also ran category, if I could put it that way as a customer, you still don’t have any more choices. Right? Just, the market’s improving. Yes. Insurance companies are more interested, but they’re still discriminating. They only want only… the only trades are going to happen among the best players.

Colin Rooke:

Yeah, absolutely. In fact, the light came on when you were speaking there. So something I’ve never, I don’t think I’ve ever really clarified on this show, so everyone was affected by the hard market. We didn’t see a lot of as-is renewals or decreases. And we’ve talked about, “Do you want to be the one that getting the 5% increase versus the 50?” But I want to be clear about something, too. So, if you were a great business before the hard market, I mean, your rate would be severely deviated from average, and certainly from above average, or someone with high severity and frequency of claims. And so, despite increases, what I’m talking about is, you could be in the same category, but there could be a 60% rate spread. And yeah, I mean, if I’m seeing 4% and you’re seeing 4% or 15 or 20% increases, we have clients that still, after the hard market, are way below the norm because of the work they’re putting in, and then even now, those clients have more choices despite an industry floor rate.

And being completely transparent, I mean, I think every broker could relate to this that, when you’re dealing with your clients and you get a renewal and you see the rates or the rating, there’s that moment where you say, “This looks, I mean, this looks reasonable, for that company.” And we’ll say, “I don’t think we should… I think we should take this. I don’t think we should re-market it. I don’t think we should push back.” But again, it doesn’t mean that you are paying the lowest rate in the industry, it means, “Well, taking a look at the operations, this is fair. I’m not… I’m certainly not going to… I’m certainly… what case can I make?”

And so, if you are on, the point of all this is, if you are on the wrong side of the point I’ve just made, there is a huge opportunity to gain ground. I mean, an absolute… I mean, just a great opportunity to say, “I get it. And I don’t want to be in the top end.” And ask your broker and say, “Okay, where do I fit on the average rating for my class of business? Where do I fall?” And then really think about that. Especially if you’re a big deviation from average. What are you going to do just to get to normal? And so, big opportunity now to say, “You know what? I’ve seen my insurance premiums triple in the last year. I would like it to start going the other way.” But they’re not going to adjust that if you haven’t changed, but you do have competitors that are paying better rates than you, absolutely.

Paul Martin:

And that makes you less competitive. Listen, we’ve got to take a break here, Colin, and we kind of run a little bit over time. So we’ll pick this up. You’re listening to Colin Rooke, commercial risk reduction specialist with Butler Byers. This is Risky Business back after this break.

Welcome back to Risky Business Commercial Insurance with Butler Byers. Paul Martin, here, your host, and joining me for a conversation today, Colin Rooke, Commercial Risk Reduction Specialist with Butler Byers. And Colin, before the break, you were talking about on the insurance companies have kind of weathered the storm and kind of back now, they’re starting to, think we talked earlier, they had four or five years of losses and they had to refill their treasuries. And that always is a scary thing in a macro context, too. Did we lose, did the world lose any insurance companies through that? Did they all make it? I mean, are they… is the industry back if I could put it that way?

Colin Rooke:

Yeah. So the world has lost insurers. There’s been a lot of consolidation. And again, I wouldn’t necessarily say they’re back. I mean, they’re certainly not back. 2021, fantastic year. However, it’s a drop in the bucket over the last, well, certainly five years of horrible returns. But it just shows that it’s moving in the right direction, and for those insurers that have fared very well, and there have been some that were early on the correct rates, that are… that have… they’re way ahead of this and already decreasing in some areas or as-is renewals, which is a fantastic term as a broker, as-is, I don’t have to make any adjustments, I can just… you know, that’s great news for us. And so, there are insurers in Canada that came out early. Again, one of them being the top three.

I mean, I remember a meeting, it was seven years ago and they said, “We are concerned that this pricing scheme cannot continue. And we are taking a hard stance and we are going to start increasing rate year over year, and we’re prepared to lose business doing it. But when the market correction ultimately does occur, we want to be well ahead of that, and then come out strong.” And you know, that insurance company is doing very well right now because they are able to offer deep discounts. But, I do want to caution that it doesn’t mean they’re going to start dropping rates to the floor, but it does show it is working and that this can continue, and despite having a great year, they’re not going to plan for this. Meaning, it’s almost too good. And so, we will see companies saying, “Well, if I take a less stringent stance on certain lines of business, we might be able to gobble up a lot more premium.” And so, we will start to see that very soon. Already have in some cases.

