The power of 35.

The Insurance Institute for Highway Safety (IIHS) estimates that automatic emergency braking and forward-collision warning features could curtail injury claims by as much as 35%. The California Department of Motor Vehicles estimates that in 35% of crashes the brakes were not applied. It is striking that these two numbers match.

These savings are not surprising. Automatic braking will avoid some accidents altogether. When an accident nevertheless occurs, automatic braking may greatly reduce the speed on impact. As a matter of simple physics, a reduction in speed results in an exponential reduction in the kinetic energy that must be absorbed in a collision. The formula, for those interested, is Kinetic Energy = 1/2mv², where "m" is the mass of the vehicle and "v" is the vehicle's velocity. Thus, a vehicle that collides at 30 mph has only one-fourth the kinetic energy of a vehicle that collides at 60 mph.

While automatic emergency braking and forward-collision warning are standard in some luxury cars and are available as options in many others, 10 automakers have agreed with the National Highway Traffic Administration and the IIHS to establish a time frame for making assisted driving features standard in all cars.

These are significant developments for insurers and for public policy makers.

For insurers, a 35% decrease in injury claims will result in a significant reduction in premium. This may be offset, at least in part, by an increase in the cost of repair for more sophisticated vehicles and the continuing increase in healthcare costs.

Public policy makers should contemplate the potential benefits of a 35% reduction in injuries and deaths because of assisted driving. At present, highway deaths in the U.S. account for 33,000 to 35,000 deaths per year (depending on how one correlates deaths to auto accidents). Over 10 years this is the equivalent to the population of some major cities-St. Louis, Minneapolis, Des Moines or the city of your choice. A 35% reduction would reduce deaths from 33,000 to 21,450. Every year, 11,550 more people would continue to go about their lives. Add a similar reduction in the more than 2.5 million injuries per year, and the public benefit is overwhelming.

These benefits only accrue as assisted driving features find their way into the fleet. This can be a slow process. It is estimated that electronic stability control, which has been available as an option for many years and has been mandatory since 2012, will not reach 95% penetration until 2029. This is because the average age of automobiles is a bit more than 11 years. Thus, anything that can hasten the adoption of these safety features (and others that are to come) benefits everyone.

Encouraging adoption directly implicates insurance. Auto insurance is one of the more expensive costs of owning a car. The cost of these safety features, either as an option or as a standard feature, is also an expense of owning a car. It is critical that savings from the lower frequency and severity of accidents be rapidly passed on to car owners in lower insurance rates, which will help offset the added cost and promote more rapid adoption.

Even when assisted driving features become standard, which will be some years in the future, the majority of the existing fleet may still be on the road for another 11 years or so. Passing substantial insurance savings to potential purchasers will make retiring the old heap more palatable.

Policy makers and regulators can play an important part in facilitating adoption of these safer cars. Laws and regulations that may impede the rapid distribution of insurance savings to insureds should be streamlined. Likewise, some driver-centric rating systems that may distort rates by artificially depressing the weight given to the safety of the vehicle should be reviewed.

Self-driving vehicles of the future have captured the attention of the public and the insurance industry. While many have been looking toward that day, enormous improvements in safety-critical technology are taking place right now. In a sense, the future is already here. Cars are taking over many safety-critical functions from their more fallible drivers. Insurers and policy makers must adjust.

Those interested in a lengthier treatment of this topic can read this article by Thomas Gage and Richard Bishop. And here is a Bloomberg article on a Boston Consulting Group study of the issue.

Hundreds of millions of dollars of claims could shift from group health to workers' compensation as accountable care organizations (ACO) expand under the Affordable Care Act (ACA), according to our new study: Will the Affordable Care Act Shift Claims to Workers' Compensation Payors?

Although pundits have written about "cost shifting" to workers' compensation, a significant and underappreciated effect of the ACA is "case-shifting" from group health to workers' compensation.

The ACA seeks to greatly expand the use of ACOs-where providers are rewarded for meeting cost and quality goals. This effort will expand the use of "capitated" health insurance plans. Under these plans, providers are paid a fixed insurance premium per insured regardless of the amount of care provided to a given patient during the year. Under traditional fee-for-service insurance plans, providers are paid for each individual service rendered.

The question addressed in the study is to what extent do the financial incentives facing providers and their healthcare organizations influence whether a case is deemed to be work-related. In other words, how many cases will get moved to workers' comp, which covers fees for each additional service, from group health, where the fixed fee under capitation means providers wouldn't get any additional payment.

The study found that a back injury was as much as 30% more likely to be called "work-related" (and paid by workers' compensation) if the patient's group health insurance was capitated rather than fee for service. The study can be extrapolated to different states-for example, the study predicts about a $100 million increase in workers' compensation costs in a state like Illinois if the share of capitated patients rises from 12% to 42%.

