All About Snow

Home • (Page 9)

With the season upon us, Paul Martin & Colin Rooke discuss all about snow, ice damming and insurance.

RiskyBusiness · Butler Byers Risky Business – All About Snow

Listen to the full episode here, or read the full transcript below.

Paul Martin:

Okay. Welcome to Risky Business. Commercial insurance with Butler Byers. This is Paul Martin, the host of the show and the business commentator here on CKOM. And joining me today, Colin Rooke, commercial risk reduction specialist in the world of insurance. And of course, he’s one of the guru, big, big shot guys over at Butler Byers.

Colin, we dedicate a lot of energy, effort and focus in this program to, hey, business person, there’s a new thing coming out that you need to be watching. But new and emerging risks are always, I guess, interesting. We always like to hear about things that are new. But, in point of fact, all the stuff that we would’ve covered two or three years ago are just more mundane things.

The whole world isn’t all about new. There’s changes coming to old stuff too. That’s what I want to talk about today. And I guess seasonality is upon us. We’re starting to see the first bits of snow this year and I just was curious. I mean, how does the insurance industry look at snow and is it something we need to be talking about?

Colin Rooke:

So, the insurance industry’s stance on snow is they don’t like it.

Paul Martin:

Straight, simple. And when you’re a buyer of insurance and the insurance company doesn’t like it, there’s usually a message implicit in all of that.

Colin Rooke:

Right. The insurance company would prefer you say, no, thank you, to snow at a high level. It’s a big deal and actually it’s getting worse. And I’m not even talking really about global climate change. However, for some reason, ice damming in the last 10 years is turned into a thing and really it wasn’t happening the 50 years prior.

I mean, 2011, 2012, there’s a lot of ice damming claims and all the adjusters had to attend these conferences just to learn what it is, what it does, how to adjust for it. And even the policy wordings, there’s all this controversy as to whether or not it’s covered. And from there, and I think that’s the catalyst, it’s really changed the whole insurance industry’s stance on snow.

So, if you’re in the snow removal business, or know anyone that is, or your broker’s doing their job and asking you either as a business owner or as someone that’s leasing a space, if you’re doing your own snow removal, which isn’t often the case that question’s asked, it is a big deal to insurance companies. Well, there’s the slip-and-trip side of things, but on top of that, it’s damage to roofs.

So you have people saying, well, I know what ice damming is and I don’t want that. So I’m going to try and scrape my own roof. And you’re doing $40,000 worth of damage trying to get the snow off, to save a couple thousand dollars’ worth of potential damage because you’re not trained. You know the snow shouldn’t be there but you’re not exactly trained to remove it properly.

On top of that, you look at commercial buildings and you’ve got people again, whether the roof, whether just the premises itself, we got increased prevalence of injury. And then you’ve got these half million, three quarter of a million dollar roofs being completely damaged by, call it volunteers or untrained individuals, trying to get the snow off.

And so it’s just completely rocked the industry to the point where the actual professionals are paying just jaw dropping increases on the liability portion of their policy, all because of how much damage is being done by individuals, for the most part, around this idea of clearing snow, being helpful, trying to look after their own building. And in doing that, essentially ruining it.

Paul Martin:

Who would’ve thought that snow would be becoming such a factor in all of this, and in a way the enemy of building owners. And I guess this applies to, if I heard you correctly, I mean, we don’t usually talk about home insurance that much here, but this is as much a residential issue as it is a commercial one.

Colin Rooke:

Yeah, it is. And we don’t really talk about home insurance. However, because of the prevalence of the problem, we have a guide for how to treat your home in the winter because you’ve got individuals doing what they think is right, which ends up actually doing what isn’t okay.

Now, I’m not saying don’t buy one of those long rakes and pull some of the snow off your roof. But then when you have people up on the roof with a shovel, for example, damaging shingles because they want to get right down to it, that can turn into a big deal. And so, for any homeowner listening, we’ve got a guide that not only helps you deal with snow, but it talks about what you should do, for example, if a storm is coming.

Real world practical advice how you can mitigate as much risk as possible, if there’s snow, if there’s freezing rain. When the big snowfall comes, if there’s a blizzard, all that stuff. It says, okay, the best you can do to mitigate, follow these steps. And so, we’ve expanded on the commercial side and said, we can help a lot of individuals with this information as well.

Paul Martin:

It’s interesting because it takes us back to a theme. It’s a theme that we’ve talked about repeatedly and really underlying all of this. I mean, you provide a whole pile of information to business owners or to people charged with managing businesses. And in a way they would feel like, well, that Colin’s selling me something here. And really what you’re saying is, listen, it’s the other way around.

It’s, I’m going to give you information that will make you look like a better customer, a better prospective customer to the insurance industry. It’s a novel concept of, we spend a lot of time trying to be really good to our customers, but do we ever think about the reverse of how do we become a better customer of any of our suppliers and insurance being one of them. And you’re giving me some hints here on how either people in business or just people on their personal side of their life can become a better customer of the insurance industry. And if they do that, then what? I mean, what does that mean? How do the insurance industry look at it?

Colin Rooke:

If you get enough people working on risk mitigation, it’s going to drive overall premiums down. But what a lot of people don’t consider too, is built into almost every home insurance policy, if you’ve gone claims free, is a claims free discount. And just losing that discount alone in the event of a claim can… If you’ve had it for a long time you don’t realize what you would be paying until it’s gone. And then suddenly you’re paying the full rate, and maybe a little more because of the claim. And it can end up being a pretty shocking year-over-year increase.

And you mentioned, just again, being a better customer. So, for any landscape company or snow removal firm that’s saying, look, I know how to clean a roof properly. Colin doesn’t have to come on this show and tell me that snow is a problem. That’s right. I’m not going to argue you don’t know what you’re doing.

But for example, when you prep a job site, before you start the snow removal, do you have a checklist that is followed, or even at a high level, that the company follows, that you could send to someone like me that I can share with an underwriter who thinks you’re high risk, you’re going to ruin roofs. People are going to slip and break hips and we’re going to be out tens of millions of dollars in liability claims.

Do you have a checklist? And is that checklist being passed on and explained to shed your company in a better light? And that’s the real point here. It’s not that business owners don’t know their craft, it’s how are we documenting and sharing that information to prove that you do.

Paul Martin:

It’s like having a safety manual at work. Well, listen, we’ve got to take a little break. We’ll come back. I want to pick this up, this whole notion of a checklist. So you’re, I think providing some really interesting insights today that go beyond what we would normally talk about.

You’re listening to Colin Rooke, commercial risk reduction specialist with Butler Byers. This is Risky Business. Back after this.

Welcome back to Risky Business. Commercial insurance with Butler Byers. Paul Martin here. And joining me, Colin Rooke, our expert in this area. And Colin, we were talking just before the break about the importance of not just knowing how to do things, but it’s actually documenting them. And man, if there’s anything I hate doing, it’s tracking that stuff and writing it all down. But you’re saying it is money and time well spent, because you’ll save money at the other end.

Colin Rooke:

Yeah. And I don’t like it either, which is why we make it easy. And again, back to some of these checklists or manuals. I mean, they’re deliberately written so you can review what we’ve done, nip and tuck, and there you have the manual.

These checklists, I mean, depending on the job you might say, look, before we start a major project, we just want to rip through this checklist each and every time. Or maybe you share it again at the company level. Or at bare minimum, fill it out and discuss it. And again, we have these checklists and manuals for so many industries, and when you go through them it just seems like some of these questions are just assumed, right? Like, I can’t believe you’re asking me this question.

So for a firm that specialize in snow removal, do you have a cleanup procedure at the end of the shift? It’s like, of course we do. We put our equipment away. We haul it back to the next job and we start working. But what’s crazy, and what I’m trying to stress, is your underwriter doesn’t know that. So they assume you have nothing, and it’s helter-skelter, and they just, you don’t even know what you’re doing from job to job.

