Download

The Right Way to Enumerate Risks

Managers often think about risks too broadly, when they need to focus on specific events they hope to prevent.

November 4, 2014

In my experience, there are a number of traps that organizations fall into when they are identifying the risks they face. The traps make it very difficult to manage the risks. #1 – The Broad Statement Some organizations fall into the trap of capturing “risks” that are broad statements as opposed to events or incidents. Examples include: • Reputation damage; • Compliance failure; • Fraud • Environment damage These terms tell us nothing and cannot be managed – even at a strategic level. Knowing that you might face, say, reputation damage doesn't help you understand what might hurt your reputation or how you prevent those incidents from happening. #2 – Causes as Risk The most common issue I see with risk registers is that many organizations fall into the trap of capturing “risks” that are actually causes as opposed to events/incidents. The wording that indicates a cause as opposed to a risk include: • Lack of …. (trained staff; funding; policy direction; maintenance; planning; communication). • Ineffective …. (staff training; internal audit; policy implementation; contract management; communication). • Insufficient …. (time allocated for planning; resources applied). • Inefficient …. (use of resources; procedures). • Inadequate …. (training; procedures). • Failure to…. (disclose conflicts; follow procedures; understand requirements). • Poor….. (project management; inventory management; procurement practices). • Excessive …. (reporting requirements; administration; oversight). • Inaccurate…. (records; recording of outcomes). These "risks" also tell us very little and, once again, cannot be managed. Knowing that you might face a lack of training, for instance, doesn't tell you what incidents might occur as a result or help you prevent them. #3 – Consequences as Risk Another trap that organizations fall into when identifying risk is capturing “risks” that are actually consequences as opposed to events or incidents. Examples include: • Project does not meet schedule; • Department does not meet its stated objectives • Overspending Once again – these are not able to be managed. Having a project not meet schedule is the result of a series of problems, but understanding the potential result doesn't help you prevent it. So, if these are the traps that organizations fall into, then what should our list of risks look like? The answer is simple – they need to be events. I look at it this way – when something goes wrong like a plane crash, a train derailment, a food poisoning outbreak, major fraud .etc. it is always an event. After the event, there is analysis to determine what happened, why it happened, what could have stopped it from happening and what can be done to try to keep it from happening in the future. Risk management is no different – we are just trying to anticipate and stop the incident before it happens. The table below shows the similarities between risk management and post-event analysis:

To that end, risk analysis can be viewed as post-event analysis before the event's occurring. The rule of thumb I use is that if the risk in your register could not have a post-event analysis conducted on it if it happened – then it is not a risk! If you apply this approach to your list of risks events, you will: • Reduce the number of risks in your risk register considerably; and (more importantly) • Make it a lot easier to manage those risks. Try it with your risk register and see what results you get. A Risk Is a Risk Commonly, people talk of different types of risk: strategic risk, operational risk, security risk, safety risk, project risk, etc. Segregating these risks and managing them separately can actually diminish your risk-management efforts. What you need to understand about risk and risk management is that a risk is a risk is a risk -- the only thing that differs is the context within which you manage that risk. All risks are events, and each has a range of consequences that need to be identified and analyzed to gain a full understanding. For example; You have a group identifying hazard risks, isolated from the risk-management team (a common occurrence), and they tend to look at possible consequences in one dimension only – the harm that may be caused. Decisions on how to handle the risk will be made based on this assessment. What hasn’t been done, however, is to assess the consequence against all of the organizational impact areas that you find in your consequence matrix. As a result, the assessment of that risk may not be correct; for instance, there may be significant consequences in terms of compliance that don't show up as an issue in terms of safety. If you only look at risk in one dimension, you may make a decision that creates a downstream risk that is worse than the event you're trying to prevent. For instance, you may mitigate a safety-related risk but create an even greater security risk. The moral of the story: Managing risk in silos will diminish risk management within your organization. In about 80% of cases, you can’t do anything about the consequences of the event; what you are trying to do is stop the event from happening in the first place.

Rod Farrar

Rod Farrar is an accomplished risk consultant. His knowledge of the risk management domain was initially informed through his 20 years of service as an army officer in varying project, security and operational roles. Subsequent to that, he has spent eight years as a professional risk manager and trainer.

Life & Health

Let's Tone Down Hope for 'Wearables'

Devices like FitBit and the Apple watch hold great promise for our health, but they won't have much of an effect for many years.

