The complexities of the current regulatory environment undoubtedly pose significant challenges for the broad spectrum of financial services companies, as regulators continue to expect management to demonstrate robust oversight, compliance and risk management standards. These challenges are generated at multiple (and sometimes competing) levels of regulatory authority, including local, state, federal and international, as well as, in some cases, by regulatory entities that are new or have been given expanded authority. Their demands are particularly pressing for the largest, most globally active firms, though smaller institutions are also struggling to optimize business models and infrastructures to better address the growing regulatory scrutiny and new expectations. Across the industry, attentions are focused on improving overall financial strength and stability, guided by the recommendations of international standards-setting bodies and U.S. regulatory mandates that encompass governance, culture, risk management, capital and liquidity. Though historically under the purview of individual states, the insurance sector in the U.S. has been responding to influences at both the international and federal levels. The efforts of the International Association of Insurance Supervisors (IAIS) to develop insurance core principles (ICPs), a common framework for the supervision of internationally active insurance groups (IAIGs) and capital standards, have all laid the foundation for global regulatory change. These efforts have been further supported by new authorities given to the Federal Reserve Board, the Financial Stability Oversight Council and the Federal Insurance Office and by the designation of certain nonbank insurance companies as systemically important financial institutions (SIFIs). Following are some of the key regulatory issues we anticipate will have an impact on insurance companies this year: 1. Strengthening Governance and Culture Despite heightened attention from regulators and organizations to strengthen governance structures and risk controls frameworks, instances of misconduct (i.e., professional misbehavior, ethical lapses and compliance failures) continue to be reported across the financial services industry, including the insurance sector, with troubling frequency. Boards and senior management are now expected to define and champion the desired culture within their organizations; establish values, goals, expectations and incentives for employee behavior consistent with that culture; demonstrate that employees understand and abide by the risk management framework; and set a “tone from the top” through their own words and actions. Line and middle managers, who are frequently responsible for implementing organizational changes and strategic initiatives, are expected to be similarly committed, ensuring the “mood in the middle” reflects the tone from the top. Regulators are also assessing an organization’s culture by looking at how organizations implement their business strategies, expecting firms to place the interests of all customers and the integrity of the markets ahead of profit maximization. They will consider business practices and associated customer costs relative to the perceived and demonstrable benefit of an individual product or service to the customer, giving attention to sales incentives and product complexities. State and federal insurance regulators have joined the global push for enhanced governance, and, in 2016, insurers can expect heightened attention in this area through the Federal Reserve Board’s (Federal Reserve) supervision framework and its enhanced prudential standards (EPS) rule; the Financial Industry Regulatory Authority’s (FINRA) targeted review of culture among broker-dealers; and the National Association of Insurance Commissioners’ (NAIC) Corporate Governance Annual Disclosure Model Act, which became effective Jan. 1, 2016, and requires annual reporting following adoption by the individual states. Given the regulatory focus on conduct, insurers might experience some pressures to put in place governance and controls frameworks that specifically recognize and protect the interests of policy holders. 2. Improving Data Quality for Risk Data Aggregation and Risk Reporting Financial institutions continue to struggle with improving their risk-data aggregation, systems and reporting capabilities, which means insurers, in particular, will be challenged to handle any coming changes in regulatory reporting, new accounting pronouncements, enhanced market opportunities and increasing sources of competition because of legacy actuarial and financial reporting systems. These data concerns are augmented by information demands related to emerging issues, such as regulatory interest in affiliated captives. In addition, there are expected requirements of anticipated rulemakings, such as the Department of Labor’s Fiduciary Rule, which necessitates a new methodology or perspective regarding product disclosure requirements and estimations of the viability and benefits of individual products. There is also the Federal Reserve’s single counterparty credit limit (SCCL) rule, which requires organizations, including nonbank SIFIs, to track and evaluate exposure to a single counterparty across the consolidated firm on a daily basis. Quality remains a challenge, with data integrity continually compromised by outmoded technologies, inadequate or poorly documented manual solutions, inconsistent taxonomies, inaccuracies and incompleteness. Going forward, management will need to consider both strategic- level initiatives that facilitate better reporting, such as a regulatory change management strategic framework, and more tactical solutions, such as conducting model validation work, tightening data governance and increasing employee training. By implementing a comprehensive framework that improves governance and emphasizes higher data-quality standards, financial institutions and insurance companies should realize more robust aggregation and reporting capabilities, which, in turn, can enhance managerial decision making and ultimately improve regulatory confidence in the industry’s ability to respond in the event of a crisis. See Also: FinTech: Epicenter of Disruption (Part 1) 3. Harmonizing Approaches to Cybersecurity and Consumer Data Privacy Cybersecurity has become a very real regulatory risk that is distinguished by increasing volume and sophistication. Industries that house significant