6 Challenges Facing Construction Firms
The Risk List is presented by:
The Risk List is presented by:
Cyber risk is an amorphous threat that demands a coordinated defense from companies, their insurance carriers, and security and privacy professionals.
The exposure is multifaceted, varies from business to business, and continues to evolve. In addition to purchasing cyber insurance, companies can bolster their defenses against this risk by conducting targeted risk assessments and implementing appropriate security controls — but the challenge lies in identifying which security programs and controls an organization needs most, and which vendors provide the best service.
All companies, but especially small- to medium-sized businesses with more limited resources, want to see improvement of their risk profiles translate into discounted insurance premiums.
However, lack of alignment between IT security vendors and underwriters can make that connection difficult to attain, minimizing the value of loss control services. Current underwriting processes typically don’t allow underwriters the opportunity to ask insureds many questions about their security and privacy improvements, and vendors often view insurance as a separate offering, if not an afterthought.
“Part of the challenge has been that you have two different industries — IT security and insurance — working in siloes to address a singular risk challenge. Naturally, security professionals think about risk and control mechanisms differently than insurance professionals, and speak different languages,” said Tom Kang, enterprise cyber underwriting & product lead at The Hartford.
“We believe aligning the solutions — between security and insurance — and providing the right incentives to our clients can make a real difference. A fully integrated solution, with discounts for the service and the insurance, can offer something compelling and help improve cyber risk for our clients.”
It’s time to start thinking about cyber risk in a coordinated, cohesive fashion.
“We believe aligning the solutions – between security and insurance – and providing the right incentives to our clients can make a real difference.”
— Tom Kang, enterprise cyber underwriting & product lead, The Hartford
“Because cyber risk was emerging so quickly, insureds were often on their own when it came to risk control, underwriters were evaluating an emerging risk and hoping they got it right, and then claims were their own animal,” said Tim Marlin, head of cyber underwriting at Hartford Financial Products.
“But now that the risk is more mature, our views need to mature as well. As we gather more claims data, the industry needs to implement a better, more coordinated strategy than the ad hoc approach that often prevails. Risk control, underwriting and claim response should be thought of as parts of a continuum.”
Insurers play a key role in driving best practices and can help clients align every part of their cyber risk strategy. By thinking through their risk holistically, insurers can help buyers identify their key exposures, establish internal risk mitigation, transfer the risk through cyber insurance, and respond to a breach.
“Insurers themselves have a marketwide view of the risk from underwriting and claims data and benchmarking,” Kang said. “They can help insureds understand whether they are doing the right thing when it comes to identifying and securing their critical assets, complying with a dizzying array of regulations in this space, and direct them to the right resources.”
Many insurers make recommendations on well-vetted service providers, but traditionally there has not been a high rate of engagement because insureds could not see how those services impact their cost of insurance.
“Most insureds and brokers want to see their investment in these services have some kind of impact on premium, and historically insurers have not had much of a response,” Marlin said. “Some provide value-added services packaged with the policy. But including those services doesn’t generally move the premium or risk mitigation needle in any material way for organizations, whether they are mid-sized or large.”
The Hartford goes a step further beyond just finding the best vendors in the business. If clients use approved service providers and services, they can report it to The Hartford’s underwriters, who will factor the risk controls into calculations of the insurance premium.
“These are vendors we trust to help our clients get better at managing cyber risk,” Marlin said. “If they are strengthening their security, it feeds directly into our underwriting process and results in a premium incentive.”
By connecting the use of risk control services to insurance cost savings, The Hartford incentivizes clients to implement best practices in cyber risk mitigation and reduce their exposure to loss.
“An insurance policy should help you get better. Not just on the front end before there’s a claim, but after a claim as well.”
— Tim Marlin, head of cyber underwriting, Hartford Financial Products
Carriers can also work more closely with brokers and insureds to help them determine what the most appropriate coverage is for their particular business. An organization’s size and function both influence what type of coverage is required.
Small and mid-sized companies with limited resources, for example, may be less inclined to purchase a mono-line cyber product than to embed coverage within a different policy, like General Liability or E&O — where cyber coverage originated.
“When you think about the risk holistically, you can more thoughtfully plan what risk you will retain, mitigate or transfer. Part of thinking about the risk holistically also includes developing a robust cyber incident response plan, and thinking carefully about recovery and necessary improvements,” Kang said.
Beyond the traditional response services that are often included in cyber insurance policies and the claims process, policyholders should think about remediating the privacy or security issue that led to the claim.
That’s why The Hartford offers a cyber security expense fund as an additional endorsement on its CyberChoice First ResponseSM product. While the policy will help cover the costs of an incident response, the fund will help to cover the costs of remediation after the claim.
