Informational Theft: On the Rise

For the first time in history a recent study conducted by Kroll Annual Global Fraud Report, revealed that theft of informational and electronic data has surpassed physical (intrinsic valued) theft. The study released the following statistics:

The findings reveal that theft of information or assets was reported by 27.3% of companies over the past 12 months, up from 18% in 2009. In contrast, reported incidences of theft of physical assets or stock declined slightly from 28% in 2009 to 27.2% in 2010. ("Kroll")

One of the main factors influencing this rise is that informational data is becoming more and more mobile and few companies have the proper controls in place. How many of your employees have a mobile device, a computer, or access to shared files over your computer network? Companies need to regularly evaluate how they are controlling access to information within their organization to ensure they are keeping pace with technological advancement.

According to the Kroll Annual Global Fraud Report, fraud is becoming more prevalent among inside employees. The companies analyzed in the report show that junior employees and senior management were the most likely perpetrators at 22% each, followed by agents or other intermediaries at 11%. The proportion of fraud carried out by these employees ranged from 50% to 60% in North America. ("Kroll")

Now the question arises: I thought I had coverage under my corporate crime policy?

Unfortunately, most carriers are going to deny coverage pointing first to the employee theft insuring agreement. This agreement refers to covered property as "money", "securities", and "other property". The term "other property" is defined as tangible property other than money and securities having intrinsic value. If the data is printed out then it would be considered tangible, but not if it is located on a flash drive, mobile device, or an electronic file.

There are some cases where the crime policy may respond depending upon the claim scenario and the endorsements included on your crime policy. An example where coverage may be available is if one of your employees is working at a client's facility and your employee steals electronic data that causes a financial loss to your client. It is still uncertain rather or not a carrier will pay the insured who can turn around and indemnify their client, even if electronic data is considered a covered property. The "Clients' Property Endorsement" must be included on the policy for the possibility of a claim payout. The endorsement states "that the insurer will pay for loss of money, securities or other property sustained by the named insured's client resulting from theft committed by an identified employee acting alone or in collusion." ("Malecki")

Recommended Risk Management Procedures:

1. Control Access
2. Conduct Due Diligence of partners, vendors, and employees
3. Be relentless in attacking Intellectual Property Piracy
4. Record Trademarks with the US Customs & Border Protection Agency
5. Purchasing a Cyber Liability Policy

Now is the time to ensure that your company is properly protected from informational and data theft.

References:

Kroll. Information Theft At Global Companies Surpasses All Other Forms of Fraud for First Time. 18 October 2010. http://www.kroll.com/news/releases/index.aspx?id=23082

Malecki, Donald. Rough Notes. November 1, 2002.

Law Banning Texting while Driving

You may have already heard, but I wanted to give you a heads up that Cincinnati has now implemented a ban on texting and accessing the internet on your mobile device while driving. Furthermore, Kentucky implemented a similar law back in July.

As a corporate entity it is imperative that your employees do not text or access the internet while driving on company business. If your employees are using their mobile devices while driving they are not only opening the company (and themselves) up to fines, but are also increasing the risk of auto accidents and negligent entrustment law suits. Have you reviewed your motor safety program recently? Have you implemented the proper procedures?

A few statistics to share:

- 80% of auto accidents are caused by driver distraction within 3 seconds of the event.

- 65% of near accidents are caused by driver distraction.

- Estimates show that 57% of drivers text while operating a motor vehicle.

- A study done by the American Automobile Association found that 46% of teenaged drivers text while driving and that 37% say that texting is extremely or very distracting.

http://news.cincinnati.com/article/20101008/NEWS0108/10090319/Chief-Look-for-texting-drivers

Joint Ventures: Possible Coverage Gap?

Due to the economy and other contractual issues, there has been a rise in the use of joint ventures (JV). This has allowed contractors to expand their traditional markets and preserve bonding capacity for other projects. In most cases the joint venture will have its own insurance program in place, but if the limits are inadequate the JV's participants are responsible for additional liabilities. Usually the contractor with the deeper pockets will be called upon to foot the bill (claim).

The standard commercial general liability (CGL) policy provides no coverage with respect to joint ventures that are not listed on the policy; therefore, JV participants will have no coverage under their own policies for liabilities arising out of the JV unless they take proactive steps to include all current and past joint ventures as insureds on the policy. To avoid the possibility of oversights that can produce coverage gaps, contractors can request a blanket joint venture coverage endorsement that provides coverage on an excess basis over policies written specifically for the joint venture. In this way, the contractor receives the full benefit of the coverage provided by the joint venture and also has protection under its own policy after the JV's coverage expires or is exhausted by claims.

