Risk Scenario

Babes in Lawsuit Land

A risk manager's improper reporting catches the SEC's attention.
By: | August 30, 2012
Risk Scenarios are created by Risk & Insurance editors along with leading industry partners. The hypothetical, yet realistic stories, showcase emerging risks that can result in significant losses if not properly addressed.

Disclaimer: The events depicted in this scenario are fictitious. Any similarity to any corporation or person, living or dead, is merely coincidental.

Part One

Paul Ferranzo took a deep breath and surveyed the fairway of the Par Four 16th as it banked left and around the stand of maple trees that blocked a player’s view of much of the green. He was strongly tempted to intentionally hook the ball and try to cut 25 yards off of his second shot if he could.


A Tiger Swallowtail butterfly chose that moment to visit the hydrangea bushes next to the ball-washing machine that flanked the tee. Paul tried to blank the butterfly out of his mind. He had $500 on this game and his opponent, who was also his insurance broker, was standing about 25 feet away.

The broker was ostensibly staring at the face of his iPhone, reading a text message, maybe. But if Ferranzo knew him like he thought he did, he knew the broker was secretly wishing Paul would shank one.

“Screw it,” he said to himself. “I’m going to bend this baby.”

Paul settled his feet, dropped his head, drew the head of the driver back and swung through, letting the club face linger on the ball just a millisecond longer than he normally would. He brought his head up just in time to see the ball begin to descend from the peak of the drive. The ball took a nice, midsummer grassy bounce, heading left, just where Paul had wanted it to.

“Holy crap!,” his broker said with a real edge in his voice.

“Wasn’t that great a shot,” Paul said, turning to see his broker still staring at his iPhone.

The broker looked up with concern in his eyes. Then cast a quick glance to where he last saw the golf ball.

“Not that. Don’t you have a distribution center near Lincoln?”

Paul felt ice water enter his bloodstream.

“Yeah, why?”

“Two tornadoes touched down in Lincoln, or just outside of Lincoln, about an hour ago. Big ones, one an F3, the other an F4,” the broker said.


Scenario Partner

“Can you drive?” Paul said, motioning to the golf cart. The broker nodded and headed briskly to the cart, sheathing his driver in his golf bag with practiced alacrity.

By the time they got to the club house, Paul, the risk manager for the Beamish Babe retail line, had learned that the company’s distribution center near Lincoln had been torn that very day into unproductive pieces.

Game over. Game on.

The supply chain implications of the loss of the distribution center were sobering, to say the least. Paul had a feeling the implications were big. He really couldn’t say just how big. It would probably be days before the company knew the full extent of this.

In the back of his mind was the company’s 10K for 2011, which it had published a scant three months ago. The work Paul and the company’s finance committee had put into that report was beyond anything they had ever taken on. But that was the atmosphere these days, with the SEC demanding more and more detail on risk exposures from publicly traded companies.

This supply chain loss loomed large. Paul now worried that the company’s reporting in this area might have been inadequate.

“Who knows,” he said to himself as he drove home for what was probably not going to be a very good night’s sleep. “Who knows what the SEC will make of this,” he said.

“Or the shareholders.”

Part Two


Beamish Babe was publicly traded and had built up its business by being lightning quick to market with the latest style trends. It had stayed on top, even in this tough economy, because management had been aggressive, almost merciless in cost cutting. They’d had to be, it was a jungle out there these days.

That cost cutting, and what it had meant to risk management, was now gnawing at Paul Ferranzo’s belly.

In the past fiscal year, Paul had faithfully carried out the Board of Director’s orders, as carried to him by the CEO, that he exhaustively research and report on the company’s material risks, be they credit, financial, property, operational or reputation; the whole range. His work included interviewing regional vice presidents, members of the treasury, and the company’s corporate communications team, on the whole menu of the company’s risks.

Paul had turned in a report on those risks, which had become the backbone of the Risk Factors section of the company’s 10K.

Paul had done what he could, but there was only so much he could control.

The CFO had his own agenda, as did the procurement arm. After Paul filed his report, with the publication date of the 10K still two months away, procurement had sold to the CFO the idea of cutting down the company’s number of Midwestern distribution centers from two to one.

They would keep Lincoln, shut down Little Rock and then sell that distribution center. No less a company than Apple itself wanted to buy the building and the land.