Paul Martin:

Well, I think at the end of the day, all of… and we talked to business people here, this is about commercial insurance. I mean, everybody that will be interested in this topic and listening to us, understands sort of where I was going with that question was, none of us benefit from big, large chunks of an industry disappearing. I mean, if insurance companies provide us with a service of supply us as suppliers, we want more options, not fewer, as customers, and that they are actually financially healthy, it’s probably a pretty good sign for us. And we know how this works. Customers have to carry the weight… the freight on this thing. And so the conversation that we’re having is really about, “Dear customer, here’s how you perform better in order to get preferred pricing in what has been, and will continue to be a challenging market.”

Colin Rooke:

Yeah. You know, it’s another good point about just the insurance company overall. So there has been consolidations and the problem is, those are Canadian domicile markets, like domestic markets being purchased up. So every time that happens, I mean, you’re going to lose their, their niche, their specialty. And then you’re more likely to have to go to a Lloyds of London, and you want to avoid that. I mean, if you can place business with a Canadian domicile insurance company, I mean, you’re ahead of the game in most cases. And the only reason why I say most cases is, sometimes they just won’t write it in Canada. But so, the concern there is, and if the industry can’t keep this up, we’re going to have less choices. And you’re right, that doesn’t work well for anyone.

And another comment too, is there seems to be a large kind of spread in the middle now. So we’ve got a handful of giants in Canada and then the middle is kind of vanishing, and then you move over to more of the mutuals. Now there’s a lot of fantastic mutuals out there. However, traditionally the box is quite small. They can’t really push the limit, and the middle is where you get all those niche players, that says, “Well, we have a program for this. We have special… We have expertise in this.” As those go away, it doesn’t necessarily say that program remains. They just bought the premium, bought the clients, and really there’s no requirement to continue. And we’ve certainly seen that, one in particular where they insure a lot of municipalities, rural schools across Canada, is purchased and now no longer able to write new business as a result.

Paul Martin:

Well, that’s the point, isn’t it? I mean, if I’m big and sort of specialized or generalized in my realm, if I buy a boutique firm, I’m going to make it look like me, I’m not going to look like that. Right? I bought it for a reason, it was available for a reason. And so, those sort of unique or distinct benefits that you had maybe enjoying, disappear pretty quickly, and you as a buyer have very little leverage when it comes to that. And Colin, we’ve got maybe a half a minute left. I’m just curious now, when you start talking to your customers going forward, how do you position this thing? And it’s just, “We need to do more of the same. This has worked, we got through the rough patch. And this is when we’re really going to benefit?”

Colin Rooke:

Yeah. We’ve got to explain that, again, it’s not the clients, it’s the insurance… their stance on rate has worked. Now we can keep it up and they can… we can do nothing and continue these high levels, or we can push back. We can put in the effort and really sell your story. And again, especially if you are on the losing end of average, put in the work now. I mean, you are a reason why we got to this place.

Paul Martin:

Colin, as always, very interesting. Thank you for joining us. You’ve been listening to Colin Rooke, Commercial Risk Reduction Specialist with Butler Byers. I’m Paul Martin. Thanks for joining us. This is Risky Business. Talk to you next time.

Home Improvements

Home • (Page 7)

Paul Martin and Colin Rooke discuss risk reduction or risk management for the average home owner.

Listen to the full episode here, or read the full transcript below.

Paul Martin:

Welcome to Risky Business: Commercial Insurance with Butler Byers. This is Paul Martin, your host. Joining me today, Colin Rooke, the commercial risk reduction specialist with Butler Byers. And Colin, we’ve, over the course of this program, covered an awful lot of ground from cyber to pick a topic, we seem to have covered it. But it sort of struck me, maybe we should… So I thought, “Well, I’m going to explore this with you.” Risk reduction or risk management is not just a commercial issue. It applies to personal stuff too, like your house. And you guys, I mean, this program is mostly about commercial insurance, but you obviously have personal lines and you insure homes and that kind of stuff. And it struck me, is there a risk management kind of plan that the average homeowner should be talking to you guys about, should be giving a little bit of their brain power to devote a little energy to that thought process? And my guess is you likely have some handy tips that a homeowner can deploy as well to take some of the risk out of just looking after your own property.