amounts of personal data (such as financial institutions, insurance companies, healthcare enrollees, higher education organizations and retail companies) are at great risk of large-scale data attacks that could result in serious reputational and financial damage. Financial institutions and insurance companies in the U.S. and around the world, as well as their third- party service providers, are on alert to identify, assess and mitigate cyber risks. Failures in cybersecurity have the potential to have an impact on operations, core processes and reputations but, in the extreme, can undermine the public’s confidence in the financial services industry as a whole. Financial entities are increasingly dependent on information technology and telecommunications to deliver services to their customers (both individuals and businesses), which, as evidenced by recently publicized cyber hacking incidences, can place customer-specific information at risk of exposure. Some firms are responding to this link between cybersecurity and privacy by harmonizing the approach to incidence response, and most have made protecting the security and confidentiality of customer information and records a business and supervisory priority this year. State insurance regulators have a significant role in monitoring insurers’ efforts to protect the data they receive from policyholders and claimants. In addition, they must monitor insurers’ sales of cybersecurity policies and risk management services, which are expected to grow dramatically in the next few years. Insurers are challenged to match capacity demands, which may lead to solvency issues, with buyers’ needs and expectations for these new and complex product offerings. The NAIC, acting through its cybersecurity task force, is collecting data to analyze the growth of cyber-liability coverage and to identify areas of concern in the marketplace. The NAIC has also adopted Principles for Effective Cybersecurity: Insurance Regulatory Guidance for insurers and regulators as well as the Cybersecurity Consumer Bill of Rights for insurance policyholders, beneficiaries and claimants. Insurance regulatory examinations regularly integrate cybersecurity reviews, and regulatory concerns remain focused on consumer protection, insurer solvency and the ability of the insurer to pay claims. 4. Recognizing the Focus on Consumer Protection In the past few years, the Consumer Financial Protection Bureau and the Federal Trade Commission have pursued financial services firms (including nonbanks) to address instances of consumer financial harm resulting from unfair, deceptive or abusive acts or practices. The DOL Fiduciary Rule redefines a “fiduciary” under the Employee Retirement Income Security Act to include persons — brokers, registered investment advisers, insurance agents or other types of advisers — that receive compensation for providing retirement investment advice. Under the rule, such advisers are required to provide impartial advice that is in the best interest of the customer and must address conflicts of interest in providing that advice. Though intended to strengthen consumer protection for retirement investment advice, the rule is also expected to pose wide-ranging strategic, business, product, operational, technology and compliance challenges for advisers. In addition, the Securities and Exchange Commission (SEC) has announced it will issue a rule to establish a fiduciary duty for brokers and dealers that is consistent with the standard of conduct applicable to an investment adviser under the Investment Advisers Act (Uniform Fiduciary Rule). The consistent theme between these two rules is the focus on customer/investor protection, and the rules lay out the regulators’ concern that customers are treated fairly; that they receive investment advice appropriate to their investment profile; that they are not harmed or disadvantaged by complexities in the investments markets; and that they are provided with clear descriptions of the benefits, risks and costs of recommended investments. In anticipation of these changes, advisers are encouraged to review their current practices, including product offerings, commissions structures, policies and procedures to assess compliance with the current guidance (including “suitability standards” for broker/dealers and fiduciary standards for investment advisers, as appropriate) as well as to conduct impact assessments to identify adjustments necessary to comply with the DOL Fiduciary Rule. Such a review should consider a reassessment of business line offerings, product and service strategies and adviser compensation plans. 5. Addressing Pressures From Innovators and New Market Entrants The financial services industry, including the insurance sector, is experiencing increased activity stemming, in large part, from the availability of products and services being introduced to meet the growing demand for efficiency, access and speed. Broadly captioned as financial technology, or FinTech, innovations such as Internet-only financial service companies, virtual currencies, mobile payments, crowdfunding and peer-to-peer lending are changing traditional banking and investment management roles and practices, as well as risk exposures. The fact that many of these innovations are being brought to market outside of the regulated financial services industry — by companies unconstrained by legacy systems, brick-and- mortar infrastructures or regulatory capital and liquidity requirements — places pressures on financial institutions to compete for customers and profitability and raises regulatory concerns around the potential for heightened risk associated with consumer protection, risk management and financial stability. For insurance companies, the DOL Fiduciary Rule will affect the composition of the retirement investment products and advice they currently offer and, as such, creates opportunity for product and service innovation as well as new market entrants. Insurers will want to pursue a reassessment of their business line offerings, product and service strategies, and technology investments to identify possible adjustments that will enhance compliance and responsiveness to market changes. Regulators will be monitoring key drivers of profit and consumer treatment in the sale of new and innovative products developed within and outside of the regulated financial services industry. This piece was co-written by Amy Matsuo, Tracey Whille, David White and Deborah Bailey. 