Paul Carroll

November 4, 2014

There is an old line in Silicon Valley: “Never confuse a clear view with a short distance.” We should keep that in mind as we think about wearable devices such as the Apple watch that are designed, among other things, to help us monitor and improve our health. The view is crystal clear, but we’re still a long way from getting to the destination. The vision is idyllic: Some day, a wearable device will monitor all our vital signs and relay the information second by second to a healthcare provider, where some combination of computers and doctors will monitor it. We’ll know two weeks ahead of time that we’re about to have a heart attack and will be able to head it off. Doctors, who currently spend only about seven minutes a year with the average patient, will mine the stream of information, spot chronic issues in more people and get them treatment for, say, high blood pressure. Our knowledge about health will increase exponentially because so many aspects of so many people will be tracked, and in real time. Researchers say the change in health will be like what has happened with cars. We used to wait until we saw steam coming out from under the hood, then fix whatever was wrong. Those cars lasted 60,000 or 70,000 miles. Now we have sensors all over the place in cars, learn about problems before they become acute and gather voluminous data on what works and what doesn’t, so cars can keep getting better. As a result, many cars last more than 200,000 miles. With people, once we can get those sensors “under the hood,” we should also see huge improvements in health and life expectancy – engine performance, too. But three major things have to happen before we achieve that idyllic vision, and only one is even close to reality. The one change that could at least plausibly happen soon is that people adopt wearables en masse. No more of this buy a Fitbit, wear it for a couple of months and then set it aside. At least millions of people, and maybe tens of millions, will have to buy wearable devices and keep them on 24/7 for basically forever, just to really get the movement started. That sort of adoption will require smaller and better-designed wearables and far better battery life – the early line on the Apple watch is that it won’t even go a full day on a charge. Makers of wearables will also have to agree on standards so that all health data can be integrated into any software and analyzed by any healthcare provider. At the moment, every wearable maker wants to own the standard, and standards fights can take years to sort out, but with Apple working its magic on consumers and with Microsoft introducing a well-regarded device, it’s at least possible to imagine mass adoption within a few years. That’s the easiest problem. The most severe problem is that wearables aren’t yet close to collecting the really useful information. Wearables can monitor your pulse and provide a reasonable estimate of how many steps you take, but that’s not the good stuff, as far as medicine is concerned. I got a tutorial on this almost 15 years ago from Astro Teller, who cofounded Body Media, a pioneer in the wearables field. He said the data he really needed was blood pressure and information from blood tests. Astro is a seriously smart fellow – the grandson of the principal developer of the hydrogen bomb, Edward Teller, Astro has since 2010 been directing the Google X laboratory, meaning he has the Google Glass, driverless car and many other cutting-edge projects reporting to him – but Body Media never cracked the code before being acquired by Jawbone for $110 million, principally for its patents, in 2013. While there are glimmerings of progress all over, no breakthrough seems especially close. Google, for one, has a project in the Google X lab that puts sensors in contact lenses that can measure blood sugar and send a constant, wireless signal to a wearable device, giving diabetics a noninvasive way to monitor themselves. But the technology must now be calibrated for different conditions. What if the wearer is crying? What if the weather is dry? What if it’s raining? It’s not clear how close to market the technology is. Others talk about having people swallow sensors that would roam the bloodstream and report on all kinds of conditions, including watching out for cancer, but those are far enough out that they still read like science fiction. A company has a prototype of a device that would measure blood pressure constantly, but, even if that proves workable, the device needs to go through multiple iterations and become tiny enough that it can fit into a general-use device – people may wear one health-related device on an arm, but they won’t wear two or three or four. The final hurdle that has to be cleared is doctors and other practitioners. When I talk to doctors about the idyllic vision for the future of healthcare, they look at me like I have two heads. They’re feeling swamped just trying to keep up in a world where they see the average patient a few minutes a year, and their problems will only get worse if talk of a physician shortage proves true. Now we want them to go from seven minutes a year to 525,600 (the number of minutes in a year) for each patient? Yeah, right. Even if doctors and other practitioners sign up for this new world of healthcare, every support system will have to change. Computer systems will have to be set up to do the vast majority of monitoring. Software will have to be written. A new class of data analysts will have to be developed. Health practices will have to reshape themselves around data streams. Insurers will have to adjust coverage. Courts will have to sort out where liability for mistakes falls – with a programmer, a doctor, someone else? You could start the clock now on all these changes in medical practices, and they’d still take years to sort out. The key issue to monitor in the progress of wearables is the sensors. Once someone can easily capture blood pressure information or conduct some important blood test without breaking the skin, well, then we’re talking. At that point, consumer adoption will be a solvable problem. So will adoption by medical professionals, though that will be a long slog. In the meantime, we will soon be able to buy our Apple watches, and we’ll have fun with them. We might even get a little healthier if we keep wearing the things and somehow feel the need to walk a bit more. But that shiny vision of a world where care, insurance and everything else about health changes because of wearables? That’s still a long way out there.