What do you do if snow begins to melt? Are there hoses and pumps available for what water removal? Again, I wouldn’t have lasted in this business this long if I didn’t have some contingency for water. But again, these are questions that they don’t know the answer to. Or they need to know, and the reason they need to know is because of claims.

So every underwriter’s going to say, Colin, you tell me that now, but two years ago, such and such claim came in and they had no policy for this. They didn’t own any hoses. Therefore, ice started to melt and we had a $1.3 million flood in a commercial building. And so-

Paul Martin:

Sorry, Colin, I’m just guessing too. The thought that’s crossing my mind is most of these policy ratings are set up on a national basis, I would assume. And you don’t have to live in Canada very long to know that the snow they get in Ontario, Quebec is different than the snow they get in Alberta and Saskatchewan. But I’m guessing that we get rated with that heavy, wet snow from the east, because it’s all factored into a national pricing policy. And the question I would ask a homeowner or a business owner, is how well do you know the snow in Ontario? Because that’s how you’re being rated in Saskatchewan.

Colin Rooke:

Yes, you are a 100% correct. Anyone that’s in Saskatchewan knows that if you forget to shovel your driveway and you’ve driven over it a few times. I mean, it comes out in two-inch blocks and those sit on your lawn for the next two months, they don’t do anything. Whereas in Ontario there’s a lot of wet snow, melting, freezing, more thaw, more wet snow. And so they’re assuming that, okay, well, in Saskatchewan, Manitoba especially, it’s the same problem, just magnified by 20.

And so, again, you just cannot assume that the underwriter in Toronto, or Vancouver for that matter, has any idea what it’s like to be here. In fact, most have never been to Saskatchewan and may never. And so again, it’s about documentation. And you cannot assume that, well, they know what it’s like. I mean, yes, we’ve got local markets here that may do a better job, but again, you need to document, you need to spell that stuff out. Or someone’s clicking no on a box that should be yes, which is going to impact your pricing.

Paul Martin:

If you’re just joining us on this program today, you’re listening to Colin Rooke with Butler Byers and we’re talking about risk mitigation in the commercial insurance world. And we’re talking about snow and your roof and who would’ve thought that.

But Colin, I was really taken by your comment that in the insurance world, snow is a big thing. Really, probably doesn’t go through most people’s mind. Hey, snow happens every year. I mean, what’s the big deal. No, it is a big deal.

Colin Rooke:

Yeah, it is. It’s a rising cause of, in particular liability claims, and it’s getting worse. It’s not quite as bad as cyber but certainly a hot topic. And so whether you’re in commercial or personal lines, we’ve got a lot of documentation and checklists and procedure manuals that are designed to help, not only the end user, but help us explain your approach to snow.

Paul Martin:

That’s what I wanted to get into. You’re always on this program talking about your step-by-step lists, your risk mitigation programs, your checklists, just basic educational, informational material that’s available to anybody. And they can just dial you up, you’ll send it to them. But do you have checklists for getting ready for winter?

Colin Rooke:

Yeah, absolutely. And something that would come up in a risk reduction workshop would be, how do you handle snow? Do you take care of it yourself, or do you hire a third party? And it’s easy to say, well, Colin, I’m a manufacturing facility, let’s stick to employee engagement and leave. And we have to cover these bases because it’s a big exposure.

And if we don’t know your approach to snow removal and you’re doing it yourself, and there is damage, there is a high likelihood that you will not receive any compensation for that. And so, it’s got to be addressed. And frankly, we in almost all cases, push our clients to outsource that because of the inherent risk.

Paul Martin:

Well, in going through the background material you gave me in preparation for this program, and in one of the things that caught my attention was, there is actually a policy for getting your car out of a snow bank if you get stuck. You have a vehicle extraction policy. I mean, I defy any business owner in Saskatchewan to show me their written copy of their vehicle extraction policy.

Colin Rooke:

I personally have not ran into a company that has this and you think, well, why do I? Well, again, it’s about showing that you are thinking of everything from a risk mitigation perspective in that, in the event someone goes off the road or can’t get out, you have a document that says what to do, so you don’t do something foolish and cause either damage to yourself, the vehicle, or others.

And in the event that, and accidents do happen, we can show that you did your due diligence. You did what a reasonable person would do to prevent this, which goes a long way when we are trying to explain why there’s a sizeable claim on the file. We can say, look, they did everything they could have, including, they have a vehicle extraction policy.

And sometimes things don’t go well and damage happens. And not that I’m going to go through this vehicle extraction policy line by line but it even says, when you need help, these are the approved third party providers that we want you to call in the event you are stuck. So you don’t get your buddy with some chains, because you don’t want to tell the boss that you’re stuck in some snow.

You have a manual that says, you are to call one of these three businesses. You are authorized to call them. We will not be upset if you did. We want our truck out safely by a professional, not the guy that pulls over that wants to help, but isn’t trained, and certainly isn’t going to foot the bill for any damage.

Paul Martin:

Colin, I think that we have to wind it up here as we’re out of time, but I think it would be a great challenge to our listeners to say, call Colin, he’ll give you your vehicle extraction policy.

Colin Rooke:

Right.

Paul Martin:

Snow bank extraction policy. It’d be, if you need one, here’s one. So anyway, you’re listening to Colin Rooke, the commercial risk reduction specialist with Butler Byers, providing us with some insight on preparations for winter. Colin, thank you. And thank you to our listeners for joining us for Risky Business. Talk to you next time.

Conversations on Risk Management

Home • (Page 9)

Paul Martin and Colin Rooke discuss how to have a conversation about risk management before the paperwork.

RiskyBusiness · Butler Byers Risky Business – Conversations On Risk Management

Listen to the full episode here, or read the full transcript below.

Paul Martin:

Welcome to Risky Business Commercial Insurance with Butler Byers. This is Paul Martin, the host of this program. And you hear me as the business commentator on CKOM. And joining me, Colin Rooke, the Commercial Risk Reduction Specialist with Butler Byers. Colin, we have covered a lot of ground over the last few years as we’ve been doing this program, and here we are coming up towards the end of another calendar year, and those conversations come out of that. But before we get to it, it just struck me as we have covered a lot of ground here, and I think probably for some people who listen to this program, I think, hm, sometimes I’m not sure if I have a problem. I’m not sure what I don’t know. And also, sometimes I just don’t even know where to start on this stuff.

I know Colin talks about these step by step programs and filling out forms and stuff, but it doesn’t have to necessarily go that way, does it? You can sit down and just have a conversation as well as do the actual kind of pull out the paperwork process.

Colin Rooke:

Yeah. Absolutely. So, not everything that we do needs to always be a big project, meaning we have a lot of our … Certainly, our ongoing clients, and then we also have a lot of people that would just reach out and say, “I need help with this. You talk about risk management. You talk about helping business and I have this problem. Is there anything that you can help with?” And so, we spend a lot of time doing that.

You can be any size, but it doesn’t always have to be a large project. Sometimes, you run into a topic. It’s brought up. It’s brought forward to you. And you really don’t know where to start. It could be a work flow, for example. We consider that risk management as well. Now, we’re certainly going to put our own, I’ll call it, insurance-y flair to it. So, we’ll explain what it is, how to set yourself up, or how to follow the work flow, whether it’s return to work, that sort of thing, and then certainly we’re going to add the consequences of not doing this, maybe some claims example, talking about, again, your own liabilities, which I think is a good thing because no one else is going to present these topics in that type of light.

So, really good example. One of the shows that we’ve done recently was talking about if you have a Board of Directors, we had a very very involved assessment that we can do, we can walk the Board through, and you can grade yourself on our level of proactiveness, risk management.

However, each topic in that assessment will frankly bring us down a rabbit hole to dozens of other topics, and that’s what we’re after. We want to know at a high level how you’re thinking, and then we really want to dive in and say, “Okay, so this is an area where there hasn’t been as much understanding or attention to detail.” And certainly we’ll work on that, but what I want to, I guess, bring forward today is that would be for an established Board operating for some time, and now we’re at the point where we want to do a review of how it’s going.