Case-shifting was more likely in states where a higher percentage of workers were covered by capitated group health plans. In a state where at least 22% of workers had capitated group health plans, the odds of a soft tissue case being called work-related were 31% higher for patients covered by capitated plans than for similar workers covered by fee-for-service group health plans. By contrast, in states where capitation was less common, there was no case-shifting seen. This is more than just the result of having fewer capitated patients seeking care. It also appears that, when capitation was infrequent, the providers were less aware of the financial incentives.

This study relies on workers' compensation and group health medical data coming from a large commercial database. This database is based on a large sample of health insurers and self-insured employers. It includes individuals employed by mostly large employers and insured or administered by a variety of health plans. The database is unique in that, for a given employee, it contains information on both the group health services used and the workers' compensation services used.

For more information about this study, visit http://www.wcrinet.org/result/will_aca_shift_wc_result.html.

When I attended the Insurance Telematics USA conference in Chicago earlier this month, I expected to see much more enthusiasm. I first wrote about Progressive's venture into telematics all the way back in the late 1990s, and technology has improved so much since then that the telematics industry would surely be bragging about its breakout into the mainstream or at least predicting that one was imminent. The idea just makes so much sense: being able to track cars so that insurance risks can be determined very precisely for individual drivers, while even providing feedback that improves driving.

While the telematics technology is, in fact, stunning and while there are reasons for great optimism, what I found was not an industry brimming with confidence. I found an industry still searching for the right business model.

Until the industry solves that problem, progress will remain limited.

The Problem

The current approach to telematics is generally to install a device in a customer's car for six months and have it relay the driver's actions back to the insurer for evaluation. At the end of the six months, the device is uninstalled, and the insurer tells the driver what sort of discount, if any, she will receive based on her driving habits. A key point is that the issue at hand only concerns discounts; insurers have promised that they won't raise rates if they find that someone is a worse risk than expected.

Think about the expense that goes into that model: manufacturing the telematics devices; installing and uninstalling them; and transmitting lots of data over a wireless network on which the insurer has to buy bandwidth.

Now think about the benefits. The prospect of a discount has attracted enough good drivers that, if all telematics-based auto policies were rolled into one company, it would be close to being in the top 10 among auto insurers in the U.S. Ptolemus, a strategy consulting firm, said there are 4.4 million cars in the U.S. carrying usage-based insurance (UBI). That's a lot of cars. But there are 253 million cars and trucks in the U.S., so the market penetration of UBI is just 1.7%. Even in the main ballroom of the conference, full of ardent proponents, only about 5% raised their hands when asked if they had UBI.

Many customers turn out to not be that focused on discounts. They would prefer receiving free access to other services, such as roadside assistance -- but what services customers want, how to bundle those services, etc. has yet to be worked out.

Even if some new package of free services drove 10 times as many people to buy UBI auto policies, telematics wouldn't do much to make roads safer. Insurers are offering incentives to a self-selected group of drivers who are already among the safest on the road but, because insurers have decided they can't raise rates for bad drivers, won't be doing anything about the people who cause a huge portion of the accidents and, thus, the costs.

The current business model works -- barely. The costs are too high, the offering to consumers isn't right and the benefits to insurers are too low.

The Potential

Help is on the way from two main sources, which I have seen drive innovation in industry after industry since I started following the world of information technology almost 30 years ago. One source is what I think of as the power of "free." The other is the power of a platform.

The Power of "Free"

The behavioral economist Dan Ariely has done all sorts of experiments about the power of free and found that it is almost magic. For instance, if someone does volunteer work and you decide to thank him by paying him a little, he will likely cut back on the work he does for you or even stop. Ariely reasons that people evaluate paid work in a hard-nosed way -- how many hours do I work, how hard or skilled is the work, how much do others get paid for this work, etc.? -- and evaluate volunteer work based on altruistic measures, such as the quality of a cause. If you have people evaluate the return from their free work on a paid scale, you'll lose them. Similarly, he says, you can get people to do all kinds of uneconomic things if remove a paltry cost and make something free.

The power of free computing and communication has driven the upheaval of business over the past 30 years, spawning the wide adoption of the Internet, smartphones, etc. and all the business models that have come along with them. (Obviously, we still pay for computers and storage devices, but they are essentially free by comparison with where they were in the 1980s -- a gigabyte of memory, which cost $300,000 then, costs about a penny today. Communication costs have gone way down and are headed toward something approaching free, even though telecom and cable companies will fight a rear guard action as long as they can.)

Now the power of free is coming to telematics, because the cost of acquiring information on drivers is heading toward zero.