Paul Carroll

Paul Carroll is the editor-in-chief of Insurance Thought Leadership.

He is also co-author of A Brief History of a Perfect Future: Inventing the Future We Can Proudly Leave Our Kids by 2050 and Billion Dollar Lessons: What You Can Learn From the Most Inexcusable Business Failures of the Last 25 Years and the author of a best-seller on IBM, published in 1993.

Carroll spent 17 years at the Wall Street Journal as an editor and reporter; he was nominated twice for the Pulitzer Prize. He later was a finalist for a National Magazine Award.

Commercial Lines

How to Win in Commercial Lines

With nontraditional competitors appearing and with Millennials changing the customer mix, working the market cycles is no longer enough.

Dax Craig

November 3, 2014

Commercial lines insurance is tricky. On the one hand, it’s one of the last bastions of niche underwriting expertise -- there are specialist writers who know their markets better than anyone else and enjoy customer loyalty and consistently superior profits as a result. On the other hand, it’s still simply insurance — and it’s experiencing many of the same symptoms that the rest of the P&C insurance industry is facing:

Increasingly sophisticated underwriting and pricing models, opening the door to adverse selection
An ever-shrinking number of market-dominating insurers
An evolving marketplace, with technology companies entering insurance and a customer base increasingly made up of Millennials

These three issues are forcing fundamental changes in the way insurers operate, creating a dynamic in which there will be clear winners and losers. It’s important to recognize the changing conditions to be successful both today and in the future. New players entering insurance A look at recent headlines reveals some well-recognized brands that are now turning an eye toward insurance. Tech companies like Google and Facebook, e-commerce giants like Amazon and Overstock and retailers such as Walmart and IKEA are all making waves. It’s also not just personal lines that’s being affected; Overstock’s new insurance agency offers business insurance, including workers' compensation. Why is there a sudden interest from new players? These companies oftentimes see opportunities for profit and growth in industries when there are fundamental inefficiencies that can be exploited, and generally start by employing data-driven strategies to compete on customer acquisition. Insurance executives understand this threat, as evidenced in a recent survey by the Economist that identified distribution (i.e., acquisition of customers) as the No. 1 vulnerability for disruption. What’s particularly troubling is that half the respondents in the survey were unsure of how well prepared the industry is for the changes coming in the next five years. With competition from non-traditional companies that are technologically savvy, are trusted by consumers and have money to burn, insurers simply cannot afford to be uncertain about their future. Catering to a new generation Numbering 76.6 million in the U.S., Millennials are the largest population in the country. Unfortunately for the industry, this group also happens to be the demographic most dissatisfied with insurance products and services. The U.S. Census Bureau notes that Millennials represent $1.68 trillion in annual purchasing power, which means insurance has no choice but to adapt to the needs of their future customers, business owners and employees. The industry tends to categorize Millennials as a personal lines concern (homeowners and personal auto, specifically), but commercial lines will fall behind and be caught off guard without a new mindset. Although insurance doesn’t carry the best reputation among Millennials, there is an opportunity to educate them and win their loyalty. According to a poll by the Griffith Insurance Education Foundation, Millennials know very little about the insurance industry -- 80% of students answered that they didn’t know anything about the industry at all (and only 5% claimed to be very knowledgeable. This is likely why Millennials tend to purchase insurance from companies with easy-to-navigate websites and don’t always base decisions based on price alone, according to a 2014 J.D. Power survey. If insurers don’t make the Millennial generation a priority, the likelihood of them buying insurance from other companies with better name recognition grows more and more likely, even if that company isn’t a traditional insurer. The risk of adverse selection grows as insurers get smarter The increased use of advanced technologies among insurers spells trouble for those that are still playing catch up -- the risk of adverse selection grows as competitors leverage predictive modeling techniques and gain access to new data sources that provide a broader view of the market. As analytics becomes more pervasive in commercial lines underwriting, leading insurers will become more adept at increasing their market share. Insurers without advanced analytical tools are more likely to bind higher-risk policyholders at inadequate rates and less likely to bind lower-risk policies by failing to match their competitor’s lower-price offering. Adverse selection is an insidious threat, because it’s completely invisible until well after it has infected a portfolio. Accurate pricing and superior risk selection are key, and predictive techniques have served as an important competitive advantage, going beyond traditional heuristics alone. How winners gain their advantage Workers’ compensation is, in many ways, a leading example for the rest of commercial lines. Combined ratios continue to decrease, making it more attractive for companies (both traditional and non-traditional) to come in. This crowds the market, forcing the industry to adopt more sophisticated competitive strategies. When properly developed and implemented, the use of predictive models is a recipe for success. It helps to achieve the pricing precision needed to stay ahead of the competition while avoiding adverse selection in the marketplace. Insurers without the ability to identify and react to adverse selection will lose their competitive advantage and simply not survive. As we’ll share in Valen’s annual outlook report for commercial lines this week, the benefit to using the latest analytical tools are huge, and the cost of doing nothing is equally as significant. Working the hard and soft market cycles no longer brings competitive differentiation -- the competition is fierce in target market segments ,where superior risk selection and pricing clearly determines who the winners and losers are. This article first appeared on WorkCompWire.

