The UK government has published its first Cyber-security strategy that ‘explains what the government will be doing to ensure [cyberspace's] safety, security and resilience’.

This precedent is another reminder that UK society is increasingly taking advantage of, and relying upon, digital and communications technology.

The document puts the average cost of a security-information incident at between £10,000 and £20,000 for a small company; and £1 to £2m for large companies with more than 500 employees; and that the incident can be perpetrated by a range of individuals or organisations (source: BERR Information Security Breaches Survey 2008, PwC). 

The perpetrators can include criminals, terrorists and states. They can use a variety of methods: from electronic attacks to gain or deny access to information and subversion of supply chains to more overt attacks, such as manipulating radio signals or damaging unprotected electronic equipment through high power radio transmissions.

The report indicates that the impact will vary according to the target and wider context and that the probability of these attacks occurring increases when a so-called ‘insider’ within the target organisation is involved.

Two new governmental structures will be created, one of which will be entitled the Cyber Security Operations Centre (CSOC) and will help to ‘ensure coherent dissemination of information across government, industry, international partners, and the public’. 

This may become a useful resource for insurers wanting to keep track of cyber risks that could impact their books.
Another source of information that may be useful to insurers is the Centre for the Protection of National Infrastructure (CPNI) which ‘has built up strong partnerships with private sector organisations across national infrastructure, creating a trusted environment where confidential information can be shared for mutual benefit’. Such information may help insurers to better assess their digital risk portfolio and their own operational risk.

The Lloyd’s Emerging Risks team is currently investigating the potential impact on insurance of an increasingly digital economy and society and will soon publish a summary report.

Related links
Cyber-security strategy launched, BBC news, 25 June 2009

Tags: Cyber, Digital risks

The Atlantic Tropical Storm and Hurricane Season officially begins on 1 June. With less than two weeks to go we thought this an opportune time to give you an update on how some of the most respected forecasters see the 2009 season.

In recent years the first named storm of the season has actually begun outside of the ‘official’ season. Last year Tropical Storm Arthur formed in the Gulf of Mexico on the 31 May. In 2007, Subtropical Storm Andrea and Tropical Storm Barry both formed before 1 June.

It’s time to turn our attention to 2009 activity, and again, sooner than perhaps we had originally anticipated—Dr Jeff Masters’ Weather Underground blog  flagged up one storm to keep an eye on from the morning of 19 May.  The storm didn’t develop into a tropical storm, however, an interesting precursor to the season, as some areas in Florida are deluged by rainfall.

Historically, we’ve seen how forecasters have changed their forecasts over the season, and we’ll look to provide an update on this situation later this summer. However, as the season begins, here’s the latest from some of the more highly respected forecaster organisations:

The hurricane forecasters are predicting an average season, with an average/slightly above number of tropical storms and hurricanes forming when compared to the 1950-2000 baseline.

With reference to the heightened activity observed from 1995-2008, we may well be looking at an average season.

Just because the forecasts predict an average season, it doesn’t mean that the (re)insurance industry should sit back and relax: it’s not the number of storms that count, it’s the intensity and also if landfall is made.

So as ever, insurers and reinsurers need to keep a close eye as the season progresses. And let’s not forget that although we may have a focus on the Atlantic season, the Pacific Typhoon season  is also in progress—and from a nat cat perspective, every day is earthquake season…

Tags: Hurricanes

A spurious (yet timely) titled lead into an area of the catastrophe bond market that is often over looked—namely, the mortality catastrophe bond market.

The recent incidence of Swine flu has brought some attention to the mortality bond market, and cat bond market issuers and investors will doubtless be keeping a watchful eye on the development of the outbreak with some interest.

Artemis.bm  reports that there are currently somewhere between USD1.5-2bn of outstanding mortality bonds in the cat bond market. The majority of these bonds have been issued by Swiss Re (via the Vita Capital Series), and most recently by Munich Re in February 2008, with USD100m of risk transferred to the capital markets. Other notable issuers include Axa and Scottish Life.

How material an issue is the current outbreak for bond investors and issuers?

It is clearly far too early to state, given that we are in the early stages of the pandemic. However, it may be useful to provide some context. An extreme mortality bond pays out to the sponsoring insurer if the mortality index to which it is linked exceeds a certain rate, typically 20% or more above what is expected for a given population.

The 1918 Spanish influenza pandemic, in which more than 50m people died, is the benchmark by which all modern pandemics are measured. And for any bond to be triggered, we would expect to see mortality rates of this order (ie millions not hundreds or thousands). The early news stories around the current Swine flu has some interesting characteristics, including a higher mortality rate when compared to 1918, although as at 30th April, only one fatality has been reported outside of Mexico.