In the short term, that will be because of smartphone apps. Although some say the data they generate isn't quite as precise as that from sensors in cars, the apps are good enough for the vast majority of uses, and they cost roughly nothing. There isn't any need to make a dongle for the car and install and uninstall it. Nor is there a need for the insurer to buy a wireless data plan for the car. The app can do most of the analysis on the phone and just send modest amounts of data back to the insurer, using the driver's wireless plan.

In the long term, things will get even better as "connected cars" move into the market. These cars, already connected wirelessly to the Internet, will automatically generate the kind of information that insurers need. Insurers will be able to know what kind of a driver someone is at the moment she applies, rather than having to guess and then wait six months to know for sure.

The Power of a Platform

From the 1950s through the early 1980s, when IBM controlled the computer industry, the pace of innovation was glacial by today's standards. Part of the reason was that the pace let IBM milk maximum profits, but part was also because IBM had to produce what software types would call the "full stack." IBM had to develop the semiconductor technology that allowed for faster processors; design those processors; manufacture the processors; design and manufacture just about all the support chips, especially memory; assemble the mainframes; code the operating system; and generate the major pieces of application software. Everything had to come together, from one company, before the next step in innovation happened.

When the PC came along in 1981, with its open architecture, innovation became a free-for-all. Intel owned the chip, and Microsoft the operating system, but everything else was fair game. Companies flooded into the market, innovating in all kinds of smart ways, especially with applications such as the spreadsheet, and the market took off.

The telematics market is well on its way to making the transition from the IBM mainframe days to the open days of the PC and beyond. Initially, Progressive had to pull an IBM and invent the whole process for telematics from beginning to end. Now, an ecosystem has developed, and all sorts of companies are free to innovate at any part of the process.

Verisk has announced an exchange, to which car makers and insurers can contribute data on drivers and from which they can pull information. GM has said it will contribute data from its OnStar system, and GM has one million 4G-connected cars on the road in the U.S. So, the need for everyone to generate their own data is going away.

The Weather Channel (represented on the panel I moderated at the conference) has information that can correlate bad weather very precisely with driving behavior -- the company is even working to aggregate information on the speed at which cars' wipers are operating, to understand in a very granular way just how severe a storm is in a certain spot.

Many other companies are innovating in new parts of the ecosystem, rather than just focusing on pricing risks better or acquiring customers. For instance, my friend and colleague Stefan Heck, a former director at McKinsey with whom I wrote a book (along with Matt Rogers) about how innovation can overcome resource scarcity, just unveiled an extremely ambitious approach to improving safety, through a company called Nauto. (A writeup in re/code is here.) Agero made a presentation at the conference about how telematics can speed claims processing and cut costs while making customers happy -- essentially, the telematics system notifies the insurer instantly about an accident, so the insurer can provide whatever reassurance and help is necessary, while also sending someone to the scene so fast that it can take control of the process, rather than deferring to, among others, municipal towing companies.

The Future

The power of free and the power of a platform ensure that, before too many years go by, the costs for telematics will drop drastically and the benefits to insurers and customers will increase greatly. That still leaves insurers with the task of figuring out the right offering to customers, but, in my experience, once costs get low enough and lots of innovators get interested, experimentation eventually produces the right business model.

The question to me is: Who will that winner be?

When I attended the Insurance Telematics USA conference in Chicago earlier this month, I expected to see much more enthusiasm. I first wrote about Progressive's venture into telematics all the way back in the late 1990s, and technology has improved so much since then that the telematics industry would surely be bragging about its breakout into the mainstream or at least predicting that one was imminent. The idea just makes so much sense: being able to track cars so that insurance risks can be determined very precisely for individual drivers, while even providing feedback that improves driving.

While the telematics technology is, in fact, stunning and while there are reasons for great optimism, what I found was not an industry brimming with confidence. I found an industry still searching for the right business model.

Until the industry solves that problem, progress will remain limited.

The Problem

The current approach to telematics is generally to install a device in a customer's car for six months and have it relay the driver's actions back to the insurer for evaluation. At the end of the six months, the device is uninstalled, and the insurer tells the driver what sort of discount, if any, she will receive based on her driving habits. A key point is that the issue at hand only concerns discounts; insurers have promised that they won't raise rates if they find that someone is a worse risk than expected.

Think about the expense that goes into that model: manufacturing the telematics devices; installing and uninstalling them; and transmitting lots of data over a wireless network on which the insurer has to buy bandwidth.

Now think about the benefits. The prospect of a discount has attracted enough good drivers that, if all telematics-based auto policies were rolled into one company, it would be close to being in the top 10 among auto insurers in the U.S. Ptolemus, a strategy consulting firm, said there are 4.4 million cars in the U.S. carrying usage-based insurance (UBI). That's a lot of cars. But there are 253 million cars and trucks in the U.S., so the market penetration of UBI is just 1.7%. Even in the main ballroom of the conference, full of ardent proponents, only about 5% raised their hands when asked if they had UBI.