Dax Craig

Dax Craig is the co-founder, president and CEO of Valen Analytics. Based in Denver, Valen is a provider of proprietary data, analytics and predictive modeling to help all insurance carriers manage and drive underwriting profitability.

Going Digital

The Power of Crowdsourcing

Traditional companies, such as insurers, must quickly adapt to the new models, or they will fall by the wayside.

Denise Garth

November 3, 2014

From Ben Franklin (inventor of the lightning rod and bifocals) to Thomas Edison (the phonograph and popular form of the incandescent light bulb) to Tim Berners-Lee (the World Wide Web)/Internet, inventions have spawned new generations of ideas and disrupted, transformed and created businesses. That process continues. . . but at a much faster pace, with smart phones, social media, the Internet of Things and much more. Today, there is the shared economy movement, built around crowdsourcing and open innovation. There is no turning back … only moving forward. Now, we instantly interact with businesses and individuals on different mobile devices. Collaboration via the Internet has quickly become mainstream in our daily lives, both personally and professionally. Mass collaboration is rising to new heights via crowdsourcing and open innovation, creating transformative outcomes. Crowdsourcing enables companies to tap into the power of the masses and communities, while open innovation helps identify, develop and market new ideas, products, services and more within these communities. Together, the combination obliterates the traditional internal, hierarchical or linear thinking and development approaches and creates an entirely new playing field that accelerates the execution of innovation within organizations. Just a few years ago, crowdsourcing was viewed as a method for ideation – a method to have people collaborate online, in an open forum, to develop the best ideas. But today crowdsourcing has moved well past this to new, more sophisticated and disruptive levels. Crowdsourcing is eliminating the traditional boundaries between companies, creating a porous environment to engage the rest of the world, whether customers, partners or others. It is fueling open innovation and the development of new businesses at an unprecedented pace that, in turn, fuels change in traditional businesses. It is reshaping business and the economy, creating a major new outside industry trend – the shared economy. According to a Forbes article, “Airbnb And The Unstoppable Rise Of The Share Economy,” in January 2013, for 2013 the revenue flowing through the shared economy directly into peoples’ wallets surpassed $3.5 billion, with growth exceeding 25%. It was noted that this rate of peer-to-peer sharing was moving beyond being an income boost to becoming a disruptive economic force. Fueling this trend are the Millennials, a large and influential economic group. Strapped with high college loan debt that limits their ability to purchase homes, cars or other high-value items, they are trending toward subscribing instead of buying music, movies or TV shows (thanks to the likes of Pandora, Netflix and others). They prefer to access news from Twitter, Facebook or Flipboard, or to buy used goods from eBay or Craigslist. Millennials have grown up with the technology that enables sharing, accessing or subscribing as an acceptable alternative to owning. The shared economy empowers people to become co-creators, funders and customers of new businesses that are disrupting traditional industries. Just consider Airbnb and Uber, two companies viewed as leaders in the shared economy that are reportedly worth billions, rivaling in value their traditional counterparts, taxis and hotels. In this new shared economy, traditional companies – like insurers – must quickly adapt to be relevant. Insurers need to begin to ask themselves these questions: What new products and services can we provide to these new business models? How will the new models reshape discounts or the bundling of insurance products? How could we partner with some of these new businesses? How will we need to rethink the customer relationship? The shared economy is empowering individuals and businesses to access specialized skills, resources, goods or services from anyone, anywhere, anytime. New business models are challenging decades of business assumptions that were based on ownership rather than short-term access or subscription. As a result, the fundamentals of insurance are being redefined, from risk models to pricing, products and services. While many insurers may see crowdsourcing and open innovation as risky, other industries are experiencing the transformative power. They are fueling the intensity and raising customer expectations that will affect insurance. Collaboration must happen both within and outside the insurance industry because the challenges and opportunities have become much bigger and broader. Insurers must reorient their business practices from product development to services aimed at creating more value and a deeper customer experience. There is an unparalleled opportunity for any company, in any industry, to ignite a new future that is powered by the human imagination through crowdsourcing and open innovation. The overriding and most critical question for insurers is not if, but how will they embrace the shared economy, crowdsourcing and open innovation – first to get in the game, then to influence change, and ultimately to win.