A session at RIMS 2016 illustrated how to methodically examine and review the right activities in claims audits to improve the bottom line. Speakers in this session were:

• Jenny Novoa, senior director of risk management, Gap
• Joe Picone, claim consulting practice leader, Willis Towers Watson

They explained that, in a claims management context, an audit assesses compliance with the carrier and industry best practices and special handling instructions. A “typical” claim audit determines if the TPA/carrier’s performance is meeting its obligations in the service agreement. It also determines adequacy of reserves, benchmarks the TPA/carrier and adjuster performance, measures against best practices, provides constructive observations and recommends and identifies areas for improvement. A group came together from some major companies including Gap, Foot Locker, Saks/Lord & Taylor, Corvel and Willis Towers Watson to study the claim auditing process. This study explored different areas of the process and was conducted over the course of about a year. The mission of the study was to determine several things, including:

• Does the claim audit fairly measure the outcome of the claim?
• Is there’s a better way to audit the claim?
• How is “outcome” defined?
• What factors are important in defining claims outcome?
• Does a best practice score really equate to a good outcome?

The study group came up with categories of what matters most in the claims process, including: quality of the adjuster, overall health of employee and quality of medical care. They looked at various audit criteria for retail business with the basis for “outcome” being days out of work. They also had a set of specific audit rules. See Also: How to Manage Claims Across Silos The group used a large sample of questions by category and compared the Best Practice Audit (BPA) with the Outcomes-Based Audit (OBA). Results were very different. A few observations from the study:

• BPA audit scores did not identify any of the 28 claims with poor outcomes.
• OBA identified just 10 of the 28 claims with poor outcomes.
• The average OBA audit score was 91, and the average BPA score was 97.
• The OBA overall audit score is much more in line with the overall outcome of the universe of claims audited.

More takeaways:

• The team proved that audits must be designed to really affect not just the performance of the adjuster but all elements of the claims process.
• Review your questions. For example — each question should be individually reviewed with regression analysis to determine correlation levels. Questions that have no correlation should be eliminated and those that do show correlation added.
• Know that BPA can score 100, but the claim can still have a bad outcome.
• OBA is a better predictor of outcomes than BPA.

The group determined the correlation between a best-practice compliance audit score and outcome may be lost if the wrong activities are audited. Critical activities that are never audited may cause poor outcomes in a claim. Again, only when you methodically examine and review the right activities do you improve the bottom line.

This is the third in a four-part series. The first article is here. The second is here. Typically, disruption hits a tipping point at which just less than 50% of the incumbent revenue is lost in about a five-year timeframe. Recent disruptions that provide valuable insight include streaming video’s impact on the video rental market. When broadband in the home reached ubiquity and video compression technology matured, low-cost streaming devices were developed and, within four years, the video rental business was completely transformed. The same pattern can be seen in the Internet-direct insurance model for car insurance. At present, 50% of the revenue from the traditional agent-based distribution model has been moved to direct insurance providers. Revenue at risk will exceed 20% by 2020 According to our survey, the vast majority (83%) of respondents from traditional financial institutions (FIs) believe that part of their business is at risk of being lost to standalone FinTech companies; that figure reaches 95% in the case of banks. In addition, incumbents believe 23% of their business could be at risk because of the further development of FinTech, though FinTech companies anticipate they may be able to acquire 33% of the incumbents’ business. In this regard, the banking and payments industries are feeling more pressure from FinTech companies. Fund transfer and payments industry respondents believe they could lose as much as 28% of their market share, while bankers estimate that banks are likely to lose 24%. A rebalancing of power FinTech companies are not just bringing concrete solutions to a morphing consumer base, they are also empowering customers by providing new services that can be delivered with the use of technological applications. The rise of “digital finance” allows consumers to connect to information anywhere at any time, and digital services can address their needs in a more convenient way than traditional nine-to-five financial advisers can. According to our survey, two-thirds (67%) of the companies ranked pressure on margins as the top FinTech-related threat. One of the key ways FinTechs support the margin pressure point through innovation is step function improvements in operating costs. For instance, the movement to cloud-based platforms not only decreases up-front costs but also reduces continuing infrastructure costs. This may stem from two main scenarios. First, standalone FinTech companies might snatch business opportunities from incumbents, such as when business-to-consumer (B2C) FinTech companies sell their products and services directly to customers and position themselves as more dynamic and agile alternatives to traditional players. Secondly, business-to-business (B2B) FinTech companies might empower specific incumbents through strategic partnerships with the intent to provide better services. FinTech, a source of opportunities FinTech also offers myriad possibilities for the financial services (FS) industry. B2B FinTech companies create real opportunities for incumbents to improve their traditional offerings. For example, white label robo-advisers can improve the customer experience of an independent financial adviser by providing software that helps clients better navigate the investment world. In the insurance industry, a telematics technology provider can help insurers track risks and driving habits and can provide additional services such as pay-as-you-go solutions. Partnerships with FinTech companies could increase the efficiency of incumbent businesses. Indeed, a large majority of respondents (73%) rated cost reduction as the main opportunity related to the rise of FinTech. In this regard, incumbents could simplify and rationalize their core processes, services and products and, consequently, reduce inefficiencies in their operations. But FinTech is not just about cutting costs. Incumbents partnering with FinTech companies could deliver a differentiated offering, improve customer retention and bring in additional revenues. In this regard, 74% of fund transfer and payment institutions consider additional revenues to be an opportunity coming from FinTech. This is already true in the payments industry, where FinTech generates additional revenues through faster and easier payments and digital wallet transactions. This post was co-written by: John Shipman, Dean Nicolacakis, Manoj Kashyap and Steve Davies.