But what if you’re forming a Board? What if you don’t know how to form a Board? You don’t know how to orient a new Board member, or maybe you have been, but you want some advice on the right way to do things. So maybe you have a Board. Certainly there is an orientation. We do invite new members, but really there’s nothing proceduralized about this. There’s nothing recorded. We can help with that also.

We can provide a work flow that says, “Here’s what you should do from a protecting your liability standpoint.” It walks you through exactly what to do and what not to do, every step, and if you just followed it, you’d be doing great. But then, we add in, “Here’s why you need to do this. Here’s why it’s so important, and here’s some examples of what happens if you didn’t do this and you were called to task or there was an incident.”

So, we explain the why. We explain the exposure. We explain the potential costs. But we also help you plan out the whole workflow, the whole, again, in this example, forming a Board or bringing in a new Board member. We can help you do that as well.

Paul Martin:

I’m curious. This seems more like the kind of stuff you’d hire consultants for, and you’re saying you just do this. To borrow a word from you, how is this insurancy?

Colin Rooke:

Yeah. It’s a really good example, and I certainly don’t want to say, “Don’t hire a consultant.” And you might need a consultant to go a lot deeper. We spend a lot of time working or finding other third party advisors that can help our clients if they need more. The reason this is an insurance question or issue is we’re telling you how to orient a Board member or form a Board because it’s very important that you do things a certain way. And if you miss certain steps, you can open yourself up for liability, which we will explain that, “Here’s why you should do it because it’s a best practice, but here’s why you need to do it from a protecting the Board standpoint.”

So, it’s advantageous to us. It’s advantageous to our clients. And it’s advantageous to an insurance company to say, “They have a step by step orientation package and they understand exactly why they need to follow this from a loss perspective because we’ve explained that to them.” And suddenly, the entity is better protected. We’ve done our job as risk managers and the insurers are happy.

Paul Martin:

It really is just the notion of, at the end of the day, this topic or kind of discovery point that we come back to, is that you do all this stuff properly. Run your business well. Insurance companies like that because you look like a better risk for them. You look like you’re going to make fewer claims and smaller ones if you make them.

Colin Rooke:

Yeah. Absolutely. And that’s what I’m trying to stress that it doesn’t always need to be the big project, or sort of the project that gets you over the hump. It might be from day one. For example, we’ve talked a lot about COVID and return to work procedures, what you can do and can’t do, the fact that we’ve got policies in place. But if you say, “Okay, well frankly the whole idea of return to work due to COVID is a little rich because I don’t have a return to work policy as it is, let alone bolting on the changes around COVID or hybrid work force.” And so again, you can hire consultants to help you do this, and I’m not saying don’t.

But we’ll help you understand why it’s important to the insurance company that you do this as well, and it is all part of our getting to know the clients, working with our customers, eliminating risk, having risk identified and quantified and working an ongoing plan.

Paul Martin:

It just strikes me that, if I go through this, and I’m making the assumption that I’m going to hire the consultant because that would provide me with good advice, but you’re really helping me figure out what questions to ask the various consultants about when I’m grading them.

Colin Rooke:

Yeah. Absolutely.

Paul Martin:

You’re giving me kind of a report card that I need to check all the boxes when I’m hiring this consultant.

Colin Rooke:

Yeah. I couldn’t have said that better, that we’re not trying to replace the consultant. It’s something that we’d say, “Look, this is what you need to have done. We’re not going to be the ones that do this for you. You are free to, or we can help you find that individual. However, this is why we need it, and these are the ramifications of sort of not doing it or ignoring the problem.”

Paul Martin:

Great. Colin, we’ve got to take a little break. We’ve reached the midpoint of the program. I can’t believe how fast it’s gone by, but you’re listening to Colin Rook, the Commercial Risk Reduction Specialist with Butler Byers. I’m Paul Martin. This is Risky Business. Back after this.

Welcome back to Risky Business Commercial Insurance with Butler Byers. Paul Martin here, your host. And talking with Colin Rooke, the Commercial Risk Reduction Specialist at Butler Byers about, well, I like to call him the librarian. He just is a place where you go with … He isn’t all the books, but he knows where all the books are. He’s really a very knowledgeable guy in terms of being able to guide, direct, and help.

And I think the point you’ve been trying to make in today’s program, Colin, is that this doesn’t need to be, as you called it, a big project. And sometimes, people just call up and ask a question. Right? Even small steps are good steps.

Colin Rooke:

Yeah. Absolutely. Another really sort of good example would be training around diversity and inclusion. Anyone can find that information. You can Google it. There’s a ton of literature, and certainly we have that as well. But again, when our clients ask us about, “Can you help with this?” There’s more of a flair to it. So, you can find your own research on the impacts of diversity and inclusion on an organization, and then we add in, sort of to that same sentence, what most wouldn’t consider is management liability.

So whether we bring it up or it’s brought up to us, it’s for the right reasons, and then we say, “In addition to that, here’s what could happen if you don’t do this. Here’s some examples of where it’s gone wrong.” And so, yes. Here are the impacts. Here’s what you can do. Here’s why you should hire someone to work with your organization. Here’s why you should change your policies and procedures. Here’s why you should be more aware and certainly educated.

But if you’re going to take this information and shelve it, here are a bunch of reasons why you might want to change your mind from a liability perspective, and we’ll walk our clients through that for almost any topic. And again, as you referenced, we’re not trying to replace the consultant, but this would certainly be something you want to make sure every item here gets covered because we are suggesting, “This is what the insurance markets want to see. This is a best practice.” Therefore when you find that help, you’re checking off all the right boxes and we have helped you do it.

And not specific to this topic, but there are a lot of conversations that go on in organizations or documentation, whether it’s a, well, employee safety manual or driver’s safety training. Yes, every organization wants to, for the most part, make sure their employees are safe and their cars aren’t bumping into others.

But a lot of it is driven by fear or the request of an insurance market. It is. You see it in the movies and it’s a real thing. And so again, if we can get ahead of that and say, “We’re already identifying. We’ve already identified it. We’ve quantified it. We’ve organized and prioritized it and we’re working the plan right now,” we get ahead of that. And so, when the question comes up, “Oh, we already knew about that. It’s already taken care of.” That’s the point of all this.

Paul Martin:

I’m assuming that it goes unsaid here, but this helps in worst case scenario. You need to make a legal defense. At least you can say, “Hey.” Point to a judge and say, “Look, here’s where we tried. We gave it our best efforts. We’re not ignorant on this. We actually took some steps.”

Colin Rooke:

Absolutely. The term negligence, of course, is used very frequently in our line of work. The difference between negligence and not is just what did you do. Did you make some kind of attempt or were your efforts reasonable? Did you put any effort? Was there due diligence done? And if we can say, “Look, bad things still happen. Things get missed. Accusations occur. But here’s what we’ve done to do our part to ensure it didn’t happen, doesn’t happen, doesn’t continue to happen.” We’ve documented all of that in the event that you are called to task.

We have worked together proactively, identified the problem, and have made some measure to address it.

Paul Martin:

You know Colin, some years ago, I took some governance training for the kind of stuff that Board of Directors participants or members would be taking, and one of the bits of advice we got from, I think it was a professor or something, from one of the Ontario universities who was speaking to us, and he just said, “Ask yourself this. I’ll pose this to all of the business owners and managers that are listening to us today. If you’re on the stand, how are you going to ask that question? What are you going to say if you’re on the stand?”

And I thought that was a very sobering kind of a question. It really made you think like, yeah, I can’t just give this short change or ignore it and pretend that I don’t know what’s going on because how are you going to answer that on the stand. You want to sound like you’re actually in control and in charge and ahead of the issue.

Colin Rooke:

It’s funny. I use that example all the time, and that’s what drives a lot of this. When called to task, what will you say you did or did not do? You can’t do everything, but could you make some attempt at all? And so, I use that phrasing all the time to say, “Look, it could be a matter of just circulating something and asking your employees to read it over and maybe you do that biannually,” but it’s the attempt. It’s the effort. It’s the thought that matters.