Note that the coverage granted by this endorsement applies only to the named insured contractor; neither the joint venture itself nor other participants have coverage under the named insured contractor's policy. However, to reduce the possibility that this policy becomes the sole source of recovery for a claim, the JV agreement should require the other participants to also arrange joint venture coverage on their CGL policies.

Contingency Planning: a "Living Document"

According to a recent study by "American Agent and Broker" 50% of companies have a distaster recovery plan in place, but more than 60% of these companies have not revised the plan or conducted mock drills in the past 12 months.

From my perspective as a risk consultant and broker, the more time a company spends on preparing and planning for recovery the less time they actually spend in the recovery stage. Most insurance buyers know that commercial insurance is a form of catastrophic coverage, but fail to realize is that "insurance" will not address the claim proactively. Taking a proactive approach to a catastrophe will help mitigate the loss and keep the business going through a loss. A proactive approach would include the following:

1. Develop a committee to revise and/or create your company's Contingency Plan. Include your insurance broker on the committee.

2. Conduct a Mock Drill

3. Revise

4. Create a plan for the committee to meet on a semi-regular basis.

Generally, companies that are uprepared suffer two fates from a catastrophe: either they lose income or go out of business.

Enclosed is a guide to Contingency Planning.

Say "NO" to Texting while Driving!

If your company has vehicles on the road then texting while driving is becoming a major risk for you. Talking on a cell phone without a hands free device creates a major risk exposure, but texting while driving poses an even larger threat. This threat not only affects companies that employ drivers and operate fleets, but to others on the road. A Virginia Tech Transportation Institute study found that texting while driving increases the risk of being in an accident by 23 times. As the report states, “Anti-texting laws do not protect businesses from irresponsible employees.”

Due to the increase of accidents caused by distractions (including texting) half of the states in the U.S. have made decisions to outlaw texting while driving. As you know, sometimes a law is not enough to discourage some of your employee’s actions.

So how can you control the actions of your drivers when they’re on the road?

The Solution: TextArrest (https://textarrest.com/)

This is a smart phone application that automatically turns off text messaging and calling functions while the phone is in motion.

The features include:

• Integration with a phone’s GPS system to determine the speed of a moving vehicle.
• Automatic switching off of text messaging and calling functions after a phone is detected to be traveling faster that 5 mph.
• An auto response message from the driver that informs people sending text messages that their messages will be delivered once the user stops driving

Fleet managers and risk managers may want to consider the option of having complete control of their driver’s cell phone use while operating a company vehicle.

Combat Heavy Equipment Theft with Proper Policy and Precautions

Now that spring time is upon us warmer weather is on the horizon - this also means construction season. As temperatures begin to rise, so do occururences of heavy equipment theft.

Businesses engaged in construction, road maintenance and agriculture are alll subject to loss because of stolen equipment. Heavy equipment used in these industries is vulnerable because it is valuable, cases are hard to investigate, it is difficult to recover, easy to steal and relatively easy to re-sell after theft.

To prevent equipment theft, be sure to register all your company's machines (not hand tools) on the National Eqipment Register, which provides a large database of eqipment ownership and theft reports in addition to providing theft prevention advice and reference materials. Also be sure your insurance policies are current and that your most valuable eqipment is scheduled. Often times your equipment list will become dated, so make sure you are analyzing the list every year.

Most commonly stolen equipment:

- Tractors
- Skid Steer Loaders
- Backhole Loaders
- Excavators
- Dozers

The following insurance companies offer incentives for companies that register their equipment:

1. CNA
2. Travelers
3. Allianz
4. Chubb
5. ACE
6. Hartford
7. Great American

For more information please contact me directly or visist the National Equipment Register website.

Hot Work

When you view the term "hot work" some people may think of a contractor working in the middle of the summer or a manufacturer working in a refinery, but the term is derived from a job description. A hot work consists of jobs like welding, cutting, grinding and the use of torches in areas that are not designed for such activities. Many serious fires in business and industry every year are attributed to hot work. Therefore, it is important for every company to have a hot work procedure that will minimize the chance of such a fire.