Many customers turn out to not be that focused on discounts. They would prefer receiving free access to other services, such as roadside assistance -- but what services customers want, how to bundle those services, etc. has yet to be worked out.

Even if some new package of free services drove 10 times as many people to buy UBI auto policies, telematics wouldn't do much to make roads safer. Insurers are offering incentives to a self-selected group of drivers who are already among the safest on the road but, because insurers have decided they can't raise rates for bad drivers, won't be doing anything about the people who cause a huge portion of the accidents and, thus, the costs.

The current business model works -- barely. The costs are too high, the offering to consumers isn't right and the benefits to insurers are too low.

The Potential

Help is on the way from two main sources, which I have seen drive innovation in industry after industry since I started following the world of information technology almost 30 years ago. One source is what I think of as the power of "free." The other is the power of a platform.

The Power of "Free"

The behavioral economist Dan Ariely has done all sorts of experiments about the power of free and found that it is almost magic. For instance, if someone does volunteer work and you decide to thank him by paying him a little, he will likely cut back on the work he does for you or even stop. Ariely reasons that people evaluate paid work in a hard-nosed way -- how many hours do I work, how hard or skilled is the work, how much do others get paid for this work, etc.? -- and evaluate volunteer work based on altruistic measures, such as the quality of a cause. If you have people evaluate the return from their free work on a paid scale, you'll lose them. Similarly, he says, you can get people to do all kinds of uneconomic things if remove a paltry cost and make something free.

The power of free computing and communication has driven the upheaval of business over the past 30 years, spawning the wide adoption of the Internet, smartphones, etc. and all the business models that have come along with them. (Obviously, we still pay for computers and storage devices, but they are essentially free by comparison with where they were in the 1980s -- a gigabyte of memory, which cost $300,000 then, costs about a penny today. Communication costs have gone way down and are headed toward something approaching free, even though telecom and cable companies will fight a rear guard action as long as they can.)

Now the power of free is coming to telematics, because the cost of acquiring information on drivers is heading toward zero.

In the short term, that will be because of smartphone apps. Although some say the data they generate isn't quite as precise as that from sensors in cars, the apps are good enough for the vast majority of uses, and they cost roughly nothing. There isn't any need to make a dongle for the car and install and uninstall it. Nor is there a need for the insurer to buy a wireless data plan for the car. The app can do most of the analysis on the phone and just send modest amounts of data back to the insurer, using the driver's wireless plan.

In the long term, things will get even better as "connected cars" move into the market. These cars, already connected wirelessly to the Internet, will automatically generate the kind of information that insurers need. Insurers will be able to know what kind of a driver someone is at the moment she applies, rather than having to guess and then wait six months to know for sure.

The Power of a Platform

From the 1950s through the early 1980s, when IBM controlled the computer industry, the pace of innovation was glacial by today's standards. Part of the reason was that the pace let IBM milk maximum profits, but part was also because IBM had to produce what software types would call the "full stack." IBM had to develop the semiconductor technology that allowed for faster processors; design those processors; manufacture the processors; design and manufacture just about all the support chips, especially memory; assemble the mainframes; code the operating system; and generate the major pieces of application software. Everything had to come together, from one company, before the next step in innovation happened.

When the PC came along in 1981, with its open architecture, innovation became a free-for-all. Intel owned the chip, and Microsoft the operating system, but everything else was fair game. Companies flooded into the market, innovating in all kinds of smart ways, especially with applications such as the spreadsheet, and the market took off.

The telematics market is well on its way to making the transition from the IBM mainframe days to the open days of the PC and beyond. Initially, Progressive had to pull an IBM and invent the whole process for telematics from beginning to end. Now, an ecosystem has developed, and all sorts of companies are free to innovate at any part of the process.

Verisk has announced an exchange, to which car makers and insurers can contribute data on drivers and from which they can pull information. GM has said it will contribute data from its OnStar system, and GM has one million 4G-connected cars on the road in the U.S. So, the need for everyone to generate their own data is going away.

The Weather Channel (represented on the panel I moderated at the conference) has information that can correlate bad weather very precisely with driving behavior -- the company is even working to aggregate information on the speed at which cars' wipers are operating, to understand in a very granular way just how severe a storm is in a certain spot.

Many other companies are innovating in new parts of the ecosystem, rather than just focusing on pricing risks better or acquiring customers. For instance, my friend and colleague Stefan Heck, a former director at McKinsey with whom I wrote a book (along with Matt Rogers) about how innovation can overcome resource scarcity, just unveiled an extremely ambitious approach to improving safety, through a company called Nauto. (A writeup in re/code is here.) Agero made a presentation at the conference about how telematics can speed claims processing and cut costs while making customers happy -- essentially, the telematics system notifies the insurer instantly about an accident, so the insurer can provide whatever reassurance and help is necessary, while also sending someone to the scene so fast that it can take control of the process, rather than deferring to, among others, municipal towing companies.