Paul Martin:

I’m going to take you back to where we started this conversation here today, and it was really sort of designed to speak to business owners in particular, business leaders, managers who might be scratching their heads and saying, “I think this Colin guy is onto something but I really don’t know where to start.” So, but what do you say to them when they ask you that question, or how should they be answering it in their own minds?

Colin Rooke:

That’s a good question. It all starts with a conversation about risk, learning the organization, learning where you’ve been, where you are now, and where you’re going and how we can help get you there. It really does just come down to, okay, let’s just chat. Let’s figure a few things out. I want to know how you think and we’ll go from there.

Paul Martin:

Yeah. Not particularly complicated, and don’t be afraid. Just send an email. Pick up the phone. Give you a call. Right? You or someone on your team.

Colin Rooke:

That’s right. If you have a question that you can’t find an answer, you want sort of the risk management flair to it, just ask it and we’ll get you what you need.

Paul Martin:

And that may include background information, just some general reading. Make yourself more knowledgeable about the topic. And funny thing happens once you start to gain some knowledge. You ask better questions.

Colin Rooke:

Yep. Absolutely.

Paul Martin:

And those questions are often asked of yourself, right?

Colin Rooke:

Yeah. Yeah. For sure.

Paul Martin:

Well listen Colin, this has been a very interesting conversation as always, so thank you for this. I just want to invite our listeners, those who are in business or in roles or responsibilities, even I think members of boards or not for profit boards and charities and this kind of stuff, these rules kind of apply to you too. So, just reach out. Give me a call and we’d be pleased to chat with them.

You’ve been listening to Colin Rooke, the Commercial Risk Reduction Specialist with Butler Byers. I’m Paul Martin. Thanks for joining us. This is Risky Business. Talk to you next time.

Cyber Risk Assessment

Home • (Page 9)

Paul Martin and Colin Rooke discuss the braoder and detailed aspect of IT and endpoints security.

RiskyBusiness · Butler Byers Risky business – Cyber Risk Assessment

Listen to the full episode here, or read the full transcript below.

Paul Martin:

Welcome to Risky Business, Commercial Insurance with Butler Buyers. This is Paul Martin, the host of this program, joining me, Colin Rooke, the commercial risk reduction specialist at Butler Buyers. And Colin is an expert in more fields of stuff than you just imagine. And Colin, I guess for the last few weeks, we’ve been talking on this program about cyber, and we’re not going to really depart it, but I realize now in our conversations that describing cybersecurity is really just too narrow. It’s really about IT.

It’s broader than just cyber and maybe you could help me understand that a little bit today. And I think from the business owner’s perspective, some of this stuff, if you’re not schooled in computer technology or technology in general, some of this stuff sounds a little like a foreign language or the classic “Wa waa waaa” thing from of the cartoons, but how does the average business owner know when they’re in good hands or in good shape? I mean, how do we even test whether we’re vulnerable or not vulnerable, or that we’re the easy, low hanging fruit or we’re actually complicated and the attackers would not be so worried about us?

Colin Rooke:

Yeah, really good point. So today, we’re not going to talk about cyber crime, the type of risk, the sort of increased prevalence, but more the piggyback on our previous show talking about sort of the IT side of things, endpoints security. You’re right, it’s really hard to know, are you a target class? Are you a vulnerable risk? And then even further, it’s hard to predict like, okay, for my type of business, if I am subject to ransomware, what kind of amounts are we talking? Is it a hundred million? If so, I guess I would just lock the door and leave or anything in between. And it’s important that our clients or anyone that’s thinking about IT and cybersecurity have some kind of idea that, okay, where do you rank among all business in Canada?

Where do you rank among your peers and then individually, how are you doing? And then even further, what does that mean? If someone says from a cybersecurity perspective, “You’re quite poor.” Well, how do you define that? And on the client side as well, as someone that has helped a lot of people fill out sort of the legacy insurance application for cyber liability coverage, it’s almost impossible, unless you are deeply, deeply involved in your company’s IT, it is really difficult to fill out. We find often we’re sort of re-asking, are you sure you meant to say this? And all of those things impact whether or not you’re going to, one; get the coverage at all, two; the limits offered and, three; the rates you’re going to ultimately pay.

And so what we’ve done and our clients and prospects find this very useful, and to anyone listening to this show, we have the ability now to go in and essentially do a risk assessment on the business itself, the way the IT is set up, all the systems you have in place and then further to that scan the dark web for any associated passwords, any vulnerabilities, any leaks you’re unaware of, any malware installed on your system. And it’s a detailed report that says what it is, how it’s affecting you, when you first got it, when it was removed, what site lost your information. And then even it will say, okay, where you rank in Canada among likelihood of having a claim? It’ll talk about where your individual IT stacks up across all your peers. And then further to that too, we’ll provide a lot of data around average claims, one in 10 year claims, one in a hundred year claims. And then it gets very specific around even types of claim like ransomware, for example, it’ll say you could expect an amount such as this.

Paul Martin:

You know, you raise really interesting point about just how, I think defenceless some people feel when they hear this topic come up and you say, “You can just do this analysis.” People just call you up and you say, “Yeah, we’ll do this for you.” Is it free? I mean, how do you handle that?

Colin Rooke:

Yeah, there’s no cost to do it. And you might say, “Well, one; why isn’t there? And then two; if it’s free, is there any value there?” And it is. I mean, we specialize in risk management and ideally we are working a risk management plan where there’s a combination of proactive work and then a strategy around coverages by way of the insurance program. Well, this allows us to one; have a deeper understanding of how our clients are set up, but it’s really impactful and when we’re talking purchase and placement of cyber liability, but also where we really need to put the work in. And this is a document that is designed where business owner, executive would go to their IT provider and not say, “You’ve done anything wrong.” That’s not the point of this report, but it helps identify what’s occurred in the past.

It helps identify leaks that your IT provider would have no idea even occurred. And then also passwords and emails that have been lost, due to known breaches that, again, really isn’t their job to follow. And so, this says, okay, we have this problem. And then the IT department or third party provider would look into it and would verify and say, “Yeah, you do. And let’s correct that. Let’s work on this together.” Now, from our purposes, then we can share, “Okay, just like our risk management plans, we’ve identified risk. And now we are working on risk.” And we can share the completion date. We can share all of that and say this client does not want cyber liability. They’re very concerned about cybersecurity and therefore we ran this report and they’re getting on addressing all of these topics.

Paul Martin:

You know, it’s almost scary though to think about this, that I can give you permission and you can get all this information. So I am assuming that you’re not the only one who can get it, so can the bad guys.

Colin Rooke:

Yeah. It’s pretty incredible how little information we need to develop a very, very in depth report and we do it in seconds. And so, if you set aside resources to deliberately go after a certain company, how easy it is to gather this information. I mean, if we can tell a business owner exactly how many email addresses they have, new and expired and where they’ve been, on what sites, I mean, there’s a lot of information here. It’s pretty shocking seeing this and then being able to sort of piece together what would be available with almost very, very little effort on the criminal side of IT, cybersecurity.

Paul Martin:

Colin, I want to pick this up in a minute. We got to take a little break, but we’re into something that, well, I would consider to be scary territory. So I don’t think we should treat it lightly. So let’s take a break. We’ll come back and we’ll pick it up. You’re listening to Colin Rooke the commercial risk reduction specialist with Butler Buyers. This is Risky Business back after this.

Welcome back to Risky Business, Commercial Insurance with Butler Buyers, Paul Martin, your host here and joining me, Colin Rooke, commercial risk reduction specialist with Butler buyers. Colin, just before the break we’re talking about, it’s almost sort of scary how much information is actually available out there. And I can’t help, but wonder, do people in Saskatchewan sometimes think, “Well, I’m not really a target. I’m a small business, I’m in a small town.” I mean, is a small town any form of protection in all of this? How do you answer that?