What are the hazards of hot work?:

1. Flame contact with combustible material
2. Sparks settling in combustible material, often falling through a hole in the floor or wall
3. Heat transmitted through pipes, ducts, or conduit to a remote combustible material
4. Ignition of flammable vapor or dust in the air

Hot Work Precautions:

- All fixed fire protection systems must be in operation
- A Hot Work Premit must be completed and a trained fire watch assigned
- All flammable and combustible material must be kept at least 35 feet away from the job area.
- Combustible material that can not be moved must be protected with fire proof tarps or shields
- Wall and floor openings must be plugged with fire proof material
- Use shields to protect others from weld flash
- Enclosed equipment that contained flammable or combustible material must be cleaned and purged
- If necessary, a Confined Space Entry Permit must be secured

Hot Work Procedures:

1. A Hot Work Permit must be completed and signed for all work involved.

2. The Hot Work Permit must be signed by a supervisor after precautions are taken (permit duration should only be 8 hours)

3. The Hot Work Permit must be displayed at the job site

4. A Fire Watch must be at the job site until 1/2 an hour after the job completion

5. Expired Hot Work Permits are retained for records

SAMPLE HOT WORK PERMIT

Another key component of a hot work procedure is having a fire watcher on duty. A fire watcher is a worker that is trained and assigned to stay in the area of hot work to look for evidence of a fire.

The duties of a fire watcher are:

- Have fire extinguishing equipment available
- Watch for hazardous conditions and stop hot work in the event of a potential fire development
- Continually check areas where a fire could start
- Keep fire proof tarps and shields in place
- Remain in attendence until 1/2 an hour after the job is complete

Lockout/Tagout

Establishing a written Lockout/Tagout policy is an important step for any organization that deals with potentially hazardous energy sources. When servicing or maintaining a machine or equipment an employee faces unexpected energizing, start up, or release of stored energy that could case injury or death.

The preferred safety method is a lockout, which is the placement of a locking device on an energy isolating device that ensures the equipment being controlled can not be operated until the device is removed. Along with a lockout device a warning tag should be placed, which will identify each lock. This tag should not be removed except by the employee who placed it on the equipment at the completion of the work requiring lockout procedure.

A machine or equipment that is not capable of being lockout then a tagout should be utilized. A tagout is the placement of a tag on an energy isolating device to indicate that the device may not be operated until the tagout is removed. If the machine or equipment contains high voltage or pressure two employees should be involved in the process of tagging the device. One employee shall be at the disconnect area, while the other person performs the repair, installation, or testing.

According to OHSA the most critical requirements are:

1. Develop, implement, and enforce an energy control program

2. Use lockout devices for equipment that can be locked out. Tagout devices may be used in lieu of lockout devices only if the tagout program provides employee protection equivalent to that provides through a lockout program.

3. Ensure that new or overhauled equipment is capable of being locked out.

4. Develop, implement, and enforce an effective tagout program if machines or equipment are not capable of being locked out.

5. Document and Evaluate the energy control procedures.

6. Use only lockout/tagout devices authorized for the particular equipment or machinery and ensure that they are durable, standardized, and substantial.

7. Ensure that lockout/tagout devices identify the individual users.

8. Establish a policy that permits only the employee who applied a lockout/tagout device to remove it.

9. Inspect energy control procedures at least annually.

10. Provide effective training as mandated for all employees covered by the standard.

11. Comply with the additional energy control provisions in OHSA standards when machines or equipment must be tested or repositioned when outside contractors work at the site, in group lockout situations, and during shift or personnel changes.

***For further compliance requirements of OHSA standards please refer to Title 29 of the Code of Federal Regulations.***

A sample lockout/tagout policy from the University of Notre Dame can be found here: Sample Policy.


References:
http://www.ohsa.gov/
http://riskmgt.nd.edu/

Why Private Company Management Liability is Important

Management liability claims affect all companies, large and small, public and private. Many connect management liability claims with the front page headlines of MCI Worldcom, Enron, General Motors, Chrysler etc. While these public company management liability claims attract the most attention, there are thousands of private company claims made every year which translate to millions of dollars in settlements and jury awards. Many private company directors and officers feel that due to their non-public filing status the likelihood of a claim is not there. However, the fact is that the directors and officers of private companies are exposed to these claims. They are often involved in day-to-day operations and are the decision makers in most circumstances; therefore, private company directors and officers are more likely to be named in lawsuits brought by employees and others. In closely-held private companies, the owner’s personal net worth may be tied to the financial health of the company making costly D&O liability claims even more destructive.