Imagine your recommended medical treatment came with this warning label: “Your results may vary. Your results are not guaranteed. Outcomes can include preventable complications, up to (and including) hospital-acquired infections, hospital readmission and premature death.” Caveat emptor or, "buyer beware,” has never been truer than in today’s healthcare system. The use of evidence-based medicine) protocols delivers higher quality, lower prices and improved outcomes throughout the country for many different treatments. Scientific studies have proven the efficacy of following best-practice guidelines. Achievable results include reduced premature mortality, improved quality of life and better clinical outcomes, which means faster recovery. See Also: Cutting Healthcare Costs Doesn't Lower Quality By no means is this a blanket assertion that the practice of all medicine can be reduced to a checklist, a differential diagnosis and a universal treatment regimen. The seven billion human beings on this planet each have trillions of cells and billions of possible variations. In addition, there are many social determinants of health, including social, economic and physical environmental factors. The fact is, no treatment regimen works 100% of the time on 100% of the people. However, there are proven, evidence-based strategies that effectively deliver higher quality and better outcomes with scale (which means lower costs). Therefore, it is incumbent upon healthcare providers and purchasers to live up to their fiduciary responsibility to act in the best interest of the consumer and the insured employee. So, what happens in the practice of medicine that results in so much variability in treatment? Today’s medicine is part science and part art. Unfortunately, for too many years, perverse reimbursement incentives have clouded and conflicted an industry that requires incredibly nuanced judgment on conditions with many variables and possible outcomes. Outcomes are largely determined by the skill and experience of a physician or team of physicians. Parity may exist in professional sports, but that is not the case in the practice of medicine. As a result, the practice of medicine is significantly influenced by individual providers and their practice patterns, beliefs, biases, needs and preferences, what we call “10 Reasons Why Medical Quality, Price and Outcomes May Vary." See Also: Healthcare Costs: We've Had Enough! Depending on your location, your level of engagement and your particular treatment, the quality, price and outcome are likely to be affected by the actual provider of services. The following list includes 10 reasons why the practice of medicine is driven by the attitude, behavior and skill of the provider: The typical American healthcare consumer still believes he is a patient and acts accordingly to eliminate the illness, not always recognizing the role he plays in his outcomes. The irreversible change taking place is that individuals have to learn to become consumers of healthcare by becoming engaged and taking responsibility for both their life outside the medical system and the choices they make when accessing medical care. The risks are real. Understanding the risk can empower recognition and awareness that acting like a consumer is in your best interest, and that might just save your life. For additional free assistance on avoiding wasteful, unnecessary or poor quality medical tests, treatments or procedures go to www.choosingwisely.org.

At the RIMS 2016 Annual Conference, Kimberly George, senior vice president of Sedgwick, and Scott Daniels, director of disability for Comcast, discussed an approach to managing mental and behavioral health in the workplace. The discussion focused on how Comcast deals with these issues. Comcast has a very diverse workforce, owning a cable company, multiple television networks and even theme parks. Behavioral health claims not only affect your employees directly, but they also can have a significant impact on your business. According to a recent study by IBI, four of the top six employment-related concerns of employers related to the health of their workforce. The study also found that mental health was the second-highest duration of disability diagnosis for their short-term disability programs. Comcast has had 1,300 to 1,600 behavioral health claims per year, paying millions of dollars in benefits. One area of concern for the company is that 60% of those being treated were not being seen by licensed behavioral health experts. Instead, they were being treated by general practitioners who lacked the expertise to adequately address the issues. Comcast is trying to focus on being an advocate for its workers on health issues, and part of that includes assisting them in being treated by the appropriate medical providers. See Also: A New Focus for Health Insurance Comcast’s program is currently focused on the group benefits side. The company hopes to someday expanded to workers’ compensation. If employees have a behavioral health diagnosis, they are required to treat with a practitioner specifically licensed in that area. Comcast does not direct to specific providers but instead work with the employee to help identify providers in the network. The Comcast employee assistance program (EAP) comes into play as the employee can receive a certain number of behavioral health visits under this at no cost to the worker. The program has been in place less than a year, but Comcast is already seeing  significant decreases in duration of disability for behavioral health claims. There is hope that this program can have a positive impact on workers’ compensation claims, as well. Under the EAP program, Comcast can provide the behavioral health treatment outside the workers’ compensation claim to help address the psycho-social issues that could have an impact on the claim. This approach recognizes that you must treat the whole person to effectively manage workers’ compensation claims, and you cannot ignore psycho-social issues that may be affecting the case. One of the first resources that Comcast tapped into in developing its program was its EAP provider. The  provider offers a variety of resources to the workforce, not just in the area of behavioral health but also with a variety of lifestyle issues. The EAP was being underutilized before this program started, but the change in focus helped employees to fully understand the benefits under their EAP. Resilience is a also very important issue that can affect both disabilty and workers’ compensation claims. Comcast is working with a vendor partner to assist employees in developing coping skills and being more resilient. Comcast feels that by strengthening the resilience of its workforce it can significantly reduce all disability in the workplace. Comcast is also using more telehealth, which is yielding positive results. It makes it easier for the employees to receive medical care in a timely manner. This has been especially useful with behavioral therapy. The company is also hoping that the focus on getting the employee the proper care will decrease relapse in disability. Oftentimes, relapse is driven by the employee's not receiving the appropriate treatment. The overall focus at Comcast is establishing a culture of health for the workforce. The company wants employees to engage in the healthcare experience and become educated consumers. The hope is this culture will ultimately lead to healthier employees, which will result in fewer disability and workers’ compensation claims.

At hospitals and clinics across New Jersey, thousands of new doctors could soon be on call — literally. In Trenton, lawmakers are considering two bills that would enable doctors and patients to skip the office visit and conduct appointments using video-conferencing tools like Skype.

They’re right to embrace this kind of technology. The increasing use of “telemedicine” promises to improve patients’ access to doctors and slash healthcare costs.

Virtual medicine makes it a lot easier — and cheaper — to see the doctor. By first consulting with a patient by video, doctors and nurses can determine whether a costly in-person trip to the emergency room or to the doctor’s office is necessary — or whether two aspirin and plenty of rest will do.

See Also: 5 Questions on Telemedicine Coverage

For patients who end up in the hospital, telemedicine can facilitate faster and cheaper convalescence.