Colin Rooke:

Yeah. I attended a conference and one of the speakers was from the Institute for Catastrophic Loss Reduction. And it was funny because he said, “I do a lot of these, and I give out all this great information, and probably no one in the room,” you know, so it’s all insurance people, “probably nobody in the room has heard of this or will use any of this information. But it’s great stuff, and it’s completely sponsored by the insurance industry.” And right away, I was saying to myself, “I use the website all the time.” A lot of our commercial tools come from sites just like this, right? Organizations that devote all of their time to protecting business across Canada or North America, and across all different industries.

So again, a lot of the information that I receive and, certainly, some of the tools come from organizations just like this. In fact, I think the very first tool we ever discussed having a disaster recovery plan six years ago, I’m referencing these tools available from this website, but the session took a turn and he started talking about all the work they do for homeowners and that we… That it’s not just for insurance… The sites aren’t just for insurance people. I mean, anyone can go to the site, and it really got me thinking, “Yeah, we need to talk more about what the homeowner can do to protect their home.” Like in Saskatchewan, we’ve got volatile weather, heavy rain, strong winds, we can have flash flooding at times. And being in insurance, sewer backup and any sort of overland flooding, water’s a really big issue in our industry.

And so, what we have available to all of our clients is, depending on sort of the concern you have, a very, very in-depth guide that will walk you through the problem, talk about, “Is this problem getting better in Canada? Is it worsening the areas most affected?” And there’s just really, really great tips and explanations on things you can do, regardless if your house is 100 years old or you’re just building it, to proactively address these issues and really ensure that, when there’s a big storm coming through, you aren’t the one worried, or high winds, you’re not worried that your roof is going to be in somebody else’s backyard.

And some of these, I mean, frankly, a lot of these tips and tricks I hadn’t considered, or never did find in my research. So if someone that spends most of their time working on risk management, if it opened my eyes, there’s a lot of great tools and resources, again, that we can share with anyone wondering about, “I’m worried about extreme heat,” or “I’m wondering about the best way to heat and cool my home.” And so, just a lot of information available that can really help our customers.

Paul Martin:

Well, that’s the thing that struck me as we were discussing this was, you live in this world. I mean, you do this for a living every day. You’re really focused on how do you deal with the various risks and how do you mitigate them. And for you to come away, having learned something about, as a homeowner yourself, if you learned something, then the rest of us probably should be… The odds are, we’re going to learn something too. And well, it might be kind of fun, even if we just walk through some of the learnings that you made, some of the tips that you’ve got. And I guess we can just start with something as simple as, “Where do I start if I’m a homeowner and I’m hearing this, and I’m kind of interested in what you’re talking about. What’s the first step I should be taking?”

Colin Rooke:

Yeah. And these documents do explain how to better protect your home. And one that’s apparent across all these tools is, “Have you had your home inspected by a home inspection service?” And if you think about it, most people, when they sell their home, some will do it proactively to look for things or, of course, the seller will order a home inspection done, but why not do it today? Why wait until you sell your home eight years from now to learn that you had water seeping in, you had improper insulation, the R-value of your insulation isn’t what you thought it was, there’s gaps, there’s faulty wiring, electrical. And so, it was just really eye-opening to me to say, right, why aren’t people… Why aren’t we recommending people that every, I don’t know, five years, whatever interval, just to say, “I’m going to get an expert, and they’re going to look for, well, moisture, they’re going to look for heat escape, they’re going to get on my roof and talk about the type of shingles I have.”

For example, there’s impact resistant shingles. And for, call it some strange reason in Canada, the shingles don’t get labeled as such like they do in the United States. But in these guides, there’s a way to determine if your shingles are impact resistant. And if anyone’s listening, and I’m sure a lot have had this happen, where a hailstorm comes in and the roof is completely damaged. If you knew that, “The shingles I purchased were able to withstand hail the size of a golf ball,” I think a lot of people would sleep better knowing. And so, this actually walks you through how to determine which shingles have been tested and literally what size of hail can they take, which I found quite interesting.