The Future

The power of free and the power of a platform ensure that, before too many years go by, the costs for telematics will drop drastically and the benefits to insurers and customers will increase greatly. That still leaves insurers with the task of figuring out the right offering to customers, but, in my experience, once costs get low enough and lots of innovators get interested, experimentation eventually produces the right business model.

The question to me is: Who will that winner be?

The passage of the Affordable Care Act in 2010 continues to redefine the employer-sponsored healthcare market. Increased regulatory and fiduciary responsibilities, employer mandates and rising medical premiums have forced employers to evaluate all cost-effective strategies for providing health benefits to employees. One strategy, self-funding, remains an attractive alternative to the traditional fully insured and association-style health plans.

In a self-funded environment, the employer will assume the role of the insurer and agree to pay the medical claims incurred by the plan's members and dependents. A good percentage of self-funded plans will also use reinsurance and captive risk tools to provide protection from both large individual claims and the plan's collective utilization.

While self-funding has gained momentum as a result of healthcare reform, it is not a new concept. In 1999, a Kaiser Family Foundation (KFF) study reported that 44% of employer-sponsored healthcare was self-funded. That number has now reportedly grown to 61% in 2014.

Why Is Everyone So Interested?

Health benefits continue to be one of the greatest expenses for employers. This fact, compounded with the continual rate increases (with little to no justification), leaves employers feeling stuck in an endless cycle. Some also may feel that their employees are a generally healthy group that is a good candidate to self-fund.

Many turn to self-funding because of:

• Lower fixed costs-The majority of the expense is incurred in the payment of actual medical claims, increasing the margin for savings when the plan performs well.
• Improved transparency-An increase in premiums is easier to swallow if the employer can get an accurate understanding of its claims experience. Self-funded health plans provide employers with a tremendous amount of data. Accurate claims data strengthens the group's ability to effectively control spending on claims.
• Control of the plan design-Self-funded health plans are in a better position to adjust benefits and control increased provider costs. Unlike fully insured products, a self-funded plan design can be structured to meet the specific needs of the group and not an insurer's overall population.
• Tax savings-Fully insured premiums continue to jump to accommodate new provisions as a result of the ACA. Self-funded plan sponsors avoid items like the new Health Insurance Industry Tax, which will increase from 2% to 5% in coming years.

With the increased interest comes new strategies and opportunities as the self-funding marketplace evolves. Self-funded plan sponsors are reaping the benefits of evolving provider network and cost containment strategies. Meanwhile, employers that have yet to make the transition see obstacles lessen because of changes in the reinsurance and captive markets.

What Does This Mean for Employer Groups?

Self-Funded Feasibility Studies Are a Must

There is a strong likelihood that every corporation or public entity with 1,000 employees or more has at least heard about self-funding. However, depending on the number of employees on your health plan, it is quite possible that you have not evaluated self-funding, at least in a thorough way.

A deeper look into the composition of employers participating shows us that group size typically has a direct correlation on whether a self-funded strategy is being used. According to the 2014 KFF study, the breakdown of corporations self-funding is:

Historically, size has mattered. While all groups with more than 200 employees have a responsibility to evaluate the method as an alternative, those employer groups in the less-than-200 range are seeing more opportunity to make the transition. Lessening participation thresholds to lease competitive provider networks and new reinsurance and captive products are creating total-cost scenarios where the right employer can realize the advantages of self-funding. It can still be a challenge when certain market dynamics are present (i.e., lack of claims data, available provider network options, pending legislative actions, etc.), but more and more companies are finding success.

One More Step

The large insurance companies have noticed the changing market, as well, of course, and have introduced a number of bundled plans that look like self-funding. These products are typically entirely owned by one entity, like an insurance company or trust, and allow the employer to participate in a pre-determined portion of any surplus when the group experiences lower-than-expected claims. These products are attractive because they pull together under one brand all the component vendors of a self-funded health plan (i.e., claims administrator, network, reinsurance, etc.). These products can be a great first step for employers weary of self-funding through their own independent health plan. The products will allow them to gain insight into their claims performance while alleviating some of the additional work associated with the wholly owned approach.

For those groups already in these products, it may be time to evaluate taking that next step and realizing the benefits of a wholly owned approach. Reinsurance policies with specific advance and monthly aggregate accommodation can give these employers the ability to still limit their maximum exposure, lower their plan's fixed costs and keep all of the savings when the plan performs well.

With the tools available today, any employer group in a packaged, shared funded or full ASO model plan is a candidate to complete the transition to a self-funded plan. While the packaged, branded approaches employed by some of the major insurance companies may work for a season, deconstructing the bundled product may be the next step in the employer's long-term strategy.