Colin Rooke:

Yeah, we get that a lot, frankly. And really the answer is the internet doesn’t care where you’re located. You’re just an IP address. And they’re not putting in that type of effort. They’re not flipping through a phone book and for trying to identify who’s who and where they are, it’s more of a blanket approach. And that’s why a security scan, like what I’m referencing is just so important. I mean, we’re able to say, “Look,” to a client, “You might not think you’re low risk, but the average ransomware in your, I’ll say successful ransomware attack in your industry is $881,000. Now, after doing your security scan though, you are in the 90th percentile, meaning not great. We want to be in the first, in this case. And so, therefore we can look deeper into the data and say with those, with poor security controls, the average would be quite a bit higher.”

So, we can really level the playing field and let our clients know this is where you truly fall to get a little more… To talk about how specific this report is, it scans every password and I’m not even sure how it does it, but again, just again, think about how easy it is to steal your password, because it can tell me how many people in your organization use lower case only passwords. It tells me. I know how many people in your organization just use numbers. I know how many people have weak passwords, medium passwords, strong passwords, because they do very simple loops that would be able to essentially open something part of the test. And so, I can say, “Look, your passwords are terrible as an organization and here’s the data. And it would take someone that actually wanted in seconds to do it. I mean, not even seconds anymore, they could buy a program on Amazon for nine bucks. And there you have it.”

Paul Martin:

I’m guessing that if this is this readily available, I mean you can provide a third party provider who’ll do this analysis. Now, when I am going to the insurance market and I am looking to get a policy, presumably the insurance companies are doing a similar sort of analysis on their own. I mean, if it’s available to me, it’s got to be available to them.

Colin Rooke:

Yeah, absolutely. You think of a lot of the major breaches. I mean, there’s breaches of course that, like the Yahoo breach, Equifax, Marriot, those sort of things. So, those are public, very public breaches and they’ve all published lists of emails that may be compromised. So, those are the mainstream breaches. Well, it’s really easy for anyone really to scan and say, “Okay. So, if the email address is at blank, blank, blank, we can throw that into the database and say, “Ooh, Marriott has 33 of those.”” But then furthermore, they know of all the breaches that don’t hit the media, thousands of them. And so, this goes a long way when we’re talking about, “Well, why is my premium so high? I mean, I’m just a small business. I don’t see what I’m doing or what kind of exposure.”

Well, they were able to ascertain in a matter of minutes that email addresses are all over the dark web or were involved in so many of these leaks that it’s a real big exposure. In fact, you’ve already been breached. They just really haven’t gotten around to doing anything with it yet. You’re probably in a long queue, but it’s coming at some point. Now, if you’re in that queue and you haven’t had a breach and we’re aware of this, we can close that loop working with your IT. But it’s very important that we’re able to identify these.

Paul Martin:

So, we’re back to that story, that is a kind of a repetitive one when you and I talk, is that at the end of the day doing all of this exercise, I mean, yes, we’re doing it. We’re talking about it in the context of making an application for insurance, but it goes beyond that. I mean, it just makes you a better company, whether we’re talking insurance or just general business operations.

Colin Rooke:

Yeah. I would agree. I mean, for example, if your only goal is to save a dollar two on insurance premiums or percentages, you’re looking at this the wrong way. If we do our assessments, say from an internet security standpoint, you’re terrible. Just think about the reputation risk, which we’ve talked quite a bit about on this show, in losing all your customer information. And in this case, it actually can tell us, like most companies can’t really figure out how many files they have, how many records they have, or even the types of records. And yet this can, so we can say, “Imagine if you lost all 23,000 files that they were able to come across and we’re now highlighting how poor the controls were. So someone gets around to working on your file for lack of better terms, they’re going to get in, you are going to lose this stuff and it is going to be a big deal.”

Paul Martin:

It’s one of those things where it’s hard to kind of think about, I can’t yell loud enough about this stuff, right?

Colin Rooke:

Yeah.

Paul Martin:

I mean, I can’t over-emphasize it and I’m sure that you run into resistance in the business community from people that say, “I don’t understand it. I think we’ve got it covered because I hired an IT guy.” That’s just sticking your head in the sand, isn’t it?

Colin Rooke:

You know, it is. And we spend a lot of time working with other IT providers and we often get credited with helping move things forward. Of course we will print this report and the first thing is you send it off to IT saying, “What’s going on here?” And of course the IT provider says, “Look, these are the 15 items that we’ve been telling you to address for seven years now.” And we have way of making it a lot more urgent or real. And so, I don’t want to suggest in any way that this is an IT issue, this is a company issue. And so, this just helps in making the case for why it’s so important, frankly, to take the advice your IT provider is giving you, it just makes it real.

And on the positive side too, we run across risks that are fantastic. Like we can say, “Geez, you’re in the second percentile. We can’t find anything.” And a lot of our clients will say, “Honestly, we take the advice of our IT provider and they just know so much more about this than we do. And so, we blindly follow and it looks like it’s really working well.” And so, there’s a lot of positives here too. I mean, we can validate all that work you’ve you’ve put in.

Paul Martin:

Colin, we got a half a minute left. So maybe just get you to circle back and just remind people that this is a service that’s available to anyone. All they need to do is reach out to you?

Colin Rooke:

Yeah. Just let me know, just reach out and say, “Can I get a cyber risk assessment?” And we’ll get it to you. It’s like I said, I need very, very little information. It’s almost scary how little I need.

Paul Martin:

And it’s free.

Colin Rooke:

Yeah. It’s absolutely free. Yep.

Paul Martin:

And no commitments, no strings attached. Just your community service?

Colin Rooke:

Yeah, exactly.

Paul Martin:

You have been listening to Colin Rooke, commercial risk reduction specialist with Butler Buyers. I’m Paul Martin. Thanks for joining us. This is Risky Business. Talk to you next time.

Library of Knowledge

Home • (Page 9)

Paul Martin and Colin Rooke discuss the wealth of knowledge, policies & procedure and stats that are used to help clients figure our how to deal with the risks they face.

RiskyBusiness · Butler Byers Risky Business – Library of Knowledge

Listen to the full episode here, or read the full transcript below.

Paul Martin:

Welcome to Risky Business, Commercial Insurance with Butler Buyers. This is Paul Martin, your host. And joining me today, Colin Rooke, the Commercial Risk Reduction Specialist at Butler buyers. And he is also really the Commercial Risk Reduction Specialist of the world. He’s the expert in this field and that’s probably the topic that I want to talk about today. We usually get into such specifics of, “Hey, this is something new that’s going on. There’s that going on?” Whether it’s cyber or, whatever, hard markets. But, I wanted to talk more generally about your approach to the way you look at helping clients figure out how to deal with the risks that they’re facing. But also how to bundle that up, package it, so it’s nice and presentable to provide to an insurance company and that you actually will get, not just a quote, but a good quote from an insurer, because you’ve told the story well.

But really, at the end of the day that’s your job. But one of the byproducts of all of this is this library of information that you guys have accumulated. You are all about tracking all of the latest stuff, and then you compile this information and make it available to business people. I bet you, not very many people know that, “Hey, if I got a question I could actually ask Colin, he would know.”

Colin Rooke:

Yeah, absolutely. For me to have enough data and information to do the show, we got to do a lot of behind the scenes research. And yeah, I mean, we’ve turned into this wealth of knowledge and policies and procedure and stats. And I just want to stress that, for anyone listening, if you have a question or feel there’s something you need. Is there a return to work policy or anything you’re struggling with, abuse policy, safety manuals and everything from newsletters.

So, a lot of the information that I’m sharing and discussions around new and emerging risk, it’s derived of course, from the information we take in. And so I’m more than happy to share that, changes to legislation around occupational health and safety. Reach out to us, to me and say, “We really haven’t visited this in a really long time. How can you get me up to speed?” Or, “What do I need to know, what changes have occurred in the last blank amount of weeks or months?” And we have all of that. In fact, we’ve got so much of it’s… I’ll sort of flip through the database and you almost forget just how much you have and how useful it would be to so many businesses out there.