Paul Martin:

It is interesting. And you were saying earlier, and sort of smiled when you said that, in the insurance industry, water is a big issue, and you’re thinking of flooding mostly, but what came to mind to me was hard water called hail. We hear a lot about that around here. And I mean, we’re not prone to things like, well, hurricanes, which are more around oceans and that kind of stuff, but we still get mighty good wind, and we get mighty good hail and that kind of stuff. We’re probably a bit of a hail capital in this part of the world, I would think, so likely that pops up quite frequently.

Colin Rooke:

Yeah, it’s funny, you mentioned hail and wind, so had I not gone through this conference… So traditionally, you look at a flat roof, particularly a flat roof, and I’ve done this for 10 years, and you say, “Okay, well, flat roof is more prone to hail damage.” So you want the higher arc because of the glancing blows, which, I’ve told people that, but then, if you don’t factor in… But that only occurs if there’s no wind. In high winds, 70, you know, like 30, 40, 50 kilometer winds, the flat roof is good because now the flat roof is getting the glancing blows and the steep roof is standing out like a brick wall.

Paul Martin:

It’s the flat surface when the hail’s coming in sideways.

Colin Rooke:

Yeah, it is the flat surface. And again, for someone that spends a lot of their free time, evenings and weekends learning about risk management to say… I’ve been telling people on the homeowner’s side, or certainly, what I’ve been saying is accurate, but not entirely accurate, you have to factor in wind. And so, these guides are just really great for opening your eyes, and if you’re interested in stats, you know, where’s the most hail damage occurring and how often, and is it getting better in the magnitude of storms? It’s just, it’s very good homeowner’s information.

Paul Martin:

All right, Colin, we’ve got to take a little break, but I’m really fascinated by this so we’ll come back and pick this up after we take a short break for some commercial messages. You’re listening to Risky Business: Commercial Insurance with Butler Byers. Back after this.

Welcome back to Risky Business: Commercial Insurance with Butler Byers. I’m Paul Martin, and joining me, Colin Rooke, commercial risk reduction specialist with Butler Byers. Colin, before the break, we were talking about that thing we learned in high school that we were pretty sure we would never use, which is the angle of incidents equal to the angle of whatever it is, just that sometimes, our conventional wisdom isn’t necessarily 100% accurate. But we’re finding out about things like, is a flat roof better than one with a pitch on it, and that kind of stuff. What else were you finding about stuff that surprised you when you looked at these tips and ideas for protecting your home?

Colin Rooke:

I find it all surprising, and I think it’s just, it’s great. It’s just great reminder stuff, or it might be things that you thought you knew or you did know, and you go through this and you say, “That makes a lot of sense.” Like for example, when looking at landscaping, it’s better to have deciduous trees, like leafy trees that shed seasonally, when you’re worried about heat loss, extreme heat, extreme cooling. So in the summer, you’ve got these, of course, giant leafy trees shading your house. And there’s a guide about how much shade you should sort of be after, the distance from the home, the angles, that sort of thing.

But then, when you say, “Okay, so then, in the winter, they lose those leaves and you can heat the home using the sun, which is lower.” And there’s tips and tricks on the type of window and the type of window coverings. But then furthermore, you read through this, and again, we’re just talking about heating and cooling now, and you say, “Okay, coniferous trees or hedges are good for sort of a wind break, but they’re neither good for shade or heating in the winter.” But also, they’re terrible when you’re worried about fire, wildfire. And so, they’re way more likely to go up in flames than any sort of leafy tree, because they retain more water. And then you move on to, “Okay, well, how do I protect my home from wildfire or fire?” And they talk about how far an ember can travel, but they also say, “Okay, well, if an ember travels three kilometers in the wind and hits a deciduous tree, it probably will not light that tree, whereas a coniferous tree, it certainly will.”