Fine-Tuning Your Self-Funded Plan

There are many companies that have been enjoying the benefits of self-funding for years. As a result of the ACA, however, these employers have had to react to escalating medical costs, expensive specialty drugs and increased regulatory and fiduciary responsibilities.

For instance, self-funded health plans typically "lease" provider networks from a large insurance company. But, in 2010, the ACA removed lifetime and annual maximums from health plans, and the number of high-dollar claims has increased substantially. The networks provide discounts on fees, but the question is how important they are given the increasingly large charges they are being applied toward.

Self-funded health plans are adept in using different types of analytics both to measure historical data and to predict outcomes. This has empowered these health plans to fine tune their plans and integrate various cost-containment strategies.

Five years ago, a cyber-attack on your organization would likely have been a quick one-two punch to compromise your firewalls and obtain your customers' personal data. As the risk manager, you would have been informed of the breach by IT staff, determined the severity of the incident and given an account to the company's compliance staff.

Fast forward to today. An attack takes a subsidiary's corporate network offline and threatens the entire firm's email system. Critical product formulas or sales data may have been stolen. You are called to not only provide a report of the incident to the chief information security officer but also to the CFO and CEO. The media and shareholders are clamoring to know how it happened, and the board wants to know how you plan to prevent another one.

Prepared or not, your role has changed as cyber criminals have grown more sophisticated - and more menacing. You can no longer simply react to cyber events. You are a crucial member of cybersecurity task forces and cyber risk strategy teams and are increasingly relied on by the most senior corporate leadership.

You're probably routinely called to be part of the team that develops best practices for assessing, managing and responding to cyber events, on top of ensuring that effective cyber insurance or other risk transfer mechanisms are in place. As regulators, shareholders, customers and others hold senior corporate leadership accountable for cybersecurity, you have to be diligent in identifying, analyzing and anticipating all of your organization's risk exposures.

Four Steps to Cyber Risk Management

To help meet the increasingly difficult and complex challenge of cyber risk management, start with these four tactics:

1. Create an operational risk working group around cyber that includes IT, information security, legal and others. As a risk manager, you're probably uniquely positioned - for example, through risk committees - to pull together a cross section of key stakeholders around an issue such as cybersecurity.
2. Quantify, as much as possible, the costs of a cyber event across all business units. Consider using analysis and assessment tools that quantify impacts by business, sector and other areas.
3. Communicate the potential impact of risks to various stakeholders inside the organization as well as to third-party vendors.
4. Deliver the cyber risk management strategy to the chief information officer or the C-suite/board in a timely manner - and be accountable for maintaining and amending the plan as required.

Heightened awareness of cyber events has enabled risk executives to play an ever-more critical role in their organization's cybersecurity strategy, but only with the right risk management tools can you truly succeed.

This article is part of a series that discusses cyber awareness among key stakeholders. For access to the other cyber articles, please click here.

Insurers, insureds and even their attorneys frequently incorrectly assume that insurance agents and brokers owe fiduciary duties to their insureds. While the law is not completely clear regarding the applicability of agency principles and fiduciary duties in this area, legal precedent can offer some guidance on the issue.

Currently, there is no appellate precedent permitting an insured to sue its agent or broker under a common law action for breach of fiduciary duty. However, the California courts have yet to be willing to rule that the cause of action based on common law agency principles is completely inapplicable to brokers and agents.

Demonstrative of the court's unwillingness to create a bright-line rule is the heavily litigated case of Workmen's Auto Insurance Company v. Guy Carpenter & Co., Inc. In 2011, the court of appeal in Workmen's answered the question regarding fiduciary duties of brokers and agents definitively in the negative, ruling that "an insurance broker cannot be sued for breach of fiduciary duty." The ruling finally provided the guidance and rule necessary to put the issue to rest. However, the relief was short-lived; in 2012, after a rehearing that affirmed the court's ruling, the opinion was vacated and depublished, again leaving the law in this area without any clear precedent to follow. After rehearing, the court deleted the quotation stating the new rule from its summary of opinion, instead stating "these authorities do not close the door on fiduciary duty claims against insurance brokers."

Prior to Workmen's, several cases made steps toward supporting the idea that no fiduciary duty is owed. In Kotlar v. Hartford Fire Insurance Company, the court held an insurance broker need only use reasonable care to represent its client, and declined to apply a higher standard such as that applied to an attorney. The court found that the broker's duties are defined by negligence law, not fiduciary law. In Hydro-Mill Company, Inc. v. Hayward, Tilton & Rolapp Insurance Associates, Inc. the court expanded on Kotlar, finding that the standard of professional negligence applied, but refused to recognize a separate cause of action for breach of fiduciary duty against the insurance broker.