Consider a patient recovering from heart surgery. His doctor may want to continuously monitor his blood pressure and pulse. Telemedicine can accomplish that remotely and automatically. That saves the patient the trip and the doctor the time measuring those vital signs.

Telemedicine can also save money. Take a program called Health Buddy, which asks patients daily, tailored questions about their health through a handheld device at home. After reviewing the answers, doctors know when and how to offer care. A study published in Health Affairs found that Health Buddy reduced Medicare spending by as much as 13% per patient.

Other programs offer patients hospital-level care inside their own homes. Doctors and nurses visit one to two times a day while other providers monitor vital signs remotely. Participating patients often require fewer tests and less time under observation, so these “hospital at home” programs can cut costs by 19% compared with conventional inpatient care.

Telemedicine can also alleviate the mental stress of being sick. Someone diagnosed with heart disease, for instance, may understandably worry about his prognosis. That can take a toll on his physical health and jeopardize his chances of recovery.

Healthcare providers can ease these concerns with remote counseling. One such telecounseling program helped cardiovascular disease patients deal with anxiety and depression through video sessions. Over six months, the program reduced hospital admissions by 38% compared with a control group, according to a report published by the American Journal of Managed Care.

Telemedicine can improve healthcare providers’ ability to communicate with one another, too. By connecting doctors with health workers in emergency rooms, for example, telemedicine can prevent 850,000 unnecessary transfers between ERs each year. The savings? More than $530 million.

There’s even evidence that telemedicine can offer care that’s superior to inpatient care. Take Teladoc, a videoconferencing technology that allows patients to consult with a doctor around the clock. According to one study, those who used Teladoc were less likely to need to see the doctor again for the same illness than patients who actually went to the doctor’s office.

Finally, telemedicine may also decrease wait times. American Well, for example, offers a mobile app that allows patients to send out a request for a doctor — much like one does for an Uber — and the first to respond does the consultation via videoconferencing. Over the last three years, the average wait time has been three minutes.

See Also: Questions to Ask on Telemedicine Risk

New Jersey’s lawmakers seem to be paying attention to all this research, particularly Sens. Joe Vitale, D-Middlesex, and Shirley Turner, D-Mercer, and Assembly representatives Pamela Lampitt, D-Burlington-Camden, and Daniel Benson, D-Mercer-Middlesex. One of Lampitt’s bills (A-2668) would establish parity for insurance coverage of telemedicine with conventional in-patient care. A bill sponsored by Vitale (S-291) would allow patients to seek telemedicine services from out-of-state doctors. This latter measure would also permit New Jersey’s Medicaid program to reimburse for telemedicine.

Thus far, the Garden State has been slow to adopt telemedicine. Insurers in many other states already cover it. The American Telemedicine Association recently gave New Jersey six Fs on crucial telemedicine issues, including allowing for the reimbursement of remote patient monitoring and videoconferencing.

State leaders now have the chance to raise those grades. Telemedicine controls costs and improves patients’ health. It’s time for New Jersey to take advantage.

Healthcare Matters sits down with Dr. Richard Anderson, chairman and CEO of the Doctors Company. In Part 1 of the series, he helps us define what “defensive medicine” is, the economic costs associated with it and why he believes it’s a clear violation of the doctor/patient relationship.