So again, you think of… Well, they use a lot of examples of the homes in Fort McMurray, and really in-depth examples. And there’s these yards where every single home around it had burned, and then you’ve got this perfectly maintained home that had no damage whatsoever. And you think, “Well, how the heck did that happen? It must have been a perfect storm.” And Noel, he walks us through that example and says, “This had to do with the trees in the yard, the landscaping use. Like, for example, I am a fan of wood mulch. I have a lot of it. It’s not a great idea. And a lot of people have wood mulch trails right to their home. That’s not smart.” And so you just, when you walk through these examples and you realize like, “Yeah, had I thought about this at all from a risk management perspective, I probably would not have made a paper trail of wood straight to the shed attached to the home.” And so, it’s just really eye-opening.

And we talked about… I think people love walkout basements. I mean, they’re horrible from a loss control perspective, water issues, but there are things you can do about it if you find yourself in a walkout today. And so, I just think that, for anyone looking to learn more, or if there’s just something that keeps you up at night, whether you’re out, you’ve got a cabin somewhere and you’re worried about wildfire, reach out to us. Again, I worry about water all the time. We talk about sun pumps and backflow valves, but I’ve got a guide that explains backflow valves, finally, at a level where I can truly understand exactly how they work. I know it’s a great risk management tool, but this talks about the installation process and how the different sewer systems work. And so, if you have any questions, or you really like to sort of nerd out on risk management like I do, I can really help, depending on what you’re worried about.

Paul Martin:

Well, I’m fascinated by your idea of getting a home inspector in just to give it a once-over, and your observation that, you know, “Why would you do this when you’re selling it?” Because the buyer wants you to do it. I mean, the buyer obviously has an interest in this, but pretend you’re buying your own house right now and go do an inspection, right? You’re about to live in it for the rest of the time you’re about to live in it, so why not just conduct yourself that way? It’s a very interesting concept. And you’ll find some pretty cool things, probably.

Colin Rooke:

Well, and another sort of interesting point is with… So for some reason, the value of the goods in basements is continuously increasing at a higher rate than the value of the goods upstairs, meaning people are putting the good stuff in the basement. And so, the challenge there, from a loss control perspective, every inspector would say, and certainly this presenter would say, “You want the good stuff as high up in the air as possible to avoid water,” but on the home inspection side, if you’re going to put all your expensive stuff, your antique, your collectible cards, your pinball table, build your man cave, so to speak, down there, don’t you want to know right now if you’ve got cracks in the foundation or water pooling outside that you’re completely unaware of so you’re not in a position where, after heavy rainfall, snowmelt, you realize that two thirds of the value of your house is wet or, heaven forbid, covered in sewage?

Paul Martin:

That’s an interesting point. I hadn’t thought about sort of the value per floor in your house of the goods that we accumulate. And I guess, back to your original point, when you said you were surprised at what you learned at this thing, and those kinds of observations are the surprising things that you learn when you check this thing out. It’s really quite interesting. And we’ve got maybe a minute left, Colin, and you talked water, water all the time. And I thought, “What about downspouts?” I mean, those things are always plugging, filled with leaves, I mean, all that stuff. They’re kind of a problem all the time. Are there any thoughts on that?

Colin Rooke:

Yeah, absolutely. From a cosmetic perspective, for example, the downspouts that go right into the weeping tile look great, but it’s, frankly, a horrible idea from a water control perspective. If the weeping tile fails, collapses, or just gets overrun, or the sewage system gets overrun, you have no choice but to pump water down into the foundation. And so, the main takeaway from this presentation was, if you have those, get rid of them immediately. Do you want a cosmetically pleasing home that’s got six feet of water in it, or do you want a couple of downspouts moving the water at least six feet away from the foundation? And I will say that the basement value comment, I got that right. If my basement was flooded, I’ll be okay. Everything is high up. And so, I didn’t miss that one, but I’ve often done that. I don’t have downspouts that are neatly tucked away, and it’s always annoyed me. And now I feel just a little bit better about these spouts reaching out across my yard. But again, it’s just great information. It’s just things that, if you really thought about, you maybe could have caught onto, but good refresher.