The California Supreme Court previously held in Vu v. Prudential Property & Casualty Insurance Company that the insurer-insured relationship "is not a true 'fiduciary relationship' in the same sense as the relationship between trustee and beneficiary, or attorney and client." The court went on to state that any special or additional duties applicable to the broker or agent were only the result of the unique nature of the insurance contract, and "not because the insurer is a fiduciary." The court in Hydro-Mill applied the concept in Vu, finding that if an insurer does not owe fiduciary duties, then a broker and agent could not.

In Jones v. Grewe, an insured sued its broker for misrepresenting coverage, negligence and breach of fiduciary duty. The court declined to recognize the cause of action for breach of fiduciary duty, holding that the broker had only the obligation to use reasonable care and no fiduciary duty absent an express agreement or a holding out otherwise.

Despite the fact that it appears from these precedents that the courts are unwilling to find a fiduciary duty exists, the California Supreme Court in Liodas v. Sahadi ruled that the existence of a fiduciary relationship could not be ruled upon, as the issue is not one of law, but of fact. This rule appears to be restated in the Workmen's unpublished opinion.

While it is clear the courts are hesitant to find a fiduciary duty is owed by agents and brokers to their insured, the fact remains that it is still a possibility and, under the right circumstances and facts, could be found. Thus, it is important that agents and brokers not only use reasonable care when procuring insurance, but that they do not hold themselves out as being a fiduciary, or expressly agree to the existence of a fiduciary relationship. So long as agents and brokers do not create circumstances in which a fiduciary relationship is agreed to or implied, the law will infer no such relationship exists.

SMA has announced the winners of the 2015 SMA Innovation in Action Awards, recognizing three insurers for truly ground-breaking projects and initiatives with demonstrable real-world impact. In conjunction with the announcement of the winners, SMA published a collection of case studies on all the insurer award submissions this year, showcasing the remarkable innovation taking place in the industry today.

The submissions for the SMA Innovation in Action Award ranged from the introduction of business models to the invention of creative distribution models, along with an array of technology projects that focus on the adoption of maturing and emerging technologies that position insurers to differentiate and win in the industry.

Last year, a chief characteristic of the winners was that they were using maturing technologies like telematics and cloud in unexpected ways to really differentiate their projects and solutions. That pattern shifted among the 2015 winners, who focused on initiatives using several emerging technologies in combination with each other or in combination with maturing technologies. Not long ago, the rate of adoption of emerging technologies that we saw this year would have been unthinkable. Now, insurers are clearly realizing the advantage of implementing emerging technologies in tandem with maturing technologies, as seen in this year’s insurer winners:

Haven Life Insurance Agency

Offers the first solution for purchasing medically underwritten term life insurance online. Haven Life users can calculate their needs, then apply for and start coverage on the Haven Term policy in about 20 minutes. Its sophisticated underwriting algorithms leverage external data sources to render an instant decision on applications. By reinventing the traditional, four- to six-week process of buying life insurance into an entirely online, 20-minute process, Haven Life has successfully streamlined how life insurance policies are sold, underwritten and administered.

The John Hancock Vitality Program

Offers a new approach to life insurance that rewards policyholders for the steps they take to promote their health and wellbeing. The program fosters a revolutionary bond between policyholder and life insurer using interactive emerging technologies like wearables and "gamification." Activities, including exercise and annual health screenings, can be tracked via a mobile app, a dedicated website or a free Fitbit to earn Vitality Points that determine a member’s status for a broad range of rewards and premium savings.

USAA

Is a pioneer in the use of drones in the insurance industry, particularly in P&C claims following natural disasters. In collaboration with the nonprofit Roboticists Without Borders, USAA deployed drones after the Oso, WA, mudslides in 2014 to provide data and imagery to county officials to assist in rebuilding. USAA was also the first insurer to file a request with the FAA for permission to utilize fixed-wing drones for research and development.

These insurers are springboarding into the future with forward-thinking applications that use a wide range of different technologies to differentiate their offerings, the customer experience and company capabilities. Their winning initiatives demonstrate commendable examples of innovation in action.

Picture the scene: You've been waiting to buy tickets to see your favorite band, you finally get hold of some - you're so excited to see them and then they suddenly pull out. What happens next? Usually, fans are left devastated, show organizers have nightmares and an emergency call is put in to the insurers.

So, who picks up the bill in this situation? Well, there is a good chance it's us -- Robertson Taylor is in the business of live entertainment insurance and has brokered nine of the 10 highest-grossing music tours ever. The cancellation of a tour or a band's appearance at a festival is always set to hit the headlines, and it will normally result in a call to us.