In Aldous Huxley's 1931 novel Brave New World, many original ideas were posited about a futuristic society. Two of those ideas, appearing in our present, involve eugenics and an ever-increasing reliance on technology. Techniques like CRISPR (clustered regularly interspaced short palindromic repeats) to genetically engineer a human embryo, and technological advances like self-driving vehicles, could be said to represent some of Huxley's notions. However, professional liability underwriters, especially those underwriting cyber liability and tech E&O, are out of phase with this "brave new world,” and this fact creates a dangerous situation for both those underwriters and an economic world dependent on them. To be responsible and successful in the present and into the future, the professional liability insurance sector must look backward to look forward and, in so doing, create a breed of underwriters who are every bit as creative as the future will be. Being out of sync with present-day reality is clearly represented in questions not asked on cyber liability and tech E&O applications. For instance, one current cyber liability application does not ask what type of firewall an applicant is using. A company can use a simple device with a firewall feature and claim to have a firewall in place, but that device will not come close to equaling the protection offered by a hardware-based NGFW, or Next Generation Firewall. The same application also does not ask if multiple hardware and software ecosystems are used, even though the answer to that question, especially for a medium-sized and large business, offers significant insight into the company’s cyber security approach. Additionally, this particular application does not ask whether an applicant is using the services of a cyber security firm. Those kinds of questions, and the answers to them, convey an enormous amount of information about the cyber security posture of an applicant and, in turn, provide significant insight into whether a risk is worth underwriting and at what cost. For such questions to be missing from an application is dangerous for insurance companies and the clients of those companies. See Also: Space, Aviation Risks and Higher Education The current situation with technology E&O applications is equally worrisome. For example, in the exclusions list on one recently updated technology E&O policy there is no exclusion for computer languages known to be highly prone to cyber breaches. Theoretically, an insured software company could be writing code in Adobe Flash or Java Script, languages that should be avoided. By not excluding those languages, the insurer is exposed to adverse results of claims and lawsuits caused by an insured using hazardous script. Perhaps even worse, this insurer does not exclude wireless products that do not include proper encryption. Thus, if a company that produces baby monitors creates a product that broadcasts the signal in an unencrypted format, claims could arise from a concerned consumer of that product. After all, what reasonable parent would allow anyone to spy on her child? This issue is likely even worse because, time and again, successful lawsuits have already been brought against manufacturers of products that lack proper wireless encryption. The absence of such exclusions to protect itself and to encourage better behavior from its insureds calls into question whether a technology E&O insurer is in sync both with technology and the current legal environment. With underwriters being out of step in the present, one must wonder how they will be able to help drive the world forward in the future. There are other parts of the professional insurance sphere that are not poised well to be in harmony with the future. In the near future, robots will be introduced into social environments like nursing homes. If a robot injects medication into a patient, prescribes a medication or lifts a patient from a wheelchair to a bed, then that takes an already risky situation into an unexplored legal realm. If a patient suffers an adverse reaction to a drug that was injected by a robot, then how will the nursing home be protected by any of its insurance policies? Or, what if a robot is provided by the nursing home to a patient who needs companionship? If the robot malfunctioned and could not be replaced and the patient drew into a depressed state and died, then how would insurance cover a wrongful death suit by the patient’s family? A general liability policy certainly would not cover such an event, and an allied health policy is not currently worded to handle such a risk. What about the manufacturer of that robot? Would a technology E&O policy step forward and indemnify the manufacturer of the robot? Most countries, especially those like China, Japan and the U.S., have populations that possess far more elderly people than younger ones, and there are simply not enough people entering the field of senior care to handle the influx of those who need care in their golden years. This means that robotic companies are going to be filling that void and, in so doing, will create an unprecedented situation that will require the professional insurance sector to provide guidance and protection to the rapidly aging world. To provide that guidance and protection, however, will require professional underwriters to understand the intersection of technology, human care and the law, an intersection with which underwriters are currently less than conversant. So how do insurance companies offering cyber liability, technology E&O and other professional insurance get into sync with the evolving world they are underwriting? There was once an international competition that encouraged students in the seventh through twelfth grades to form groups of two or three people and build educational websites. The competition was known as ThinkQuest. It was supported by both governmental and private organizations, had strong support from educators in more than thirty countries and rewarded the most successful competitors with scholarships of as much as $25,000. A similar approach must now be embraced and championed by the insurance industry. The brilliance of ThinkQuest was that it brought together young people who could appreciate and understand a multitude of ideas, numerous bodies of knowledge and people who were willing to learn and teach at the same time and who could convey their ideas both by the written word and binary. The spectrum of ideas that the groups put forth ranged from examining a social phenomenon like Harry Potter to examining how music affects people’s mental and physical health. To be able to fully appreciate and understand nearly every cyber liability and technology E&O risk requires people who have an uncommon breadth and depth of knowledge that extends from simple areas like grammar to complex areas like quantum mechanics. When an underwriter tries to underwrite a risk like SSA (space situational awareness), to underwrite a risk in which a company produces electronic-photopic chips or to understand memory-resistant malware, that requires a degree of understanding that is clearly not being demonstrated by the majority of the current breed of underwriters. However, the degree of wide-ranging creativity needed here was what the ThinkQuest competitions were created to foster in young people. The insurance industry needs people who can draw from a wide range of knowledge, and it also needs people who can write binary code with exactitude. Insurance companies must employ cyber forensic engineers who can pinpoint where a security breach happened, how an intruder gained access to additional computers and how to remedy the situation. Being able to work individually or in a team, being able to backtrack to the point of intrusion and being able to view the world in tangible and non-tangible ways requires more than someone who can simply write one line of code after another. Currently, insurance companies depend on other companies to investigate data breaches, but this will not work out in the long run. In the 20th century, numerous insurance companies owned law firms to litigate claims economically. The 21st century will require cyber liability insurers to employ cyber forensic engineers to investigate claims based on network breaches. Moreover, in the very near future insurers will need to create an organization that tests routers, switches, servers, smart phones, robots and other technology devices to determine how secure or how capable those devices are. As has already been argued on the PLUS Blog in November 2015, not all technology devices are created with the same expertise, and figuring out which devices are least and most secure will greatly facilitate insurers’ ability to price policies correctly. However, to find young people who can view the computer realm in multiple dimensions, and to find those who can function in a cross-disciplinary environment and approach a risk from a multitude of angles can only be successfully accomplished on a large scale through an instructional competition. People who have a broad and deep appreciation for multiple disciplines and cyber forensic engineers are uncommon, and insurance companies are not the only ones who need such thinkers. cyber security companies, law firms, private and public educational organizations, research organizations, think tanks and governments are just a few sectors that need those type of people. This means that, as difficult as it is already to find thoughtful insurance people knowledgeable about the cyber world, the future is only going to be exponentially more troublesome. When the 20-year-old who is going into her senior year at college thinks about the past and future, what will she strongly consider for a career? Will she remember the competitions that the insurance industry hosted that allowed her to cultivate friends from all over the world, and allowed her to gain the needed assurance in her skills as a programmer or a writer to pursue a major in computer science or history? Will she remember the competitions that helped fund her time at college, and in doing all of that proved that being a cyber liability underwriter is a fulfilling career opportunity? Or will that 20-year-old have nothing to remember where the insurance sector is concerned? The Cyber Security Challenge is one competition that currently aims to increase the pool of cyber forensic engineers; however, it is not an international competition and focuses only on people who are capable of becoming cyber forensic engineers. Professional liability insurers need thinkers and tinkerers, and locating both on a large scale can only be accomplished through a competition like ThinkQuest. Nano-technology, advanced robotics, augmented reality and memory-resident malware are elements of a brave new world that cyber liability and tech E&O insurers are going to come face-to-face with in the short term. In three to five years, insurers are going to encounter robots where none have been before. If insurers do not create and enthusiastically support a competition like ThinkQuest, then insurers will not be acknowledged or remembered by those in college. Consequently, insurers will find themselves without a breed of underwriters who can thrive and understand the brave future. This must not be so!