Paul Martin:

Colin, as always, very interesting information. I want to thank you for that. You’re listening to Colin Rooke, commercial risk reduction specialist with Butler Byers. This is Risky Business. I’m Paul Martin. Thanks for joining us.

State of the Cyber Market

Home • (Page 7)

Paul Martin and Colin Rooke discuss the issue of cyber crime and ransomware as the 2021 assessments roll in.

Listen to the full episode here, or read the full transcript below.

Paul Martin:

Welcome to Risky Business Commercial Insurance with Butler Buyers. This is Paul Martin. And my guest today joining me as always, Colin Rooke, commercial risk reduction specialist at Butler Buyers. Colin we’re going to go back to a topic that well, we haven’t touched for a while. But it was a pretty common theme for us in 2021. And that’s this issue of cyber crime. And it’s been pushed off the headlines a little bit by other events that have been going on, but it never really went away. And now here we are pretty much the end of Q1 of 2022. So we’re starting to get the assessments of what last year looked like. And we now got the numbers on this issue of ransomware and cyber crime, and all of that. And all of a sudden we’re talking about it again, because guess what the numbers are in, and they’re really noteworthy. And what did we see last year, with companies being attacked on electronically and digitally? And what’s the insurance industry’s perspective on this?

Colin Rooke:

Yeah so, good lead up. So now that 2021 is finalized, I can report that roughly a quarter of all Canadian businesses experienced some cyber attack last year. To make matters worse, and this will lead into the topic of this show. Of those businesses that experienced some ransom demand ransomware, 56% paid the ransom. And so I want to talk about why that’s happening, what’s going on. Dispel some of the myths about well, is this growing because more businesses are buying it. Talk about again, what’s causing these ransoms, and then what you can do about it. And lastly, how this is impacting the insurance markets. And how they are addressing this, and how their stance has changed very specific to ransomware or cyber extortion.

Paul Martin:

Well I guess insurance companies are at the end of the day, not in the business of paying out claims. They end up doing it as a course of business, but it’s not their mission, or their ambition is to go out and pay out claims. So when they start to see a category of claims going up, I would assume they respond. They look at it and say, hang on. What are we doing here? And probably starts with a process of making it harder to get. Secondly after that then raising deductibles, and eventually just taking it off the table. Am I even close to what the process looks like?

Colin Rooke:

Yeah, exactly. We’re getting very close to the taking it off the table. Cyber Liability Insurance is still fairly attainable. However, where underwriters and insurers are getting a lot stickier, is cyber extortion or ransomware. And so within the policy now, we are seeing decreased limits. So it’s now not uncommon that the max payable might be 25% of your overall limit liability, which was never the case before. Depending on any third party scan, or work done on your system. They might say you know what, there’s so many vulnerabilities here. We’re not going to offer it all together. So they have the ability to offer it, and they’re saying we won’t. And then there’s other insurers that are saying, we’re not going to get out of the space. But all we’re doing is paying for ransomware, so we’re not offering it. We want to be a player in cyber liability, but we’re not going to offer that coverage whatsoever.

And others are waiting around to see okay, if we are known for not offering ransomware, or sorry extortion coverage, will that impact the likelihood of our customers receiving ransomware? So the insurance company says, well if we are known for not offering it, and the hackers or criminals are able to determine who our policy holders are, are they going to leave them alone? And that is proving also not to be the case. It doesn’t matter if they think you have it or not. There’s really no deterrent. But from the industry perspective, it’s a ginormous lost leader.

Paul Martin:

That sounds ominous I think in the sense of, there’s been a lot of comfort drawn by business owners, and those who run companies. That been drawn from the fact that they could get this insurance, and that it was always this backstop. Now you’re saying that pardon upon insurance policy may well disappear, that it might not be available anymore. And that takes you to the position of okay, then what? What’s my next step after that? How do business managers, business owners protect themselves? What do you do with this thing?

Colin Rooke:

You have to put the work in. So the issue is 53% of all attacks on Canadian business, were caused by an individual working in that business. So you could look at that and say, 53% of all the activity was human error. And so the industry says we… And of course we talk about this all the time, but we have to get better. Our customer have to get better. We’ve got to start talking about this. We’ve got to start educating. We have to understand what a cyber threat is. We have to have an internal policy. We’ve got to work on incident response planning.

