EMERGING RISKS/ HOT TOPICS RIMS 2015 March 26, 2015.

EMERGING RISKS/HOT TOPICS

RIMS 2015

March 26, 2015

Emerging Risks/Hot Topics

Recently, some of the “new” risks that grabbed headlines were:

Ebola

ISIS

Super Storms

As Managers of Risk, we try to see what risks are emerging so we can be prepared and warn our colleagues.

Our presentation today will identify some of 2015’s New Risks. This will be an interactive discussion and we look forward to your participation.

Your presenters:

Arya Yarpezeshkan – Group Chief Risk Officer at Navigators

Richard White – Senior Vice President at Willis

The World is filled with RISK. EMERGING RISKS are simply the ones that become PROMINENT today

Emerging Risks/Hot Topics | 2

Cyber Risk may not be New – but it is Hot

To help us understand the New Risks in Cyber, the following presenters have joined us:

Stu Kohn – Vice President, Professional Division at Navigators

Robert Barberi – Vice President, Willis FINEX Practice

Cyber Risk has been around for many years, but it continues to evolve and create new challenges


Insurance Solutions to Emerging Cyber Risks

The information presented herein is for informational purposes only and is not intended to be legal, accounting or other professional advice or opinions on specific facts or matters, used for trading or investment purposes or a complete description of certain aspects of the business of Navigators and its operating subsidiaries.

5

Insurance Solutions to Emerging Cyber Risks

• INCREASED CAPACITY Limits and Dual Towers

• THIRD PARTY LIABILITY Privacy, Network Security, Media, Regulatory and PCI

• FIRST PARTY EXPENSES Notification/Call Centers, Monitoring/ID Theft Protection,

Crises Management/Public Relations, Forensics/Investigatory, Legal

• CYBER EXTORTION EXPENSE• DATA RESTORATION• BUSINESS INTERRUPTION• PRE-BREACH SERVICES

WHAT IS DIFFERENT TODAY?


In 2014, there were more than 1,868 privacy breaches reported in the US, roughly 5 per day

Preventable breaches continue to decrease, while breaches involving hackers and organized crime continue to increase

Point of sale vulnerabilities

Failing to protect personally identifiable information (PII – employee, customer, vendor) or Personal Health Information (customers or employees)

Reliance on Cloud Vendors (Cloud, IT, HR)

Regulatory changes and heightened regulatory enforcement

SEC Cyber Risk Disclosure for Public Companies

Aggressive enforcement of Payment Card Industry Fines & Penalties

Key coverage issues: cloud breaches, acts of rogue employees, portable device and encryption exclusions, credit monitoring, terrorism, limited 1st party coverage.

Risk Assessment & Benchmarking

| 7Cyber Risk Discussion Prepared for World Duty Free Group | 7

Type of Data

– PII was the most frequently exposed data (41% of breaches), followed closely by PHI (21% of breaches).

Cause of Loss

– Hackers were the most frequent cause of loss (30%), followed by staff mistakes (14%).

– Median number of records lost was 1,000. Average number of records lost was 2.3M.

Business Sector

– Healthcare was the sector most frequently breached (23%).

Breach Costs

– Average records lost: 2.4M / Median records lost: 3,500

– Forensics, legal counsel, notification and credit monitoring represent highest costs to Insureds

– The median cost for forensics, notification, credit monitoring and legal compliance was $366,000

– The average cost of defense was $698,000

– The average cost of a legal settlement was $558,000

2014 Ponemon Study of Per Record Data Breach Expenses :

– Average per record cost: $136

2014 Net Diligence: Key Findings After Analyzing Insurer Claim Payouts

CYBER MARKET ENVIRONMENT


Claims severity has spiked dramatically, especially in the retail sector with breaches at Target, Neiman Marcus, P.F. Changs, Goodwill Industries, Michaels Stores, Living Social, SuperValu , Home Depot and in the managed care sector with the recent Anthem breach.

Consequently, the markets have tightened their underwriting standards, pricing and retention guidelines (including separate class action retentions).

Some underwriters are requiring conference calls with legal and IT prior to issue quotes.

The marketplace is taking a closer look at Access Controls, Data Classification, Encryption, Fraud Prevention, Malware Controls, Vendor Management, Employee Training, Incident Response and Business Continuity Plans as underwriting criteria.

Overall capacity remains strong (around $400M) and over 50 carriers currently write cyber risks. However, overall capacity in the Managed Care E&O sector and Retail sector is more limited.

Other Interesting and Emerging Risks

The information presented herein is for informational purposes only and is not intended to be legal, accounting or other professional advice or opinions on specific facts or matters, used for trading or investment purposes or a complete description of certain aspects of the business of Navigators and its operating subsidiaries.