Private companies may be sued by shareholders and customers, as well as creditors, competitors, government bodies and others. The following points demonstrate why the purchase of directors and officers insurance is very important:

1. Company assets can be closely tied to the personal wealth of directors and officers, making protection for claims brought solely against the company vital.

2. When the company cannot by law indemnify its directors and officers in D&O claims, D&O insurance can step in instead.

3. During the bankruptcy wave of the past 4 years there have been a record amount of creditor claims and bankruptcy trustee claims against bankrupt company boards. Lenders have sought restitution at the expense of the individual board members personal assets.

4. Complex claims brought by competitors, such as anti-trust and unfair competition claims against directors and officers, can generate sky-high defense and settlement costs.

5. Investigations by government and regulatory agencies can generate enormous defense costs, even if no wrongdoing is found. When wrongdoing is found, settlement values are often severe.

6. D&O insurance can protect the personal assets of a director’s or officer’s spouse, as well as the assets of a deceased director’s or officer’s estate.

7. Shareholders of private companies frequently sue for inadequate or inaccurate disclosure in financial reports and statements made in private placement materials.

8. With D&O insurance in place, management can focus on managing the company rather than managing protracted litigation

9. D&O insurance from a quality insurer can take private companies through their IPO and into public ownership well protected. Developing a proven track record with a quality insurer provides an insured with an easier transition into the public D&O insurance market. Private companies with a established relationship with a D&O carrier often receive reduced pricing and expansive terms.


The following scenarios, based on actual claims, illustrate the need for D&O and Private Company Liability Insurance.

SHAREHOLDER SEEKS RESTITUTION

A minority shareholder of a closely–held corporation alleges that the board of directors and certain officers conspired to assist the majority shareholder in maintaining majority control of the company when the minority shareholder attempted to purchase a greater controlling interest.

At trial, a jury awarded the minority shareholder $4.2 million in compensatory damages and $445,000 in plaintiff’s attorney fees.

CREDITOR SUES FOR BREACH OF FIDUCIARY DUTY

A creditor of a Mississippi-based private company sues the company, their board of directors, and the controlling private equity group alleging, among other things, breach of fiduciary duty by the board. The creditor further alleges that the private equity group over-leveraged the company in a desperate attempt to compete against more savvy, well-funded competitors. The result was the company filing for Chapter 11under a mountain of debt and laying off hundreds of employees.

The case settled for $18 million. Defense costs were $2.3 million.

Negligent Entrustment Liability

Negligent entrustment is a cause of action in tort law that arises where one party (Company) is held liable for negligence because they negligently provided another party (Employee) with a dangerous instrumentality, and the employee caused injury to a third party with that instrumentality. The cause of action most frequently arises where a company allows employee to drive a company and/or personal automobile.

With regards to commercial auto, negligent entrustment often arise after a collision where the employee was permitted to drive a vehicle without due regard for their qualification/ability to safely operate the vehicle. Although the driver’s own negligence in causing the accident is usually the primary issue, the two main focuses of investigation of a negligent entrustment charge are:

1. Company’s policies
2. Company’s actual practices

In other words is the company "practicing what it's preaching"?

Once a case is brought forth, the third party must prove the following elements:

1. The driver was incompetent
2. The driver was negligent in the collision
3. The employer should or knew of the driver's incompetence
4. The employer allowed the driver to operate the vehicle

Now what can a company do to lower it's exposure of negligent entrustment?

Here are some recommendations:

1. Written Motor Safety Program (with upper management buy-in)
2. Driver recruiting and selection practices
3. Monitor MVR's and implement a scoring system
4. New driver evaluation and orientation
5. Driver reviews and training
6. Post accident reviews

The following link is an example of a formal motor safety program that can be tailored to your needs: Motor Safety Program. As a reminder the most important aspect of implementing a motor safety program is to have upper management buy-in. With buy-in form upper management these programs will be short lived and ineffective.

Mergers and Acquisitions: Uncovered Liabilities

Due to our firm's business model, we deal with mergers and acquistions quite frequently. Therefore, I wanted to touch on the topic that needs some attention:

Acquisition of Liabilities: A company that acquires another company's assets and liabilities may face the liabilities without the benefits of the acquired company's insurance policies. Therefore, it is important to analyze the acquired company's insurance. For example, does the acquired company have sufficient proof of its historic insurance coverage? Has any of that insurance coverage been exhausted? Have any rights under those insurance policies been released? Furthermore, it is important to analyze the retrospective dates on all claims-made policies to ensure that they are correct when replacing coverage. For example, if a company is acquiring a piece of property that was exposed to remediation efforts in the past it is important to ensure that the pollution policy's retrospective date is correct.