The CFO loved this move. It represented a $20 million one-shot swing and $7 million annually in savings going forward.

But now look what had happened. The tornadoes had punched out Beamish’s sole Midwestern distribution center.


Early news coverage was taking things in the wrong direction, fast. The mayor of Lincoln was quoted on CNN decrying the number of jobs the tornado had wiped out.

The mayor had pulled a tax increment financing deal together to land the Beamish Babe distribution center and he couldn’t control himself, he painted the loss of the distribution center as a regional economic disaster.

The vice president of the Beamish Babe distribution center stood next to the mayor at the site of the loss, they were friendly after all, and corporate communications had been too slow to foresee all the possible angles and warn him away from the television cameras and the microphones.

“Don’t say anything,” Paul said out loud as he watched the coverage with the CFO. “Don’t say anything.”

But just then a television reporter swung her microphone over to the vice president.

“This is a total loss, I don’t know how we come back from this,” the Beamish vice president said.

Paul and the CFO each gave the other a look that said, “Oh well, there goes that.”

The comments from the vice president and the mayor’s emotional statements had to get the SEC’s attention.

Paul was uneasy but had no time to waste. He wasn’t cc’d on every e-mail but word was getting around that stores in the Midwest and the West were clawing at each other’s eyes for product, putting in orders for inventory that just wasn’t there.

The company was mobilizing to try to shift inventory from the East Coast, but who wanted to under-supply New York, Boston and Miami? Those cats needed to get fed. Procurement could have fun with itself now, Paul thought to himself bitterly.

A review of his notes from his interview with the Midwest regional vice president made Paul more than uneasy. With the business and contingent business interruptions that were piling up now, they had vastly under-reported their possible losses in that area.

The models they’d used just weren’t accurate enough to have predicted a strike this bad.

Paul watched a pair of high school girls dressed in Beamish Babe sweatpants, with the letters “BMB” printed on the back, walk past his office building on their way to the local coffee shop.

“Enjoy them while supplies last, girls,” he said out loud, shaking his head and turning his face back to his computer monitor.

Part Three


It was a few months until the day came when Paul looked up to see Ray Sachs, the CEO of the company, standing in his doorway. Ray, who preferred casual dress, was wearing his ubiquitous designer polo shirt and jeans. In his hands was a two-page letter.

“You got a second?” Ray said.

Like he wouldn’t say yes.

“Sure, Paul said.

Ray stepped into Paul’s office and closed the door.

As he sat down in front of Paul, Ray threw the two-page letter on Paul’s desk.

It was a Wells notice from the United States Securities and Exchange Commission. The letter said that the SEC had begun an investigation into shareholder allegations that Beamish Babe had substantially misrepresented its material risks in its 2011 10K.

“This is on you,” Ray said.

“I know,” Paul said.

Ray had another letter in an envelope in the back pocket of his jeans.

It was Paul’s letter of resignation.

It wasn’t like the supply chain interruptions from the tornadoes that struck Lincoln in June of 2012 had devastated the company because they hadn’t. In terms of what fell to the company’s bottom line, the supply chain issues stemming from the loss of the distribution center had resulted in revenue losses. But it was hard to pin down in exact numbers to what degree.

Company-wide revenues for the first quarter were off 8 percent, though. Net income was off 25 percent. Retail analysts for the investment banks hadn’t seen that coming and the stock price plummeted 15 percent in one day.

In its first quarter release to investors, the company’s corporate communications team gamely tried to spread the blame for the company’s reductions in net income and revenue, but successful shareholder lawsuits have been built on lesser losses and Beamish Babe was just not going to get off Scott-free on this one.

The SEC concluded that the board of directors of Beamish Babe breached its fiduciary responsibilities by accepting and turning in a report to the SEC that underreported its Midwestern property risks and its risks to its supply chain. The SEC used its subpeona powers to order copies of Pauls’ notes from his interviews with his regional vice president.

Those notes clearly showed that Paul and the vice president had relied too much on inconclusive models and had failed to take into account the impacts of possible supply chain interruptions.

For his documented part in failing to fully comprehend and report the risks to the company’s supply chain, the regional vice president was fired.

But Beamish Babe now had problems that firing someone couldn’t fix.

Attorneys for the shareholders picked up the SEC report and threw it at the company’s D&O and E&O policies like a big spear.