“Coverage typically stops at the claim. But we wanted to go a step further. Similar to pre-breach services, the fund can be used to strengthen those vulnerabilities that were targeted in the event,” Marlin said. “Perhaps more than pre-breach services, we believe engaging the insured after a claim is the best time to help them get better. They have had a loss and they understand very specifically what vulnerabilities they have and the impact of the exploit. No one else in the market offers a coverage like this.
“An insurance policy should help you get better. Not just on the front end before there’s a claim, but after a claim as well. We help clients get stronger through every part of the cyber risk management continuum.”
FOR PRODUCERS ONLY. CyberChoice First Response is offered on a SURPLUS LINES* basis. This material is not to be used for solicitation purposes. The Hartford has arranged for data risk management services for our policyholders at a discount from some third-party service providers. Such service providers are independent contractors and not agents of The Hartford. The Hartford does not warrant the performance of third-party service providers even if paid for as part of the policy coverage, and disclaims all liability with respect to use of or reliance on such third-party service providers.
*Eligibility for surplus insurance coverage is subject to state regulation and requires the use of a licensed surplus lines broker. Surplus lines insurance policies are generally not protected by state guaranty funds. Policies should be examined carefully for suitability and to identify all exclusions, limitations, and other terms and conditions. Surplus lines coverage is underwritten by Pacific Ins. Co. Ltd (except in CT and HI) and The Hartford Ins. Co. of Illinois in CT and HI. The Hartford® is The Hartford Financial Services Group, Inc. and its subsidiaries. Its headquarters is in Hartford, CT. All rights reserved.
This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with The Hartford. The editorial staff of Risk & Insurance had no role in its preparation.
On Jan. 28, the New York Taxi Workers Alliance called a strike at John F. Kennedy International Airport, one day after President Trump signed an executive order banning entry of foreign nationals from seven Muslim-majority nations, including a blanket ban on refugees. The strike was an act of solidarity with immigrants, and a public display of the Alliance’s opposition to the executive order.
Uber, however, continued to service the airport, tweeting that it would halt surge pricing during the protests. Some saw it as an opportunistic ploy to get more riders to use Uber. A #deleteUber Twitter campaign was quickly born, with users tweeting screen shots of themselves removing the app from their smartphones.
More than 200,000 were estimated to have uninstalled the ride-sharing service over the course of the weekend.
Uber CEO Travis Kalanick reacted, creating a $3 million legal defense fund to provide lawyers and immigration experts for any of its drivers that were barred from the U.S., and promising that drivers would be compensated for lost wages.
Over the same weekend, in response to the travel ban, Starbucks CEO Howard Schultz announced that the company would hire 10,000 refugees worldwide over the next five years. Then it was Starbucks turn to get punished in the public arena. A #boycottStarbucks campaign was launched by people who felt the company should focus more on hiring American veterans.
Athletic shoemaker New Balance suffered blowback in November of 2016 when its vice president of communications, Matt LeBretton, told the “Wall Street Journal” in an interview that he believed “things are going to move in the right direction” under the new administration. Angry customers began posting pictures of themselves trashing or even burning their New Balance sneakers.
These social media-fueled public relations crises demonstrate how fickle public opinion can be. They also serve as warning signs of growing reputational risk for corporations.
Uber, for example, typically stops its surge pricing in the event of emergency so as not to exploit a crisis for its own benefit. To do so during the protests and taxi strike at JFK was perhaps meant to show its respect for the event.
Starbucks’ 10,000 refugee hires would be spread out across its locations around the globe, not just in the U.S., where the coffee conglomerate already promised to hire 25,000 veterans and military spouses by 2025.
New Balance’s LeBretton was speaking specifically about the Trans-Pacific Partnership during his interview, and how the deal could hurt sneaker production in the U.S. while favoring foreign producers — he wasn’t talking about Trump’s other proposed plans.
These companies, in reality, did nothing as abhorrent and scandalous as the Twitterverse may have led some to believe, but context isn’t always provided in 140 characters.
Complaints and boycotts have been launched at companies via social media for perhaps as long as social media has existed. But the current contentious environment created by one of the most divisive leaders in American history now colors every public statement made by prominent business leaders with a political tint. Executives are stuck between a rock and a hard place. They’re exposed to reputational damage whether they oppose or endorse a Trump action, or even if they do nothing at all.
Take Elon Musk, for example, founder of Tesla and SpaceX and a well-known advocate for climate research and environmental protection. He came under fire for not publicly denouncing the travel ban and for keeping his seat on Trump’s business advisory council.
Musk has largely avoided the limelight on political issues, couching statements when he makes them at all — as most executives are wont to do. But he was prodded to defend himself on Twitter after some users suggested he was a hypocrite.