In my opinion I’ll say, it’s not that we’re going to get to the point where it’s not available. But they’re going to limit who gets it. And they’re going to reserve it for the businesses that understand. That are taking the recommendations from whether it’s their IT provider, or the insurance industry third party audits, or all of them. And they’re saying okay, if we wrote out a wish list of what we want all of our clients to have, those that get a 100% scorecard, we’re going to offer it any deviation from that. It’s going to be a no.

And to take it a step further, we end up talking about multifactor authentication all the time now. And cyber insurers are demanding it, even if you have absolutely no need. So you don’t have anyone logging in remotely as an example. There’s no access to the server, or the system through your phone. And they’re saying, we don’t care. You got to have it anyway. Even if that’s not the case, we just need you to have it.

Paul Martin:

It’s a funny thing about how sometimes the insurance industry is the leader in dragging people along. They are the ones at the pointing end of the stick, if I can put it that way. In terms of feeling the impact of the conduct of these cyber criminals. So they’re the ones that are most vehement about, here’s the steps you’ve got to take, and by the way if you don’t I can’t do business with you.

Colin Rooke:

Exactly. And I feel like I say this all the time, but some of the recommendations that we were reviewing two or three years ago, went from a recommendation, to best in class, to now a requirement. And then those recommendations are evolving. And at a high level when you talk about IT, if you don’t view your IT provider as a strategic partner in your business, and the IT space as a necessary investment. No different than locking doors on your office. If you don’t have that view that they are so important to how we operate, and what… I don’t want to say whatever they say will do, but again if you don’t have that level of confidence where they are that valued advisor, you’re going to find yourself in this group.

That’s going to have ransom, or paying the ransom, or not being able to get proper coverage. And again it’s not a matter of we’ll call in. What if I throw up a big deductible, they’re going to take it. No they’re not. It’s not a deductible issue. The payouts are growing in frequency and severity. And we are starting to see the insurance market take a stand on extortion coverage.

Paul Martin:

Right. This is an interesting topic, and right in your kitchen if you’re running a business. So I want to continue with this, but we got to take a little break. You’re listening to Risky Business Commercial Insurance with Butler Buyers. I’m Paul Martin, back after this.

Welcome back to Risky Business Commercial Insurance with Butler Buyers. This is Paul Martin. And joining me Colin Rooke, commercial risk reduction specialist with Butler Buyers. And just before the break, we were talking about the severity of claims, and the severity of demands being made by the cyber kidnappers if you want to call them that, the extortionist. That the frequencies going up, the values are going up. Insurance companies are saying whoa, I don’t know if I want to play this anymore. All right. So what does the business owner do? That’s the question. You can acknowledge all of this stuff, but say all right then what? So if someone calls you up and says, help me with this, saying what’s first steps on this one?

Colin Rooke:

Yeah, good point. You’re right. I don’t want to just leave it all as doom and gloom, and then hand out the show. But at minimum, at absolute minimum, and this is not something new. It’s something that has evolved over time for us. But I’m sure we talked about our cyber risk scorecard five, six years ago. But if you just did that, it’s something that you can reach out to us. Request it, it’s self scoring. There’s no risk of well this is rigged, and whatever my answer’s going to be. It explains before you go in, what’s a yes, what’s a no, what’s an unsure. But so you can go through this risk assessment. It’s going to tell you, are you a target, do you have stuff that someone wants or not. But also the scorecard Excel… the scorecard itself, there’s 20 questions on there. But they’re all designed to spark conversation. Whether you have a yes or a no, these are all big ticket items.

And so you’re able to work through that, and really think are we exposed? Have we done this? Why aren’t we doing this? We’ve talked about this. That sort of thing. That would be the first step. Now I don’t want to suggest that if you fill out the score card, and it says your risk is low, you don’t need any protection. That needs to be determined later on. But it will certainly let you know, at a high level where you fit. From there we are also able to do system scans that by… They’re done by a third party, not by Butler Buyers. That will say, okay we’ve done this first step. And now we can look for known vulnerabilities, and we can also rank any class of business where they fit within their peers. The likelihood of breach, the average cost across all different lines.