The company’s D&O and E&O policies responded, but Beamish Babe’s total cost of risk would never again look the same.


Paul Ferranzo, the risk manager for a large retailer, does a diligent job of documenting his company’s risks in its annual report to the U. S. Securities and Exchange Commission. But Ferranzo ends up losing his job when a sequence of events undermines his company’s best reporting efforts, leading to an SEC investigation.

1. Link procurement and operations to risk management: Many companies struggle when it comes to creating linkage between their risk management departments and other key areas like procurement and operations. When it comes to business and supply-chain interruptions, there is simply too much at risk for risk management to be kept out of the loop when it comes to strategic business decision making like the location of a warehouse, supplier or distribution center.

2. Manage your message: Press accounts and other forms of media exposure, including social media exposure, can have an inordinate amount of influence on the mind sets of shareholders and regulators. Companies should have a crisis-response plan in place that is well-understood by all key players. That response plan should include a strategy for limiting negative media exposure. Beamish Babe should never have let one of its officials near a politician in front of a television camera during a crisis.

3. The SEC means business: In 2010, the SEC broadened is subpoena powers and made them permanent. Instead of working forward and letting business decisions strike the risk managers desk without any foresight, companies need to work backward, in a sense, and operate with the assumption that business decisions that create possible risk exposures will have to be reported on a quarterly basis. Before making a decision, publicly traded companies need to ask themselves, “What exposures will this create that I should report?”

4. Don’t over-rely on catastrophe models: More and more companies are realizing that they must take a hybrid approach to using models in managing risk. The major losses due to tornadoes in the United States in 2011 were a wake-up call for everyone. Models that concentrate mainly on wind storms in Texas, Louisiana and Florida will be of limited use to a company that has key operations in Oklahoma or Kansas. The model hasn’t been made that can predict the kind of tornado and flood damage we saw in 2011.

5. Build a proactive board of directors: Risk committees should include active board members who aren’t afraid to challenge the assumptions and actions of senior management. To ensure that accurate annual and quarterly reports are filed, board members need to have full transparency into and involvement with enterprise risk management. It takes a number of sets of eyes in many cases to adequately assess and report a risk.

Dan Reynolds is editor-in-chief of Risk & Insurance. He can be reached at [email protected]

More from Risk & Insurance

More from Risk & Insurance

Risk Scenario

The Betrayal of Elizabeth

In this Risk Scenario, Risk & Insurance explores what might happen in the event a telemedicine or similar home health visit violates a patient's privacy. What consequences await when a young girl's tele visit goes viral?
By: | October 12, 2020
Risk Scenarios are created by Risk & Insurance editors along with leading industry partners. The hypothetical, yet realistic stories, showcase emerging risks that can result in significant losses if not properly addressed.

Disclaimer: The events depicted in this scenario are fictitious. Any similarity to any corporation or person, living or dead, is merely coincidental.


Elizabeth Cunningham seemingly had it all. The daughter of two well-established professionals — her father was a personal injury attorney, her mother, also an attorney, had her own estate planning practice — she grew up in a house in Maryland horse country with lots of love and the financial security that can iron out at least some of life’s problems.

Tall, good-looking and talented, Elizabeth was moving through her junior year at the University of Pennsylvania in seemingly good order; check that, very good order, by all appearances.

Her pre-med grades were outstanding. Despite the heavy load of her course work, she’d even managed to place in the Penn Relays in the mile, in the spring of her sophomore season, in May of 2019.

But the winter of 2019/2020 brought challenges, challenges that festered below the surface, known only to her and a couple of close friends.

First came betrayal at the hands of her boyfriend, Tom, right around Thanksgiving. She saw a message pop up on his phone from Rebecca, a young woman she thought was their friend. As it turned out, Rebecca and Tom had been intimate together, and both seemed game to do it again.

Reeling, her holiday mood shattered and her relationship with Tom fractured, Elizabeth was beset by deep feelings of anxiety. As the winter gray became more dense and forbidding, the anxiety grew.

Fed up, she broke up with Tom just after Christmas. What looked like a promising start to 2020 now didn’t feel as joyous.

Right around the end of the year, she plucked a copy of her father’s New York Times from the table in his study. A budding physician, her eyes were drawn to a piece about an outbreak of a highly contagious virus in Wuhan, China.

“Sounds dreadful,” she said to herself.