10

Google-ization of the Insurance Industry

Description Internet giants like Amazon and Google may disintermediate personal and small commercial lines and then possibly large commercial lines, employee benefits.-huge customer lists-unparalleled data analytics-proven ability to offer a winning customer experience-massive capital needing deployment -insurance market - highly fragmented and resistant to change.

Timeframe Mid-term: 6m - 2 years

Likelihood High

Impact Significant disruption to the existing insurance model

Risks - May not be able to deliver “personal touch” services. - U.S. market is more difficult to enter.

Opportunities Competitive pricing and selection for insurance buyers

11

The Internet of Things

Description The Internet of Things is a term used to describe a world where everyday objects—from parking meters to home heating systems—are connected to the Internet and can be controlled by computers and mobile devices.

Timeframe Near-term: < 6months

Likelihood High

Impact High

Risks Equipment failure or faulty commands could potentially lead to injury, property loss and loss of income. The scope of liability, due to systems failing to properly control an intended device, is still being established.

Opportunities Streamlining operations – both through cost reduction and operational efficiency.

12

Medical Marijuana

Description Employers that are trying to grapple with whether—and, if so, how—their employment policies and practices should be modified to take into account the new statutes allowing for medical marijuana use.


Likelihood High

Impact - Employers’ rights versus workers’ rights- Potential for litigation regarding employment policies- Workers’ comp systems may not be able to handle the

issue on a large scale basis

Risks - Workplace safety

Opportunities

13

Autonomous Cars

Description A fully autonomous car can be defined as a car which is able to perceive its environment, decide what routeto take to its destination, and drive it.

Timeframe Longer-term: > 2 years

Likelihood High

Impact - Significant changes to travel- Less carbon emissions due to more efficient driving- Legal responsibilities / liability become less clear

Risks - Machine malfunction- Reliance on GPS- Hacker hijacking

Opportunities - Reduced risk of accidents- Reduced insurance rates

14

3D Printing

Description. 3D printing or additive manufacturing is a process of making three dimensional solid objects from a digital file.


Likelihood High

Impact High

Risks - The use of mass-market 3D printing technology will create an army of back bedroom manufacturers.

- As new techniques and ink technologies are introduced, latent defects will appear in products that were previously unimaginable and many will not emerge for years, if not decades, after this process has become mainstream.

- Intellectual property will also be an issue.

Opportunities End users will be able to do much of their own manufacturing.

GoogleZilla

It is amazing how little the insurance industry has changed:

Personal Lines and Small Commercial Agencies will most likely be the first targets. But it won’t stop there.

Analysts predict that Google, Amazon, Alibaba, Facebook, LinkedIn, and Twitter will enter the insurance market.

With capital, data, and analytics, Internet giants prepare to devour the insurance industry– Leader’s Edge Magazine


What are the Possibilities?

Med Mal sold on a per-surgery basis

Auto insurance premiums that change depending on where you drive

Product liability premium based on sales by product and region

Given the power of analytics, here are some of the possibilities:


Tech Giants Love to Disrupt Traditional Business

There are reasons to believe that our business with: Retail brokers Wholesale agents MGAs E&S Brokers General agents Direct agents Captive agents

… can be streamlined.

So what can we do?

Get a better handle on Risk Data

Make the Customer Experience as user-friendly as possible


Alternate Dispute Resolution (ADR)

Mediation – Arbitration – Ombudsman

Two NY projects, same Developer, one ADR, and another non-ADR. The non-ADR project had costs about 600% higher than the ADR project

The first two years of Electrical Workers ADR in NY found about 25% reduction in medical and indemnity costs

NY Studies have shown approximately 30% shorter open case duration; and indemnity/medical payments about 40% lower

ADR was authorized by New York State to foster:

Less Adversarial process

Improved delivery of medical benefits

Promotes administrative efficiency

For Construction Risks in New York State, ADR is a major development for Collective Bargaining Agreements


NARAB

What is it?

A nonprofit, private body whose members would be required to be state-licensed insurance producers

What is the benefit?

Members could operate across states without licenses from individual states

Who runs it?

A 13-person board, (eight commissioners/five insurance industry representatives)

Presidentially appointed and Senate-confirmed

What is its Purpose?

Increase efficiency and reduce cost

The National Association of Registered Agents and Brokers


Pandemic Disease

Work Place Risks

Specific to some occupations- Healthcare, Airlines, Humanitarian workers, Funerals and First Responders.

If your employees travel

Have a service that provides travel advisories

What if an employee is infected- EBOLA, Measles, etc.?

Have a written plan

Cleaning personnel should be trained for OSHA blood-borne pathogens standard

Title of Presentation – edit in master | 20

EMERGING RISKS/ HOT TOPICS RIMS 2015 March 26, 2015.

Documents

cyber risk discussion

cloud breaches

emerging riskshot topicsrims

s new risks

median records

privacy breaches

daypreventable breaches

risk assessment benchmarking