When a band pulls out

When this happens, you need to consider the type of event; for example, if it's a festival, a band's cancellation can have little or no impact because tickets can be sold out within minutes of going on the sale, with no band or artist line-up being mentioned -- a cancellation won't stop the event from happening, but partial refunds may have to be considered. Also the band may lose its guarantee. A concert, however, is different. More stakeholders are affected, like the promoter, the agent and the venue.

The tour

Touring is where things get tricky. Decisions rely heavily on the accuracy of the financial forecast generated for the tour, and the size of the claim depends on the size of the event and the artist involved. The largest one-off show we arranged cover for was insured for $22 million, which is still the largest non-appearance policy placed for one show.

On a large production where there is a substantial set construction, and a large amount of crew, the costs can be huge, even just to reschedule. We've had an artist who had to cancel and reschedule several shows, and the claim was tens of millions of dollars because it required the rehiring of venues, crew, equipment and so on.

How much is it to insure a band?

It's all about risk. If insurers think a particular artist is high-risk, then this will be reflected in the cost to insure that artist -- as with any type of insurance. To gauge risk, we look at a number of factors, including the history of touring and any previous losses, health issues, logistical issues such as the tour routing, what happens if key individuals or equipment is not available, etc. Sometimes, insurance might not be available for an artist who has too much of a "history."

The call

This can happen at any time of day or night; I remember a number of times I have been on the phone in the early hours of the morning because there was an urgent incident on the other side of the world. It's important to get on top of the situation quickly, understand what the issue is and then decide what needs to be done to mitigate the situation. If it looks like there could be a big loss involved, then we may need to reach out to the loss adjuster, but they don't always appreciate getting a call at 3 a.m.!

Throughout the process, it's important to continually communicate with the client. We operate in an immediate business where your expertise is required at that particular moment in time. Although we have been in this industry for 38 years, and undoubtedly the music scene has changed, insuring it still has the same unmistakable ability to keep you on your toes.

In today's cyber world, business is done digitally. Trusted cyber relationships between partners must be formed to effectively conduct business and stay at the forefront of innovation and customer service. Having these trusted partnerships comes with a major drawback, however.

Look at it from this perspective: If your organization is the target of a malicious actor, yet they find your defenses too difficult to penetrate, the attacker can use a partner company to find a way in. Depending on the difficulty, the attackers could target multiple third parties in an attempt to gain access to your network.

The important factor to keep in mind here is that just because your organization may have top-notch security practices in place, it does not mean your partners do, and they can be targeted for their valuable insider access to your systems.

Related story: Third-party vendors are the weak links in cybersecurity

Third-party companies, no matter how trivial they may seem to your everyday operations, need to be thoroughly vetted. If they are given secure insider access as part of doing business with your organization, their systems must be reviewed and assessed for security vulnerabilities. The adage, "you're only as strong as your weakest link," could not be more true when it comes to third-party vulnerabilities.

Coming to grips with risk

Partners may think of themselves as unlikely targets, but even your HVAC vendor could be creating a gaping hole in your security network that malicious actors may use to gain access to your sensitive information.

For example, financial enterprises have extremely large networks of third-party vendors and partners, from payment processors and auditors to Internet providers and other financial institutions. Being able to map your third parties' public Internet space and network presence allows you to identify indicators of compromise and risk that paint an accurate depiction of your partners' potential attack surface.

When we think of potential targets for hacking, we naturally think of big companies or government agencies-organizations that have large volumes of critical and sensitive data. But because these organizations typically have the funds and resources to implement sophisticated security, they are usually not the weak link when it comes to an attack.

Because these organizations cannot be easily accessed, malicious actors adjust their attack strategies to use alternate paths to their desired goal-less secured partners with privileged access. Once a vulnerable company is compromised, its trusted access into other partners allows malicious actors to bypass security controls with exploits that didn't work previously. Adversaries now are free to roam the connected partner networks, essentially undetected.

Dealing with the problem

The moral here is that insider threats don't necessarily have to come from within an organization. Trusted third parties, once compromised, create significant security risks to sensitive data. Organizations must look beyond their own defensive perimeters and consider monitoring their partners to better understand their complete attack surface-especially large and complex organizations in which new services are frequently delivered on outward-facing infrastructures.

Understanding the complete attack surface not only provides the intelligence to prevent abuse, but it provides insight into how an attacker may view a path of attack. Additionally, gaining insight into third-party partners, vendors and suppliers is crucial in creating an informed and dynamic risk management program.

Most organizations are busy enough dealing with their own IT infrastructure, so double-checking the risks associated with their partners may not be at the top of their priority list. However, in today's cyber threat landscape, if you don't take into account the security posture of your partners, you will never be able to truly mitigate your risk and are leaving gaps in your defenses for anyone to access your critical information.

This article was written by Jason Lewis. Lewis is the chief collection and intelligence officer at LookingGlass. Lewis is a network analyst who has technology initiatives in the private and public sectors.