“Be proactive in your plans to mitigate the aftermath and how to communicate. Own up to error. Be transparent. Salvage your crown jewel.” —Helen Chue, global risk manager, Facebook
A strategy of avoidance may no longer work as consumers, employees and the public at large pressure companies to make a statement or take action in response to political events.
“A large segment of the population expects the people they do business with and the companies they buy from to support their point of view or respond to political or social issues in a certain way,” said Chrystina M. Howard, senior vice president, strategic risk consulting, Willis Towers Watson.
In a damned-if-you-do, damned-if-you-don’t environment, reputation risk is expanding, and risk managers need to re-evaluate how they assess their exposure and build mitigation strategies.
The challenge begins with determining whether a negative public relations event is really a crisis. Is it a temporary blow to a brand, or does it have the potential to do long-term reputation damage? Misreading the signs could lead companies to overreact and further tarnish their image.
“These sudden public relations crises are a source of panic for companies, but sometimes it sounds much worse than it actually is. The financial ramifications may not be anywhere near what was feared,” Howard said.
“Uber is probably a good example of what not to do,” said Jeff Cartwright, director of communications at Morning Consult, a brand and political intelligence firm.
“They maybe went over the top in trying to reverse the way they handled the protests at JFK.”
Tracking brand value in real time can give risk managers insight into the true impact of a negative social media campaign or bad press. Michael Ramlet, CEO and co-founder of Morning Consult, said most events don’t damage brands as much as trending hashtags make it appear.
Morning Consult’s proprietary brand tracking tool allows companies to measure their brand perception against influencing events like a spike of Twitter mentions and news stories. More often than not, overall brand loyalty remains on par with industry averages.
In Uber’s case, Twitter mentions spiked to roughly 8,800 on Jan. 29, up from about 1,000 the day before. By Jan. 31, though, the number was back down to around 1,250 and quickly settled back down to its average numbers. From the beginning of the #deleteUber campaign through the end of February, Uber’s favorability shrunk from 50 percent to roughly 40 percent, based on a series of polls taken by 18,908 respondents.
It’s a significant dip, but likely not a permanent stain on the company’s reputation, especially after Kalanick’s public show of support for immigrants and rejection of the travel ban. Uber’s favorability rating remained higher than competitor Lyft’s throughout the ordeal.
“The #deleteUber campaign turned out to be a very local thing that didn’t have a widespread impact,” Ramlet said.
“Twitter at best is an imputed analysis of what people are saying. The vocal minority might be very active, but there might be a silent majority who still think fondly of a brand, or at least have no negative opinions of it.”
He said risk managers can also benefit by breaking down their brand perception into geographic and demographic subsets. It can, for example, show whether a brand is favored more heavily by Democrats or Republicans.
“If you have that data on day one, it can help you determine how to respond if, say, Trump tweets at you,” Ramlet said.
Of course, some spikes in news media and social media attention are indicative of much deeper problems and true reputational risk.
After the Wells Fargo dummy-account scandal broke, for example, unfavorability ratings as measured by Morning Consult jumped from roughly 20 percent to nearly 55 percent, while favorability dropped from 50 percent to 30 percent. Net favorability, which stood at 33 percent pre-scandal, fell to -4 percent post-scandal.
“They went from being the most popular bank to the least popular in less than four months, according to our data,” Ramlet said.
The contrast between Uber’s and Wells Fargo’s stories demonstrates the difference between a more surface-level public-relations event that temporarily hurts brand image, and a true reputation event.
“Failures that produce real and lasting damage to reputation include failures of ethics, innovation, safety, security, quality and sustainability,” said Nir Kossovksy, CEO of Steel City Re.
“Activists make a lot of noise that can be channeled through various media, but for the most part in the business world, stakeholders are interested in the goods and services a company offers, not in their political or social views. As long as you can meet stakeholder expectations, you avoid long-term reputational damage.”
Wells Fargo’s scandal involved a violation of ethics, sparked an SEC investigation and forced the resignation of its CEO, John Stumpf. It’s safe to say stakeholders were severely disappointed.
That’s not to say, however, that a tarnished brand name doesn’t also impact the bottom line.
“Even if a bad event is short-lived, the equity markets react quickly, so there may be sharp equity dips. There may be some economic impact even over the short term,” Kossovsky said, “because sharp dips are dog whistles for activists, litigators and corporate raiders.”
The root of reputation risk’s tightening grip lies in the politicizing of business, and consumers’ increased desire to buy from companies that share their values. Social media may not be driving that trend, but it acts as a vehicle for it.
“Social media has really changed the game in terms of brand equity, and has given people another way to choose who they give their money to,” Howard of Willis Towers Watson said.
Platforms like Twitter make it easier for consumers to directly reach out to big companies and allow news to travel at warp speed.
“Social media are communication channels that can take a story and make it widely available. In that regard, the media risk is no different than that posed by a newspaper or radio channel,” Kossovsky said.