The Insurance Information Institute estimated in 2006 that even a moderate avian flu pandemic could cost the US life insurance industry $31bn in additional death claims, while a pandemic on the scale of 1918 could cost $133bn.

The market has yet to see any impact on bond pricing – primarily due to a) the magnitude of the fatalities to date, and b) the geographic areas impacted (ie limited to Mexico). There may be far more concern if the number of reported cases increases exponentially and begins to impact the US and western Europe in particlar.

So the market will continue to watch the developing situation with interest, as will we all…

Tags: Bonds, Flu, Natural catastrophes, Pandemic

The Emerging Risks Team at Lloyd’s has been looking at the economic and insurance impacts of pandemics and published a report into the possible insurance impacts of a pandemic (pdf) in 2008, which was also summarised in this recent CII think piece (pdf) .   

The current strain of flu that’s causing concern is of the H1N1 type; different to the H5N1 strain (or ‘bird flu’) that made the news several years ago.  The new strain is from a mixture of a swine virus, human flu and, in fact, bird flu.

According to the World Health Organization the majority of people will not have immunity unless they work with pigs.  Once a strain is isolated work on a vaccine can begin but this is likely to take several months to prepare. 

In the meantime antivirals (which help to suppress the full effect of the virus) can be prescribed; it appears that oseltamivir and zanamivir are effective.  A key concern is that a virus will have immunity to antivirals; but at the moment this appears not to be the case, which is fortunate.

The current WHO ‘preparedness phase’ has now been raised to level 4.  The WHO is not recommending travel or trade restrictions.  They have already concluded that containment of the outbreak will not be possible because it has already been identified in many locations. They stress that a pandemic is not inevitable but that it is now more likely.

The excellent on line encyclopedia wikipedia once again shows its worth with an article  that shows suspected cases around the world. These are being mapped live (below) and include unconfirmed cases ranging from the US, UK, Spain to New Zealand.

View H1N1 Swine Flu in a larger map

Note that only 45 cases have been laboratory confirmed with another 1807 cases only “influenza like”.  According to the Centres For Disease Control and Prevention there are small number of confirmed cases from the east to west coast of the US (see graphic).

Restricting the view to just Mexico we see 152 deaths out of 2761 cases, which is appears to be a “case fatality rate” of over 5% (compared to 2.5% for the 1918 “Spanish flu” virus which killed tens of millions, though lower than bird flu which is still at a worrying 60%). 

The case fatality is the percentage of people who are ill with the flu who go on to die from it.  It is likely that a number of cases are unreported (whereas deaths are likely to be tracked accurately) so the true case fatality rate is probably lower than the basic statistics suggest; time will tell.  As you can expect there is some conflicting information on numbers with wikipedia showing 50 confirmed cases in the US and the CFC showing 40.

In the event of a major pandemic the insurance industry will potentially have to cope with an variety of claims, while it is still reeling from its own business continuity problems. Life and health insurers will be directly impacted but less immediately obvious losses could arise, from medical malpractice to event cancellation.

One of the key issues raised is that a major pandemic is thought likely to cause a global recession – given the current financial state of the world’s economy a pandemic could not be worse timed.  At present however, there is good reason to hope the impact of this flu will be manageable; we will continue to monitor the situation.

Tags: Flu, Pandemic

Against the backdrop of economic malaise, the preservation of capital is critically important for insurance companies. Capital is precious and post-event reloads are much harder than they used to be. Add to this poor investment returns, currency volatility & recessionary claims inflation and it’s easy to appreciate the importance of robustly managing catastrophe risk profiles to within insurer’s risk appetites - surprises are certainly not welcomed by boards of directors, shareholders, rating agencies nor regulators.

The Exposure Management team at Lloyd’s is tasked with understanding and managing the aggregation of risks both within syndicates and across the market, and we are currently looking for an experienced  new colleague to bring the team up to full complement.

If you have the right experience and are interested in joining a dynamic team, more details about the role can be found at jobs.lloyds.com (Ref: 441).

Tags: vacancy

Whenever disaster strikes there is a natural desire to understand the extent of damage and cost implications as well as the scale of human tragedy.

While it may take many months before the full extent of insurance claims are known, the (re)insurance industry, analysts and regulators are keen to know asap how badly each company has been impacted. To fill the information void, the big three catastrophe modelling companies scramble to publish real-time loss estimates based on their proprietary model technology and their view of industry exposure. 