And spoiler alert, ransomware is always the highest by five to tenfold in these claims examples. But it lets you know where you fit, based on how your system set up today. Where you fit among your peers, where you fit among Canada. And also how this could impact you. And it’s a very detailed report. And then we can take it a step further. And it’s something that I believe every business should have, is a proper incidence response plan. Regardless of coverage, what are you going to do when you find yourself locked out? When you find yourself with a ransom. If your answer is well, I’ll just call my IT department, you’re in big trouble.

Paul Martin:

Yeah. And we tend to talk about this in the context of, it’s simply an isolated event. It’s behind your closed doors, inside your business. And work your way through it. Now this has an impact on customers, it has an impact all the way down the chain. I think about a pretty well known one in Saskatchewan. I think it was Christmas day or something. The SLGA, the Liquor Board got hit. And I remember talking with some of their staff the morning after. Customers came in, they were actually handwriting the sale down on a piece of paper. That’s how debilitated it was. And so if you’re in business, sometimes it means you’re not in business the next day, because you’ve got too many problems to deal with.

Colin Rooke:

Yeah, absolutely. And just back to the coverage question. If extortion is excluded on your cyber polls, usually the perks that go with it are removed as well. Which would mean business interruption, so lost revenue as a result of that breach. So it’s something they could really think about. But great example. And I do not want to suggest that if you have a breach, you wouldn’t call your IT provider. Obviously they’re going to play an integral role in getting you back up to speed. But it’s all those other components.

What do we tell our customers? What do we tell our staff? Do we need help from a PR firm? How bad is this thing? In the event of ransomware, who’s going to help? Are we just going to pay it? Are we going to put in a claim? Are we going to hire a negotiator? Do we need a forensic analysis to help us out? And so it’s answering all those questions in advance, and really sorting out the true cost of a breach. And knowing whether or not, is it $10,000 a day in lost revenue? Could it be a 100,000 a day, 500,000? Understanding the full impact of downtime, and also the social consequences of that breach.

Paul Martin:

This is a little bit off the topic, but as we are having this conversation here today, there is currently a war in Eastern Europe. And one of the participants the Russians are famous for being active, extremely active in the cyber attack world. They look at the West now a country like Canada, which is sending supplies to the enemy. Does that ramp up that this is… We’re at war now. And this is one of the battlefields that will be played, is that this will… The Russians may not be doing well militarily, but they certainly are doing it well in this front. And will they just amp up their activity? And in fact business owners need to understand, if your nation is a Quasi participant in a war, you’re a target. And they’re elevating. They’re going to stop targeting companies in Africa, they’re coming after us. Are we actually liable to be more subject to these attacks going forward?

Colin Rooke:

Yeah very good point, and I was hoping we had time to briefly discuss. But Putin has promised increased cyber activity. And the articles are all suggesting, where is it? I would argue that it’s coming, they’re planning it out. If it’s anticipated today, then we’re going to ramp up security and watch more closely. But you look at the economic sanctions that the world has imposed on Russia, while he’s got to pay for this war somewhere. And cyber crime is big business. And he’s made outward threats saying, we’re going to ramp this up. I believe that we are going to see a significant increase in the frequency, and severity of cyber crime in the future.

Paul Martin:

Really this would serve as a warning to any business owners that are listening to this. Is that the war we’re not necessarily isolated from this, and that the war can be brought to our doorstep in a digital wage. And whether you like it or not, you may well be a participant in this, and you’re certainly more of a target now. So if for no other reason than that, get ahold of Colin and his team at Butler Buyers. They have this free scorecard. They’ll allow you to walk through, and you can self test yourself. And see whether or not you’re a high risk, or a low risk, or you need to do some work on it. Colin, we run out of time on this one, but we’re talking about pretty serious stuff here. So and encourage anyone to reach out to you, and you’d be quite pleased to entertain a call I’m sure.

Colin Rooke:

Thanks Paul.

Paul Martin:

You’ve been listening to Colin Rooke, commercial risk reduction specialist with Butler Buyers. I’m Paul Martin. You’re listening to Risky Business. Thanks for Joining us, talk to you next time.