So essentially, if you’re in an executive or leadership meeting, having a strat planning session and there’re areas where you feel you’re delinquent, and certainly we’ve talked about a lot of those documents on the show, but not even close to how many we would have. Reach out and just say, “Hey, this came up, do you have anything for this?” Chances are we do.

Paul Martin:

Well you know, just the amount of volume of stuff that we’ve talked about in this program over the last few years is astounding. And I think that we’ve probably just scratched the surface of the kind of volume of content that must pass over your desk. So you’re in a kind of a clearinghouse area. You’re seeing all this stuff, for those of us who are just running businesses and we A, don’t have access to that river of information that you’re applying all the time. And B, I don’t know if time to digest it and consume it. You will do all that for us and you’ve actually bundled up and you made it, oftentimes it’s a step by step guide or it’s an information piece, something like that?

Colin Rooke:

Yeah. I remember one of the first shows we did and we were talking about our risk reduction process and what are the stages and what do we do with that information? And is it all bad? We only focusing on the negative. And I remember saying, “No, we have this organization where 100%, they have a culture of safety,” and that was not getting communicated. And when we went through the process and developed the plan, the number one topic was safety.

This continuation of the culture of safety. Well, why would we do that when they put such a focus. Well, it is the primary focus of this company. They want to be known for safety. And so we work with them on an ongoing basis and we provide safety newsletters. And so, as we are going through our information, we flag things that we can send off and make it very easily to circulate. And it’s our efforts or our partnering with our clients to say, “This is what’s most important to you. And it’s most important that it continues. So let us provide. Let’s take the headache out of, having to search and sift through the information. We don’t do that. And we’ll get it to you.”

Paul Martin:

I’m just trying to think of something that might be kind of current, that we could use to spark the thought process a little bit. And I think about the way the world is evolving around work from home, and the fourth wave of getting bigger, especially around here. And business owners having to try and figure out, “What am I doing with staffing?” And that changes almost on a daily basis, I would assume. But you guys have to keep track of this. What’s the latest from your perspective? I mean, what are you seeing? What information do you have? How can you help me with that one?

Colin Rooke:

Yeah, that’s a good one. For example, we have return to work policies and return to work guides. Now, normally when I say that it’s return to work after an injury or an event, how do you slowly integrate back into your daily? And what steps does the employer need to take, what documentation, how to get your ducks in a row? In this case, it’s this whole idea of hybrid workplace. Are you a 100% back into work? Is it more of a hybrid model? We have clients that are still a 100% remote.

And so same type of name, but different approach, right? We are educating on what you need to think about in this new return to work or hybrid environment. And so we spend a lot of time talking about things like end point security now as part of the return to work plan or call it this new way of operating we’re now highlighting new risks that we maybe thought were temporary now, for those that are saying, “This is going to be a permanent thing.” There’s new risks we need to address and discuss. And so we’ve got the plan in place. We can make it easy for you. You can look at it as an executive and make changes, roll it out. You can use our model, but the important thing is, we’re helping you with the education. We’re helping with the document itself and making working on risk easy.

Paul Martin:

Well, easy is a good thing. We all want to push the easy button. Right? But as I’m listening to you talk about this, it just strikes me as probably three years ago or something. We were talking about the old security and privacy things and around your cell phone. So you always worried that employees were taking corporate information on the cell phone, through email or whatever with them when they left the building. I guess now when they’re working from home, this is that same story, but on steroids, right? It’s just exaggerated.

Colin Rooke:

Yeah. Absolutely. We would talk about you might have management or if you have a sales staff, are they at a restaurant meeting with a prospect, leaving the phone out or heaven forbid you forget the laptop somewhere? And so we talked about sort of bring your own device policies and a little bit about endpoint security now, whereas that might apply to three to 10%, three years ago, it may apply to 50 to a 100% now. And so the new focus or where the focus needs to be is, “Okay, this is the low hanging fruit. How secure am I?”

Paul Martin:

All right. We’re going to dig into that. We got to take a little break because we’ve reached the midpoint in the program, but Colin, I think we’re into something that’s really hands on helpful for anyone who’s got a management role in business today. You’re listening to Colin Rooke the commercial risk reduction specialist with Butler Buyers, commercial insurance. This is risky business back after this.

Welcome back to risky business commercial insurance with Butler Buyers, Paul Martin, here, your host, and joining me, Colin Rooke the commercial risk reduction specialist with Butler Buyers. Colin, before the break, we were talking about that something we used to talk about called bring your own device, which was, does an employee use their cell phone at work, or does the company supply them with one and then they carry around two? You know that was a conversation point for a couple of years ago. Today in the post or COVID world and post pandemic, that’s taken on a whole new meaning because we still have people working from home. And so are they taking their office equipment back to the house or does the company have to supply? I mean, all of those questions come into play.

Colin Rooke:

Yeah, absolutely. And just kind of at a high level, over 90% of IT decision makers, so those supplying and those calling the shots believe that end point security is just as important as network security in the new, sort of post pandemic environment, it’s a really big deal. And prior to this recording, I made a few phone calls and I wanted to get some local thoughts too. And that is the feeling that we really have to turn our focus to what was taken home. We all rushed to get home, but what really is at home and what policy and procedures are in place and how are we secure? And the other issue too, is as you bolt-on more features, as you make navigating your work laptop, more difficult, the younger you are, statistically, the more likely you are to find a workaround and then bypass that all together.

So the older you are, you’re probably buy the books. You’re logging in, you’re using it for work, you’re in the server only. As you get younger and you say, “Gee, this is a pretty good laptop, actually.” If you are more likely to cut corners, and you’re more likely to know exactly how to cut corners because you find security to be a drag. And so that’s a big issue. And so, where the industry is moving is rather than bolt-on, built in. So you don’t have a choice. But if you say, “Okay, well, the equipment, for example, that I sent home is old. It’s barely current.” Does that equipment have on it or installed what you need it to do. And maybe should you be looking at what can you purchase today that’s going to eliminate or close the loophole.

For example, you see advertising around Chromebooks that have built in antivirus. You don’t have an option of not having it or subscribing or not, or it is right in there. And that’s this view around this endpoint security, that’s getting ignored as more people are buying laptops, Chromebooks, even printers, right? And most importantly, those with a wireless connection. I mean, technically if there’s a wireless connection, you run the risk of those being able to attack or hack into that network printer. And so those are the conversations that need to be had and a lot more sort of work and effort needs to put into those vulnerabilities.

Paul Martin:

My guess is based on what you just said, mom, dad work at a place where they’ve got pretty good equipment. Now they bring it home. And the next thing you know, the kids are on it, even though they’re probably told not to and all that sort of stuff. I mean, as a business owner, A, what’s my liability and all of that? B, how do I coach or help my employees when they go home so that they do have some level of security without upsetting the home apple cart and saying end up with kids angry at parents, because I’m not allowed to play or touch or whatever. How do I do all of that? How do I navigate that? Do you have information on that?

Colin Rooke:

Yeah, we do quite a bit and I think it all starts with arming you with the statistics, right? If I say, “Oh, it’s a big problem.” How big is it? But I can say, for example, 48% of workers in Canada believe that office security is a complete waste of time. And again, back to the younger demographic from 18 to 24 year olds, that’s 64% say, “I think it’s a waste of time. It’s holding me back. So I’m just not going to do it.” Now where we combat that though, is the education, what does it mean? Right? What happens when you take your laptop home, do personal things with it, come back into the office environment, log back in, what are the risks?

And it starts with one understanding the nature of the problem, what is it? How widespread… So making it real, right? Arming with some numbers of, okay, how significant is this? And then three, walking you through what you can do, how you can change that. Or at least again, arming you with knowledge, you understand where you’re at and you can budget accordingly. I mean, I’m not saying that you immediately replace every printer, every device, but you have to understand your risks and what you can do about those. And certainly educate those around those risks.

Paul Martin:

But it’s not a bad idea. I think I’m hearing you say that as a business owner, take a look at your inventory of assets and how current are they? And if you’re thinking about replacing it or you have a schedule, you might want to just be aggressive about that, stay on top of it or get ahead of it a little bit.