Another creative approach to mitigate accrued liabilities from a merger or acquistion is through a "Loss Portfoloio Transfer/Buyout Program". This will transfer accrued liabilities resulting from past or ongoing operations. This will elimate the uncertainty of adverse loss development, reduce previously established reserves, and increase debt capacity.

Contingent Liabilities: This liability comes into play when a company is trying to acquire another company that is currently in litigation with a third party, and the buyer is concerned about potential successor liability presented by this litigation. Contingent liability insurance can insure the company against this potential successor liability if the target company loses the lawsuit, the selling shareholders of the target company do not satisfy the judgment, and the buyer is held liable as successor to the sellers. This type of coverage is normally underwritten on a case by case basis.

There are other concerns that come into play while dealing with a merger or acquistion situation, but acquired and contingent liabilities are the two most common to keep in mind.

Social Media: What's the Risk?

If ten years ago you mentioned the term social media, people would have looked at you wondering what you were talking about. Today social media is becoming an integral aspect of everyday life. Here are a few staggering statistics as of January 2010:

1. 400m people on Facebook
2. 60m people on Linkedin (average age of 43 with a college degree)
3. 1/3 of all adults have used Twitter

With these statistics in mind, insurance companies have started to examine what exposures a person or business will uncover using social media. The following are some risks that you need to be aware of:

1. Personal injury suits as the result of an unintentional libelous comment on a blog or Web posting.

2. Identity Theft

3. Privacy Liability

4. Theft or Destruction of Data

5. Hacker attachs against Third Parties

6. Crisis Management Expenses

Since 2005, 227 million data records of US residents have been exposed due to security breaches, according to the Privacy Rights Clearinghouse. One high profile case involved TJ Maxx. In January 2007, the US retailer revealed that it had experienced an ‘unauthorised intrusion’ into its computer systems and it later emerged that 46.2 million credit details may have been compromised. Credit card, debit card, check and merchandise return transactions, drivers’ licence numbers, names, and addresses were all exposed in incidents dating back to 2003.


Lloyd’s of London offers the following tips for businesses on how to manage cyber risks:

- Have a formal process in place to update software, firewalls and anti-virus programmes regularly and promptly.

- Safeguard mobile devices that hold sensitive personal data. Encryption is a key tool to do this.

- Safeguard personal information within the workplace, segregating pay information and personal details on a separate part of the network and restricting access to staff on a “least privilege” need to know basis.

- Develop a firm set of operational and procedural guidelines to support security policies and standards that must be followed to maintain security.

- Implement regular staff training on security procedures and employ rigorous staff vetting when hiring.

- Make sure you have a crisis management plan in place which has been rehearsed and can be executed as soon as you detect a potential security breach.

- The first 24 hours of a security breach is critical: implement the crisis plan immediately. Time is of the essence, particularly if regulatory reporting is required.

- Having insurance in place is a big bonus for companies involved in a security breach. In addition to covering many of the major costs, insurers have many of the resources to advise a company on what they need to do, as well as expert contacts to handle the situation expediently.

Employment Practices Liability (EPL): Should I consider it?

Workplace discrimination claims reached a record high in 2009 with claim payouts over $375 million. Please keep in mind that the $375 million does not include the defense costs associated with these claims either. A more staggering fact is that roughly only 1% of all businesses carry EPL. The fragile economy and more worker friendly laws have added to the increased number of employment practice liability claims.

Businesses should not be so exposed, but many small businesses don’t have internal resources, such as in-house counsel and human resources professionals, to establish risk-management policies and procedures, or rigorously document poor employee job performance. Even if you consider a claim to be fraudulent the cost to defend can quickly cause damage to a company's financial stability. Therefore, EPL coverage should be strongly considered by all businesses - small or large.

Common EPL claims are:

1. Workplace Discrimination
2. Sexual Harassment
3. Age Discrimination
4. Wrongful Termination
5. Failure to Hire
6. Failure to Promote

Welcome

This blog was created to give people an insight to common insurance issues, coverages, and updates of the industry. My goal is to cover a new topic every week, so if there is a topic that you would like more information on please email me and I will cover it.