Within three months, anxiety gnawed at Elizabeth daily as she sat cloistered in her family’s house in Bel Air, Maryland.

It didn’t help matters that her brother, Billy, a high school senior and a constant thorn in her side, was cloistered with her.

She felt like she was suffocating.

One night in early May, feeling shutdown and unable to bring herself to tell her parents about her true condition, Elizabeth reached out to her family physician for help.

Dr. Johnson had been Elizabeth’s doctor for a number of years and, being from a small town, Elizabeth had grown up and gone to school with Dr. Johnson’s son Evan. In fact, back in high school, Evan had asked Elizabeth out once. Not interested, Elizabeth had declined Evan’s advances and did not give this a second thought.

Dr. Johnson’s practice had recently been acquired by a Virginia-based hospital system, Medwell, so when Elizabeth called the office, she was first patched through to Medwell’s receptionist/scheduling service. Within 30 minutes, an online Telehealth consult had been arranged for her to speak directly with Dr. Johnson.

Due to the pandemic, Dr. Johnson called from the office in her home. The doctor was kind. She was practiced.

“So can you tell me what’s going on?” she said.

Elizabeth took a deep breath. She tried to fight what was happening. But she could not. Tears started streaming down her face.

“It’s just… It’s just…” she managed to stammer.

The doctor waited patiently. “It’s okay,” she said. “Just take your time.”

Elizabeth took a deep breath. “It’s like I can’t manage my own mind anymore. It’s nonstop. It won’t turn off…”

More tears streamed down her face.

Patiently, with compassion, the doctor walked Elizabeth through what she might be experiencing. The doctor recommended a follow-up with Medwell’s psychology department.

“Okay,” Elizabeth said, some semblance of relief passing through her.

Unbeknownst to Dr. Johnson, her office door had not been completely closed. During the telehealth call, Evan stopped by his mother’s office to ask her a question. Before knocking he overheard Elizabeth talking and decided to listen in.


As Elizabeth was finding the courage to open up to Dr. Johnson about her psychological condition, Evan was recording her with his smartphone through a crack in the doorway.

Spurred by who knows what — his attraction to her, his irritation at being rejected, the idleness of the COVID quarantine — it really didn’t matter. Evan posted his recording of Elizabeth to his Instagram feed.

#CantManageMyMind, #CrazyGirl, #HelpMeDoctorImBeautiful is just some of what followed.

Elizabeth and Evan were both well-liked and very well connected on social media. The posts, shares and reactions that followed Evan’s digital betrayal numbered in the hundreds. Each one of them a knife into the already troubled soul of Elizabeth Cunningham.

By noon of the following day, her well-connected father unleashed the dogs of war.

Rand Davis, the risk manager for the Medwell Health System, a 15-hospital health care company based in Alexandria, Virginia was just finishing lunch when he got a call from the company’s general counsel, Emily Vittorio.

“Yes?” Rand said. He and Emily were accustomed to being quick and blunt with each other. They didn’t have time for much else.

“I just picked up a notice of intent to sue from a personal injury attorney in Bel Air, Maryland. It seems his daughter was in a teleconference with one of our docs. She was experiencing anxiety, the daughter that is. The doctor’s son recorded the call and posted it to social media.”

“Great. Thanks, kid,” Rand said.

“His attorneys want to initiate a discovery dialogue on Monday,” Emily said.

It was Thursday. Rand’s dreams of slipping onto his fishing boat over the weekend evaporated, just like that. He closed his eyes and tilted his face up to the heavens.

Wasn’t it enough that he and the other members of the C-suite fought tooth and nail to keep thousands of people safe and treat them during the COVID-crisis?

He’d watched the explosion in the use of telemedicine with a mixture of awe and alarm. On the one hand, they were saving lives. On the other hand, they were opening themselves to exposures under the Health Insurance Portability and Accountability Act. He just knew it.

He and his colleagues tried to do the right thing. But what they were doing, overwhelmed as they were, was simply not enough.


Within the space of two weeks, the torture suffered by Elizabeth Cunningham grew into a class action against Medwell.

In addition to the violation of her privacy, the investigation by Mr. Cunningham’s attorneys revealed the following:

Medwell’s telemedicine component, as needed and well-intended as it was, lacked a viable informed consent protocol.