Colin Rooke:

Absolutely. And for anyone listening saying, Paul, Colin, we’re good. We have a policy around this, so I’m not concerned. Well, roughly 70 percent of businesses in Canada report having some sort of network security policy, however, 39% of Canadians in the workplace are unsure of what those policies say, and 32% didn’t know the company even had one. So you’re not as protected as you might think. It’s about reviewing. It’s about updating. It’s about educating and making it real.

Paul Martin:

It’s a bit of a classic, isn’t it? The boss thinks they’re covered, because they are. But nobody below them knows. And so by definition you’re not covered because no one knows.

Colin Rooke:

Absolutely. Yeah. And we get the same thing with fleet safety, right? All of our drivers stand to the limit and follow every rule of the road. Well, did you tell that to the drivers?

Paul Martin:

Well, you often see those vehicles, how do you like my driving dial this number? I mean, first of all, that’s a contradiction and safety anyway, you shouldn’t be posting a phone number on the side of a vehicle going 110K or something. We’ve got like a minute, minute and a half left in this program and solid information you’re giving us. But I’m just curious. How does the insurance company look at this conversation you and I are having right now? I mean, what’s their perspective on it?

Colin Rooke:

Absolutely. So we’ve talked about cyber reliability pricing being up to 300%. And we’ve also talked about seven out of 10 organizations that are faced with ransomware, they pay it. So it’s arming the insurance companies with the focus on endpoint security and cyber security as a whole, that’s going to reduce cyber reliability premiums. I mean, if you’re okay with a 300% increase, go ahead and pay it. And that’s the average, right? So I means there’s people with 600% increases in there. I mean, if the average is 300, it doesn’t mean that’s the marker. And so that’s why this is important. It’s all about arming us with knowledge and then us going back to the insurance companies to say, “They’re putting in the effort, maybe they’re not fantastic, but we’re working on getting from good to great.”

Paul Martin:

All right. Just wind up here, because we only have a few seconds left, but we started this program by saying you have a library and just maybe just elaborate invite people, what would they find in your library?

Colin Rooke:

Policies, procedures, manuals, newsletters basically you name the topic. If there’s an element of risk, our goal is to make your life easier. It’s easy to work on risk if we do all the heavy lifting for you. So reach out and just ask me, “Do you have anything for this?” And we’ll let you know.

Paul Martin:

Yeah. Templates, any of that sort of stuff.

Colin Rooke:

Exactly.

Paul Martin:

Colin thank you as always very insightful. You’ve been listening to Colin Rooke, commercial risk reduction specialist with Butler Buyers, commercial insurance. I’m Paul Martin. Thanks for joining us with risky business. Talk to you next time.

How to navigate through a hard market?

Home • (Page 9)

Paul Martin and Colin Rooke define the insider term “hard market” and what it means to be the best in class.

RiskyBusiness · Butler Byers Risky Business – How to navigate through a Hard Market

Listen to the full episode here, or read the full transcript below.

Paul Martin:

Welcome to Risky Business, Commercial Insurance with Butler Byers. Paul Martin here, the CKOM business commentator. And joining me, Colin Rooke, the Commercial Risk Reduction Specialist at Butler Byers. And Colin, over the last year or two, we’ve been talking about something that in the industry, they call a hard market. Now that is an insider industry term, but it really means that the industry, insurance industry generally, has not been doing very well financially. The cost of claims has exceeded cost of revenue from premiums. And so they’ve had to kind of rearrange the way they do things.

And let’s spark the conversation between you and I that if you are looking to buy insurance, you really have to scramble and make yourself look good to an insurance company because right now, they’re not real crazy about taking on every risk. They’re actually very, very selective. So we’re starting to see, I think you’ve indicated to me, that there are some early preliminary signs that maybe this hard market thing might just be … the end of it may be in sight. Might be a long ways away, but it might be in sight.

Do you want to just elaborate on that? The hard market’s been something that’s not fun for those who buy insurance. What are you seeing right now?

Colin Rooke:

Yeah, Paul, you made a really good point on how the hard market works. We talked about, it’s been sort of a downward slide for the past five years. Now, if you talk to any business that’s buying insurance, they would say, how am I coming out ahead, I’ve had increases for four or five straight years? But I will give it to the insurance markets. I mean, they’re looking at their loss ratio saying, for every dollar taken in, we’ve paid out a dollar 50 and we’re going to have to increase rates. But they didn’t do it overnight.

So, they didn’t look at the book and say, everyone’s going to get a 300% rate increase. We’ll return to profitability. They do do it over time. Just, when you’re in year four and five of it, it seems like a really, really long haul. And you’re delivering bad news over and over and over again and referencing the same thing, but it really is a cycle. They say, okay, well, our ratios are high. We have to work towards returning to profitability. And so that’s going to take time. And there’s finally, in the first six months of 2021, there’s finally some light at the end of the tunnel.

Now, losses, catastrophic losses, are quite low. Now someone might say, well, what about all the fires in BC and Alberta? Yes, that’s very costly to government. But in the whole swing of things, there’s not a lot of property damage. There’s some, but we’re not talking levels of the fires of Fort McMurray where, essentially a city’s burned to the ground. A lot of trees, yes. But not really property claims, as far as insurance companies are concerned. So very, very few cat losses, catastrophic losses.

And then, the results of COVID, where people aren’t moving around as much. They’re not driving as much. There’s people working from home. And so a lot of lines of business, outside of cyber liability and maybe directors and officers, we’re really seeing claims reducing. And back to the level of the true accidents, the things that you maybe couldn’t have of predicted. The water main snapping underground, which you really had no control over. So we’re now seeing, essentially the most profit in the insurance industry of the last 20, 30 years now.

So I say that, and you could say, okay, so I should start seeing premiums decrease. I can’t wait to talk to my broker. I’m going to get a reduction, probably, because they’re making money, so the hard market is over. Well, they’re very, very cautious. So they don’t think it’s any effort on their clients’ part that’s reducing the frequency and severity of claims. They’re basically saying, there’s a pandemic. And frankly, we’ve been very lucky with weather.

However, for some, there is room to move. I mean, there is more capital available. They are able to increase their level of risk tolerance. And so for the great risks, or if you’re a great risk that no one knows about this is the time to say, there is room there and I am one of the great ones. And even though you might be continuing to charge more for most of my competitors, here’s why I’m the one that should take advantage of the breathing room that is now in the market.

Paul Martin:

I love that terminology you used. I mean, it means any small business or business owner, any business actually, could aspire to be Gretzky. You called them, be one of the great ones. We should talk about a great one. What’s it take to be the great one? In business, in terms of how I’m perceived by an insurer, how do I get to be the guy who’s going to where the puck’s going to be, not where the puck is?

Colin Rooke:

Really good Gretzky analogy, again. And a really good point. So for anyone listening, you could say, well, that’s me. I haven’t had a claim in 5, 10, 15 years. I mean, I’m exactly what the insurance industry wants. And unfortunately, that’s not true. We use the term best in class all the time on this show. And I don’t know, maybe the insurance companies are listening, but that’s really something that’s thrown around on a day-to-day business, best in class, but it’s very, very difficult to define.

So again, as a listener, you would say, well, again, if their job is to pay claims when there’s losses, best in class would be those with no losses. Couldn’t be further from the truth. Best in class might be the way the building was constructed. It might be the organization chart of a management group. It’s the employee manuals that are … or the procedural operation of a board of directors and how they review themselves annually. It would be your cyber controls and how often you are revisiting those.

So it’s not really … in fact, it’s in almost in no way defined as loss history. The insurance markets say, that’s just luck. And that’s the business we’re in. You could go 100 years with no claims, you could be one of the great ones. And you could go every year with a claim and have the same operations exactly. And there’s just, there’s that luck component.