“The difference today that changes the strategy for risk managers and boards is that social media has been weaponized: Stories shared on social media don’t necessarily have to contain truthful content, and there’s not always an obvious difference between what’s true and what’s not.”
Helen Chue, Facebook’s global risk manager, agreed.
“More influential than social media platforms is today’s culture of immediacy and headlines. Because we are inundated with information from so many sources, we scan the headlines, form our opinions and go from there,” she said.
“It’s dangerous to draw conclusions without taking a balanced approach, but who has the time and patience to sift through all the different viewpoints?”
An environment of political divisiveness, driven by speed and immediacy of social media, creates the risk that false or half-true stories are disseminated before companies have a chance to clarify. This is what happened to Uber and New Balance.
“It creates the opportunity to turn a non-problem into a problem,” Kossovksy said.
“That’s how social media changes the calculus of risk management.”
The best way to battle both political pressure and social media’s speed is through an ironclad communication strategy; a process that risk managers can lead.
“Risk managers play a crucial role in mitigating reputation risk,” Howard said.
“They bring with them the discipline of managing and monitoring a risk, having a plan and responding to crisis. Now they really have to partner with communications, marketing and PR.”
They also have to get the attention of their board of directors.
“If you let a gap form between what you say and what you do, that gap is the definition of reputation risk.” — Nir Kossovksy, CEO of Steel City Re
“This is both a company-wide risk and personal leadership risk, so the board needs to drive a company-wide policy that protects the board as well,” Kossovsky said.
The art of mitigating reputation risk, he said, comes down to managing expectations. Corporate communications should clearly convey what a company believes and what it does not believe; what it can do and what it can’t do. And those stated values need to align with the operational reality. It comes down to creating credibility and legitimacy.
“If you let a gap form between what you say and what you do, that gap is the definition of reputation risk,” he said. A strong communication strategy can prevent adverse events from turning into reputational threats.
Willis Towers Watson helps clients test their strategies through a table-top exercise in which they have to respond to a social media-driven reputation event.
“We’ll say, ‘Something happened with X product, and now everyone’s on Twitter lambasting you and calling for resignations, etc.’ What do you do on day one? What do you do a week out? How long do you continue to monitor it and keep it on your radar?” Howard said.
“If you have that plan in place, you can fine-tune it going forward as circumstances change.”
Sometimes, though, the communication strategy fails, and a company falls short of meeting stakeholders’ expectations. Now it’s time for crisis management.
“Volatility creates vulnerability. If you stumble on your corporate message, it creates an opportunity for activists, litigators and corporate raiders to exploit. So you need to have authoritative third parties who can attest to your credibility and affirm the truth of the situation to open-minded stakeholders,” Kossovsky said.
Owning up to any mistakes, reaffirming the truth and being as transparent as possible will be key in any response plan.
Recouping dollars lost from reputation damage requires a blend of mathematics with a little magic. While some traditional products are available, reputation risk is, for the most part, an intangible and uninsurable risk.
“Many companies have leveraged their captive insurance companies in the absence of traditional reputation products in the marketplace,” said Derrick Easton, managing director, alternative risk transfer solutions practice, Willis Towers Watson.
“It goes back to measuring a loss that can include lost revenue, or increased costs. Some companies build indexes in the same way we might create an index for a weather product, using rainfall or wind speed. For reputation, we might use stock price or a more refined index,” he said.
“If we can measure a potential loss, we can build a financing structure.”
Some insurers, including Allianz and Tokiomarine Kiln, and Steel City Re, an MGA, do offer reputation policies. When these fit a company’s needs, they have the ancillary benefit of affirming quality of governance and sending a signal that the insured is prepared to defend itself.
“Because reputation assurance is only available to companies that have demonstrated sound governance processes, it helps to convince people that if a bad piece of news happens, it’s idiosyncratic; it doesn’t reflect what the company really stands for,” Kossovsky of Steel City Re said.
“And it tells activists, broadly defined, not to look for low-hanging fruit here.”
In a volatile political environment, companies fare best when they simply tell the truth.
“The American public will accept an apology if delivered quickly and if it’s sincere,” said Stephen Greyser, Richard P. Chapman professor (marketing/communications) emeritus, of the Harvard Business School.
“Tell the truth. Don’t stonewall. A bad social media campaign can be an embarrassment, but if you stick to the facts and apologize when you need to, people forget about the bad quickly.”
“Reputation is the crown jewel,” Chue said. “Given the power of social media’s reach, one individual can have a tsunami-like influence. And it can happen when you least expect it, and it will probably be something you thought was innocuous or even positive that sets off a maelstrom.
“Plan for the worst-case scenario. Be proactive in your plans to mitigate the aftermath and how to communicate. Own up to error. Be transparent. Salvage your crown jewel.” &