The politics of guns in America are volatile, divisive and passionate, yet the risks that firearms present to organizations every day do not depend on the politics of the moment. Employers must deal with the reality of gun violence in America. A RIMS 2016 session discussed the legal aspects of what organizations can do and the practical implications of creating a firearms risk management program. Speakers were:

• Michael Lowry, attorney, Thorndal Armstrong Delk Balkenbush & Eisinger
• Danielle Goodgion, director of human resources, Texas de Brazil

What Risks Do Firearms Pose? OSHA states that an employer must provide “employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm to his employees.” See Also: Active Shooter Scenarios There are several risks to your organization, including:

• Operations can halt in the case of a shooting. You have issues like police investigations and possibly injured employees.
• Workers’ compensation will kick in if employees become injured.
• General liability will be activated to cover injuries of non-employees.
• Reputational risks are possibly the largest risks. You do not want your business associated with a violent act.

Most think that the Second Amendment bars private businesses from banning guns, but this is incorrect. The amendment applies to governments, not private homes and businesses. Some employers react by posting signs banning all guns. This simple sign can be a recipe for disaster for several reasons:

• Have you created a duty? If you post a sign, you have officially created a duty.
• Why did you create this policy?
• What are you doing to enforce this policy? Did you have a manual? Did you put up X-ray detectors? Probably not. You have to be able to prove you are enforcing the policy if you post a sign.
• Did you train your employees to enforce this policy? If this policy is not enforced, a person might be injured by a firearm on your property.

"Bring Your Gun to Work" Laws This is not a good idea. According to the law, business may not bar a person who is legally entitled to possess a firearm from possessing a firearm, part of a firearm, ammunition or ammunition component in a vehicle on the property. In Kentucky, an employee may retrieve the firearm in the case of self-defense, defense of another, defense of property or as authorized by the owner, lessee or occupant of the property. In Florida, the employer has been held liable for civil damages if it takes action against an employee exercising this right. Reputational risks also can apply. You could either get special interest groups protesting against your business or people who refuse to do business with you. The Middle Ground It is best to create a policy. Even if you support the right to bear arms, you can do it subtly. There are several provisions on what type of carry you allow and what signs are required. Business owners also do have the ability to allow no guns on the premises. See Also: Broader Approach to Workplace Violence Your policy should describe exactly how to approach a customer if an employee sees a weapon, including who should approach the customer, what to say and the steps to take to address the issue. Training is important. Why Train?

• Researchers from the Harvard School of Public Health and Northeastern University found the rate of mass shootings has tripled since 2011.
• In 2014, an FBI study considered 160 events between 2000 and 2013. 70% occurred in business or educational setting.
• In 2000-2006, the annual average rate was 6.4 shootings. That jumped to 16.4 in 2007-2014.

This is clearly a problem that is getting worse, so why is training rarely provided? Places of business are a target – especially retail, restaurants and businesses in the hospitality industry. The active shooter wants soft, easy targets in large, open, public and crowded areas, and the goal is to kill indiscriminately. If your business is doing well with large crowds, you are a soft target. Active Shooter Resources To learn how to manage this risk, you can find resources from:

• Law enforcement
• Insurance partners
• Government
• Outside experts
• Legal
• Human Resources

Online resources include:

• City of Houston: Run. Hide. Fight. Surviving an Active Shooter Event
• Los Angeles County Sheriff’s Department: Surviving an Active Shooter