The consultation with Elizabeth, and as it turned out, hundreds of additional patients in Maryland, Pennsylvania and West Virginia, violated telemedicine regulations in all three states.

Numerous practitioners in the system took part in teleconferences with patients in states in which they were not credentialed to provide that service.

Even if Evan hadn’t cracked open Dr. Johnson’s door and surreptitiously recorded her conversation with Elizabeth, the Medwell telehealth system was found to be insecure — yet another violation of HIPAA.

The amount sought in the class action was $100 million. In an era of social inflation, with jury awards that were once unthinkable becoming commonplace, Medwell was standing squarely in the crosshairs of a liability jury decision that was going to devour entire towers of its insurance program.

Adding another layer of certain pain to the equation was that the case would be heard in Baltimore, a jurisdiction where plaintiffs’ attorneys tended to dance out of courtrooms with millions in their pockets.

That fall, Rand sat with his broker on a call with a specialty insurer, talking about renewals of the group’s general liability, cyber and professional liability programs.

“Yeah, we were kind of hoping to keep the increases on all three at less than 25%,” the broker said breezily.

There was a long silence from the underwriters at the other end of the phone.

“To be honest, we’re borderline about being able to offer you any cover at all,” one of the lead underwriters said.

Rand just sat silently and waited for another shoe to drop.

“Well, what can you do?” the broker said, with hope draining from his voice.

The conversation that followed would propel Rand and his broker on the difficult, next to impossible path of trying to find coverage, with general liability underwriters in full retreat, professional liability underwriters looking for double digit increases and cyber underwriters asking very pointed questions about the health system’s risk management.

Elizabeth, a strong young woman with a good support network, would eventually recover from the damage done to her.

Medwell’s relationships with the insurance markets looked like it almost never would. &


Risk & Insurance® partnered with Allied World to produce this scenario. Below are Allied World’s recommendations on how to prevent the losses presented in the scenario. This perspective is not an editorial opinion of Risk & Insurance.®.

The use of telehealth has exponentially accelerated with the advent of COVID-19. Few health care providers were prepared for this shift. Health care organizations should confirm that Telehealth coverage is included in their Medical Professional, General Liability and Cyber policies, and to what extent. Concerns around Telehealth focus on HIPAA compliance and the internal policies in place to meet the federal and state standards and best practices for privacy and quality care. As states open businesses and the crisis abates, will pre-COVID-19 telehealth policies and regulations once again be enforced?

Risk Management Considerations:

The same ethical and standard of care issues around caring for patients face-to-face in an office apply in telehealth settings:

  • maintain a strong patient-physician relationship;
  • protect patient privacy; and
  • seek the best possible outcome.

Telehealth can create challenges around “informed consent.” It is critical to inform patients of the potential benefits and risks of telehealth (including privacy and security), ensure the use of HIPAA compliant platforms and make sure there is a good level of understanding of the scope of telehealth. Providers must be aware of the regulatory and licensure requirements in the state where the patient is located, as well as those of the state in which they are licensed.

A professional and private environment should be maintained for patient privacy and confidentiality. Best practices must be in place and followed. Medical professionals who engage in telehealth should be fully trained in operating the technology. Patients must also be instructed in its use and provided instructions on what to do if there are technical difficulties.

This case study is for illustrative purposes only and is not intended to be a summary of, and does not in any way vary, the actual coverage available to a policyholder under any insurance policy. Actual coverage for specific claims will be determined by the actual policy language and will be based on the specific facts and circumstances of the claim. Consult your insurance advisors or legal counsel for guidance on your organization’s policies and coverage matters and other issues specific to your organization.

This information is provided as a general overview for agents and brokers. Coverage will be underwritten by an insurance subsidiary of Allied World Assurance Company Holdings, Ltd, a Fairfax company (“Allied World”). Such subsidiaries currently carry an A.M. Best rating of “A” (Excellent), a Moody’s rating of “A3” (Good) and a Standard & Poor’s rating of “A-” (Strong), as applicable. Coverage is offered only through licensed agents and brokers. Actual coverage may vary and is subject to policy language as issued. Coverage may not be available in all jurisdictions. Risk management services are provided or arranged through AWAC Services Company, a member company of Allied World. © 2020 Allied World Assurance Company Holdings, Ltd. All rights reserved.

Dan Reynolds is editor-in-chief of Risk & Insurance. He can be reached at [email protected]