But why? Why do they take the enormous downside risk of getting it wrong when there is so much uncertainty pre-landfall and in the first few days following a hurricane event? There is a grave danger of misinforming clients as well as giving cynics license to engage in a bit of model-bashing if they miss the mark.

The answer: they have to. 

First, Real-time loss estimation has been sold as a product feature, targeting both buyers and sellers of Live Cat protection.  Also, supporting certain Insurance Linked Security (ILS) transactions commits model vendors to developing event windfield footprints, damage and loss estimatesto synthetic industry data.

So how well do they do? Naturally all will tell you that they do better than the others! AIR Worldwide feel sufficiently pleased with their performance in Ike that they have released a report comparing their model estimates with the latest figures from PCS. 

Personally, I think Ike demonstrates precisely why model companies should resist the rush to publish early loss estimates.

First, damage to offshore energy interests was unusually high considering the Saffir Simpson cat 2 classification that Ike had, not to mention the enormous scale of the windfield. We have learned from Katrina and Rita that it also takes a while to fully appreciate the extent of claims for damage to subsea interests.

Second, none of the ‘hurricane’ models extend far enough inland to generate meaningful losses to Ohio in the way that Ike did (over $1bn and counting).

Unlike some of the experience of model usage in the banking world, the insurance industry  has benefitted enormously from disciplined adoption of catastrophe modelling technology to support portfolio and capital management. Unfortunately real-time loss estimation is not where the models add real value.

Tags: AIR, cat models, Ike, PCS

2008 will be remembered as a year of significant natural catastrophe losses. Munich Re and Swiss Re have suggested industry losses of between USD40-50bn for 2008 alone, with PCS (Property Claim Services) reporting US losses of around USD25bn. Much of the focus has been headline losses, including Hurricanes Ike and Gustav, and these events have merited special mention in a number of recent (re)insurance year end financial reporting statements.

But there are two more issues worthy of consideration.

The first is that of large/single risk losses. Guy Carpenter has produced a report entitled Man-Made Cats hit USD7bn in 2008 (18th February, 2009) which highlights just how significant large losses have been in the past 12 months, both in respect of size and frequency.

In summary:

“Man-made and technological catastrophes caused around USD7bn in insured losses last year. This put 2008 losses around 46% higher than the annual average of USD4.8bn, according to data from Swiss Re. Nineteen known events resulted in insured losses of more than USD50m each, according to publicly available information. These events occurred in 11 countries, with losses ranging from USD80m to nearly USD2bn”.

Within these losses are significant contributions from business interruption losses – eg USD1.5bn from BHP Billiton and the Apache Varanus Island explosion (all in a USD1.8bn loss). A stark reminder to the insurance community of the requirement to manage these types of large risks, and to maintain control over large  business interruption loss potential.

The second element relates to balance sheet value erosion/deterioration. Swiss Re pre-announced (9th February, 2009) that they had taken a CHF6bn loss on their balance sheet. Swiss are not alone in this regard and year end statements have been punctuated by declining shareholder equity values. Many publicly listed companies have also suffered the ‘double-whammy’ of declining stock values.

Whilst the insurance industry has fared relatively well in comparison to counterparts in the banking sector, again the requirement to rebuild balance sheets and financial robustness will have a marked impact in determining the rating environment going forward. And it is important to note the different dimensions of potential losses that insurance companies are exposed to.

Tags: Financial, Hurricanes, Ike, Large Loss

Insurance Linked Security (ILS) triggers have long included indices based upon industry surveys and loss estimations. In the US the PCS (Property Claim Services) has become the industry benchmark for many Industry Loss Warranty (ILW) and some index traded insurance products. Outside the US, Swiss Re’s Sigma publication has been the recognised index. However, these loss notification media were not designed for this purpose.

There is a new toy in the ILS toyshop.

As the ILS market has rapidly expanded over the past decade, a number of, predominantly European, (re)insurers acting under the auspices of the Chief Risk Officers’ Forum have been investigating the development of a bespoke European loss index. Yesterday Perils AG was announced. Perils’ founding shareholders, who hold equal shares in the firm, include Allianz, AXA, Groupama, Guy Carpenter, Munich Re, PartnerRe, Swiss Re, and Zurich. The company will be fully operational in the latter part of this year, and will offer two main products ‘to subscribers’, which are likely to include insurers, reinsurers, brokers, risk modellers, banks and other insurance industry stakeholders.

These two products are:

1. Aggregated industry-wide insurance exposure data (insured values), which will be catalogued by risk type and CRESTA zones (defined European geographical zones for natural catastrophe insurance). The data will be provided on an annual basis;

2. Industry loss estimates per risk type and CRESTA zones, following large natural catastrophe events.”

The development of this index will remove any perceived ‘moral hazard’ from Swiss Re. Swiss Re have been actively engaged in the ILS space, facilitating trades, buying/selling ILWs, and so forth. By removing the reliance upon a Sigma trigger will ease the reporting burden on Swiss Re, and increase the transparency around the index itself.