My day job at Ribbit.me keeps me insanely busy. Too busy, unfortunately, to spend enough time thinking about one of the more exciting and disruptive impacts of blockchain technology: the breakdown of double-entry bookkeeping. In a previous life, I was a CPA, and I’ve been wanting to put some thoughts out there for a while. I still see very few people talking about the effect on blockchain on bookkeeping despite its potentially bringing into doubt the effectiveness of the most fundamental foundation of commerce today.  Tried and True Double-Entry Bookkeeping Double-entry bookkeeping is the basic foundation of how we account for value today. For 2,000 years it has served as an unquestionable given in commerce. There are two columns, the debit column and the credit column. There are two entries — the first entry is to record what you have, and the second entry is to record how you got it (e.g. debit cash and credit sales). If these aren't equal, we know counterparty exposure has not been properly accounted for, prompting an audit and a correction. It mandates the accounting of counterparty exposure for every single movement of value. It is a beautiful system in its simplicity and effectiveness. See Also: What's In Store for Blockchain But, what happens if the counterparty exposure is not known? What if we don’t know who owns, or is liable for, the value of assets recorded on a ledger? In the old paradigm, this was simply an impossibility. Counterparty claims to assets were always known, because, to receive or send an asset of value, it must be received by or sent to a counterparty! It seems so basic and fundamental, someone would think this could never be questioned. Until now. Permissionless and Permissioned Blockchains Enter blockchain. A blockchain is a single-entry bookkeeping ecosystem. Well, technically a permissionless blockchain is a single-entry bookkeeping ecosystem. A permissionless blockchain is an ecosystem where, obviously, permission is not required to participate. On the other hand, there is the permissioned blockchain. My company Ribbit.me uses a permissioned ledger as its platform. In the permissioned blockchain ecosystem, permission is required for a user to participate. The degree of permission can vary from ecosystem to ecosystem. Permissioned blockchains have come about to facilitate enterprise adoption of blockchain technology. If you want to know why, it's all about counterparty risk. A pure permissionless blockchain ecosystem is a type of distributed autonomous organization (DAO). In a DAO, there is no central authority running the show. Control is decentralized across anonymous users in the distributed network, and anyone can participate as a user. The blockchain does not know or care who the users are. It introduces the real potential for true universal and global financial inclusion. This is great! But, wait, the road to utopia isn’t that simple. An ecosystem of anonymous users means transactions with counterparties of unknown identity. In other words, it means we no longer know the identity of who has ownership of or who has creditor claims to the assets on the ledger. Double-Entry Bookkeeping in Legacy Banking When we deposit money into a bank account, we are transferring value to the bank as custodian of our asset. We still own the asset in our account and, at some point, the bank is required to return the asset to us. On the bank’s ledger, this transaction will result in a debit to cash, an asset account on the left hand side of the ledger and a credit to demand deposits (a liability account on the right hand side of the ledger). Easy-peasy double-entry bookkeeping!  Single-Entry Bookkeeping in a Permissionless Blockchain When a user acquires access to (not ownership of — keep reading to know why) a permissionless blockchain native token, it is effectively doing the same thing as what was described above. It is transferring or depositing value into a ledger wallet. In this case, the bank is replaced with network nodes performing as custodians of a distributed ledger. The depositor and the custodians can also be anonymous. On the permissionless-blockchain-distributed ledger, this transaction is recorded as a debit to the user’s wallet, an asset account on the left side of the ledger and a credit to… what? To answer that question, we need to figure out who is actually liable for the distributed ledger. Well, the network nodes should be, as they are our custodians of the ledger and, therefore, of the value contained within it. Furthermore, since every network node is of equal importance and authority, in theory, every node should equally share the custodianship liability of the assets recorded in the left hand column of the ledger. Anonymous Counterparties We have two problems here. In this ecosystem, both the users and the network nodes are anonymous. And because it is a DAO, there is no centralized owner/operator of the ledger to approach for access to network node identities. The Introduction of Single-Entry Bookkeeping Because the user’s network node counterparty is anonymous, it is impossible to record it as the entity liable for the asset. A search for ledger ownership in the form of a capital account will not be any more fruitful. Remember, this ledger is a DAO. By definition, no single entity owns or operates it. And, just like that, with nobody to attribute liability to and nobody to attribute ownership to, the right hand-side of the credit column disappears. Double-entry bookkeeping collapses. What is left behind is a single-column ledger in a single-entry bookkeeping ecosystem. I omitted one part of the bank-deposit example out of this blockchain example: “We still own the asset in our account, and, at some point, the bank is required to return the asset to us.” This was omitted because there is a possibility that the user can never really own value embodied as a blockchain native token. First, the user’s identity may be anonymous. Second, even if the user chooses to reveal its identity, the value it claims ownership of always resides within the blockchain ledger. It is literally impossible to have physical possession of the value. To do so would require a counterparty to request the returning of the user’s value to it. Paradoxically, the deeper one’s understanding of double-entry bookkeeping, the more difficult it may be to understand all of this. More than once, I’ve spent more than an hour trying explain this to university accounting professors and professional-practicing CPAs. They are so close to double-entry bookkeeping that asking them to question it is something akin to asking a physicist to question gravity. It’s like they say: Don’t try this at home, kids! Entirely New Challenges and Risks Cognitive dissonance aside, blockchain has introduced a new age of single-entry bookkeeping. This has opened a Pandora’s box of entirely new challenges and risks that are brought about by undefinable asset ownership/liability and unquantifiable counterparty risk. These are not just new challenges and risks for the transaction counterparties but for the regulators mandated to oversee it all. See Also: What Is and What Isn't a Blockchain? Challenges for Enterprise Adoption If the user is an individual, as sole proprietor of its person, it can make decisions regarding risk exposure on its own behalf. But can a corporate director? Can a corporate director authorize the use of shareholder capital for an anonymous counterparty transaction in a single-entry ledger ecosystem without violating its fiduciary duty to those shareholders? Can a regulator determine (with confidence) that a regulated entity in the same transaction is not in violation of KYC/AML or anti-terrorism financing laws? These are very important questions that have yet to be answered and that risk managers must demand answers to. Entirely New Accounting Standards Are Needed Once considered the boring bedrock of commerce, accounting as a discipline is now entering an era of uncertainty at the most fundamental level. This will force us to redefine how value is accounted for. This brings new opportunities — as we will soon see, single-entry bookkeeping will emerge as a new discipline of study and research. There will be a real market need to innovate standards that allow us to account for value in the new paradigm. This probably terrifies the accountants out there. But in reality it is good, as it is human innovation itself that is true source of wealth creation. If I have sparked an interest, feel free to reach out! You may very well be a pencil-pushing geek just like me.