But for those that we really want to push back and say, we know there’s credit savings available. It’s everything you’re doing proactively, trying to get to where the puck’s going to be, saying, I haven’t had a cyber incident yet. And we’re going to put in a ton of effort to make sure that never happens. And then you’re going to work with a broker like us that’s going to share exactly what you’re doing to the market.

Not just filling out the apps. Writing a detailed risk management report to suggest, this is why, if there’s credit available, if there’s breathing room, if there’s relief, you can take on this client and not affect loss ratios or combined ratios. And then save the increases of the trailer of the hard market for those that really aren’t doing anything other than relying on luck.

Paul Martin:

The word luck has come up a few times in today’s program. And I’m really intrigued by that because lady luck goes both ways. Doesn’t it? I mean, the insurance companies have been saying, we’ve been lucky with weather. But it’s not about being lucky when you’re the company trying to buy insurance. When you’re saying to your broker, get me some coverage. Because luck doesn’t come into play there.

You actually have to produce something that is the exact opposite of luck. You have to show a broker. Show real production, real evidence that you’ve taken the steps.

Colin Rooke:

Exactly. And for anyone listening, if you’ve ever filled out an insurance app for a broker that’s sending out insurance apps, there’s really no area where you can explain why you’re so different. Why you’re a great risk. I mean, some of these apps at the bottom might have room for a line or two about any special comments you’d like to add. But if we’re just looking at claims history and construction details and revenues and number of employees and splits between US and Canadian operations, that is just the basics to go into the algorithm, to get the conversation started around rate.

The system will say, for this type of class … it’s going to look at every similar business on the books. And it’s going to say, statistically, we lose money on these and the rate needs to be here. There’s got to be a reason for an underwriter to either, sort of on their own power, or go back to a supervisor to say, there are a lot of credits available, or even some credits we’ll take now. And this is one of those accounts that, frankly, we really want. This is going to turn the tides for us. But there’s got to be that detailed report, that plan, that explanation of the why.

And if you’re just filling out an insurance app … and if all your conversation’s around operations, not risk and forward thinking, it’s not going to happen.

Paul Martin:

We’ve got to take a little break, Colin. We’re going to pick this up … you’re always triggering interesting thought processes for me. So I want to explore one of them when we come back. And we’ll just take a look at, what does this mean from management’s perspective? You’re listening to Colin Rooke, the Commercial Risk Reduction Specialist with Butler Byers. This is Risky Business, back after this.

Welcome back to Risky Business, Commercial Insurance with Butler Byers. Paul Martin here, your host. And joining me, Colin Rooke, the Commercial Risk Reduction Specialist with Butler Byers. Colin, before the break, you were talking about best in class and how you have to kind of reposition yourself and make the case. If I’m a business owner or a manager listening to this program, I’m thinking, oh man, that’s a lot of work. And aren’t they supposed to do that job for me? And what’s this all about?

But if you just look at the flip side of that coin, I mean, this is your job as management, right? Get to be the best in class. So this is just one more discipline that’s going to help you achieve that. And you’ve got some guidelines and programs and formats that will actually help me be better at running my business and make my business better. Which ultimately, will be a really much better place or much better thing to sell at the end of the day.

Colin Rooke:

Yeah. I couldn’t agree more. For those that get it, this is just … for those businesses that say, we want to be the best at what we do. This is just part of that. If you have a large supply chain, if you have thousands of customers that rely on you every single day, wouldn’t you want to have a full and complete disaster recovery plan in the event you suffer a major loss? And I would even venture further to say, the best companies, that’s how they think. And they are doing that, which is part of why they’re the best.

Or you look at cyber, incident response planning. Again, you’ve got, could be millions of people that rely on you. Take Amazon, for example. They need to have a plan in place. And I promise you, they have several, they have dozens in the event of data breach. And you say, well, how do they get to where they are? Well, it’s that level of thinking. So it is part of the day-to-day operations. This shouldn’t be a chore. This should be partnering with someone that’s going to help you in different areas of your company, really do what you’re already doing as a trusted advisor. And just change the conversation from insurance to risk.

Paul Martin:

Well, that’s interesting, because today we’re talking about the hard market. But really, in your repertoire or your library of information that’s available to any client … or a prospect, even. A prospective client, someone who isn’t even part of your client base. They can come to you and say … you could provide them with something on, here’s the disaster recovery plan you talked about. Or here’s the cyber incident management report.

But you could also do … you have them available on employee engagement. I mean, it’s not just one topic. This is like the whole manual for running a business. It’s kind of like taking an entire four year course at university, and it’s all available for free. Just call Colin up and he’ll give it to you.

Colin Rooke:

Yeah. Even for those organizations that say, we don’t even have an employee safety manual, or we did it once and it’s so out of date, give us a call. I’ll get you a current version. You are free to use it as is or revise it how you see fit, it doesn’t matter to me. But we can check the box. We can educate and say, okay, go through this, make sure it’s relevant. And here’s what I want you to do. Circulate it to everyone. And then, put in your calendar a quarterly reminder to review it. Even if every employee does not listen and actually review it, you’re doing your due diligence and you’re reminding them to do it, which is 10 times more effort than most.

And so it doesn’t have to be a huge undertaking. It’s just a matter of reaching out and having a conversation around what you have, what you don’t have. What you need, what you don’t need. Putting a plan together. And we do really focus on making it easy. But then again, we share that knowledge. We reference that, hey, they didn’t have an employee safety manual. They do now. And if you’d like a copy to the insurance market, here it is. You’ll find it’s extremely thorough. And now, it’s that simple. It’s done.

Paul Martin:

Yeah. I just wanted to circle back around on that, and to kind of summarize this. So I go through all of this … steps that you’ve talked about. I do these things. I mean, first of all, makes me a better manager. Makes my team better. Makes me a better business, which ultimately, increases my value.

But how does the insurance company look at me like this? I mean, that’s ultimately what we’re talking about here. So why does this elevate my profile in the eye of the underwriter?

Colin Rooke:

Good question. It shows the forward thinking. It shows that you are aware of your risks, and you have plans in place to those. You mentioned employee engagement surveys … and I’ve said this in the past. But you might survey the organization and say, we are doing fantastic. And that’s perfect. We’ll share that. Or you might survey the organization and say, there’s a lot of work to be done. Well, to an insurance company who is, let’s say on for the property, disengaged employees don’t go back to the office to unplug the coffee maker, so to speak.

Really stereotypical. But the disengaged employee does not get back in their car on Friday at seven o’clock and realize they were the last to leave and that thing’s still on and it may run all weekend. The engaged ones do. And we sell that story to the insurance market saying, why would an engagement survey affect the property rate? Well, these people care about where they work. In fact, they love working there. Turnover is so little, that these people bleed the colours of their organization. Versus, honestly, I don’t even know if they would put out a fire if they saw it.

Paul Martin:

Colin, we’ve got about a minute left before we run out of time today. So I want to go back to where we started this conversation. And it’s that there are signs on the financial markets that the insurance industry, the health of the insurance and industry, financially, is improving. That the numbers in the first half of this year show increased profit.

So am I reading this right if I get the conclusion that the steps that have happened so far are making some progress, but it’s not fair to say that the insurance company’s out of the woods?

Colin Rooke:

No. They have not forgotten how bad it’s been, despite a little breathing room. But again, there is breathing room. We just have to really exploit and sell those businesses putting in the effort. And I can assure you those that aren’t, or there’s really no story, they’re going to remain in the same spot for any length of time. I mean, there’s other industries where there’s no end in sight to the hard market. But again, if we can explain the operations the right way and show the effort, there is room.

Paul Martin:

To put another metaphor on it, this is a concert and we’re all lined up to get into the concert. And in the concert, the performance is better coverage, lower rates. Only the first few are going to get in. So what you want to do, what you’re saying is, let me help you get to the front of the line.

Colin Rooke:

Exactly.

Paul Martin:

You’ve been listening to Colin Rooke, the Commercial Risk Reduction Specialist with Butler Byers. I’m Paul Martin, thanks for joining us. And we’ll be back with the Risky Business next week.