 This initiative is to be welcomed and will have some beneficial impacts upon the European insurance industry. But will it be industry-changing? The timing of the release of this product, given the current economic backdrop, will make it challenging for ILS providers to test the water with this index—as this has not been tested in a real cat scenario.

There are associated issues of basis risk given that the index will be based upon a large set of extrapolated exposure/inventory and loss date. The quality will be driven by the information provided by respondents to the questionnaire issued by Perils. The big question remains as to how forthcoming, and timely, this information will be. Improving data quality and maintaining the integrity of the underlying databases will be a significant challenge, and an ongoing issue - as the catastrophe modelling agencies have already found.

I look forward to seeing how this index develops, how widely it will be used (given that this is on a subscription basis rather than ‘free’), and whether it will indeed help to revive the ILS space in Europe this year.

Tags: ILS, ILW, Reinsurance, Swiss Re

I’ve recently become aware of a worrying paper by Robert Repetto called The Climate Crisis and the Adaptation Myth (pdf).

Adaptation is the term used in climate-change circles to refer to actions taken to make infrastructure and processes more resistant and resilient to climate related harm.  Resistance means that whatever the hazard, it will be kept at bay for longer (eg a flood proof membrane to keep flood water out); and resilience means you bounce back quicker after an event (for example by putting kitchens and living spaces upstairs rather than downstairs for buildings in a flood plane).

Repetto’s report notes that many past studies have assumed that developed countries will adapt to climate change, and therefore for low temperature increases caused by climate change, the impacts will be contained. He goes on to show that assumptions don’t appear to match the way human beings and policymakers actually behave. He cites reasons for humans’ less than rational behaviour such as: the perverse incentives of state run insurance, where premium rates are less than the risk requires; or behavioural economics, which includes concepts like ‘anchoring’, where people struggle to move away from previously held beliefs.

He notes that many disaster plans are based on past events rather than forecasts from climate models and have repeatedly been shown to fail because of this.

His final chilling sentences read:

“Without national leadership and concerted efforts to remove these barriers and obstacles, adaptation to climate change is likely to continue to lag. It will be largely reactive rather than anticipatory and preventive, responding to damaging impacts once they have occurred. To say that the United States can adapt to climate change does not imply that the United States will adapt.”

Lloyd’s 360 project, working with Risk Management Solutions, produced a paper (pdf) in September last year on the benefits of adaptation. It showed that sea level rise of just 30cm could double average losses for some exposed properties; but that certain forms of adaptation could bring the risk back down to below current levels.

Repetto’s paper reminds us that even though adaptation can make sense it often happens too late, or not at all.

Repetto’s paper is on this website: www.climateactionproject.com

Tags: Adaptation, Climate change

Google have come up with an innovative use of their search engine.  They have noticed that the number of people making queries like ‘flu symptoms’ is strongly correlated with the number of doctors visits due to the flu in that region.

Google explain their work  and provide a link to this paper (pdf) from Ginsberg et al which gives more details (including a brief mention of other similar studies, some of which use Yahoo! data). 

At first look this result might seem quite obvious.  If a region is in the depths of a flu epidemic it’s hardly surprising that more people than average will search for information about relevant symptoms.

The real power of Google’s research is that the information contained in the queries appears to have predictive power.  In other words they can spot an impending epidemic before it happens. 

According to Ginsberg et al the new Google methods can give useful information some two weeks prior to the traditional monitoring methods by the Centre for Disease Control and Prevention (CDC).  They stress that traditional methods still have their place and are not calling for their new methods to replace them. 

However, they hope that their approach could be very useful for medical authorities in planning for an epidemic before it occurs.  I imagine this would enable the early ordering and deployment of antivirals, for example.

They consider how their approach might fare during a pandemic and stress that their method has not been tested in this scenario.  It may be that heightened public awareness of the flu at such a time will invalidate their method (searches by the ‘concerned well’ may swamp those with early genuine symptoms).  However, if their method is useful in such a scenario it could save many lives. 

Lloyd’s Emerging Risks team have produced a report on Pandemics (pdf, 408kb) and are continuing to monitor this subject for developments.

In any case, Ginsberg et al state that seasonal flu, which occurs annually, is still responsible for up to half a million deaths every year, so any reduction in mortality from this cause would be welcome.

Tags: Flu, Pandemic