Denise Garth

Denise Garth is senior vice president, strategic marketing, responsible for leading marketing, industry relations and innovation in support of Majesco's client-centric strategy.

Commercial Lines

How to Manage Legal Fees for Work Comp

Here are nine ways that risk managers can control the alarming rise in legal costs for workers' compensation claims.

Rebecca Shafer

October 31, 2014

Loss expenses are on the rise, at an alarming rate, according to California's Workers' Compensation Insurance Rating Bureau (WCIRB). The California Workers Compensation -- Aon Advisory Bulletin (July 2014) indicates that “allocated costs (mostly attorney payments) increased 7.3% in 2013. Unallocated costs increased 10.3%.” Given that legal costs are on the rise, here are nine ways that risk managers can more closely manage legal services: Have in-house counsel monitor outside counsel (and adjuster performance). Litigation costs must be properly managed because overzealous defense counsel and untrained (or cooperating adjusters) can prolong litigation, increase costs for the employer and wreak havoc on the lives of injured workers. Review outside counsel financial arrangements -- consider capped fees, flat fees or “invoice paid upon file completion.” Paying at the end allows outside counsel to defend the claim but discourages unnecessary hearings and runaway fees and lets risk management easily review the ultimate fee rather than numerous monthly bills. Excessive fees are more noticeable and easier to compare against other files and law firms. Attorneys who are milking the claim become more visible. An “invoice paid upon file completion” is a good approach if you use the same attorney frequently. However, this approach should not be used when the defense counsel only has one file. You could end up with an excessive bill, with little recourse other than to fight with your own chosen counsel over the amount. Conduct an independent audit to assess whether defense counsel was needed in the first place, or whether she was just assigned the case to do work the adjuster, assigned too many cases, was too busy to do. A favorite ploy of overworked adjusters (and lazy adjusters) is to allow the defense counsel to handle the claim. Legal counsel should not be paid to do the adjuster’s job, including gathering medical reports, state board records and ISO reports, arranging independent medical exams (IMEs), etc. An independent claims audit of your files will tell you whether you are paying legal fees for the work the adjuster should be doing. Review hearing rulings. Review whether the same attorneys are requesting hearings on the same issue repeatedly or requesting hearings on issues they are likely to lose. For example, if benefits are terminated but reinstated at the hearing, and this happens repeatedly, it is an indication that benefits are being terminated without sufficient cause, thereby creating unnecessary legal expense. In insurance speak, this is called “churning” files. Churning is any unnecessary activity undertaken by defense counsel for the sole purpose of increasing the legal services bill. It can be unnecessary research on a subject the attorney should know, unnecessary motions, unnecessary discovery, having another attorney in the firm review the case, having a paralegal or junior partner undertake an unnecessary action, etc. Before any preparation by defense counsel for the hearing, the adjuster should phone the defense attorney and discuss the need for the hearing and what the probable outcome will be. If you know going into the hearing that you are going to lose, have counsel resolve the issue with the opposing counsel. It will save both legal fees and unnecessary claim costs (indemnity and medical costs continue while you wait for the hearing). By removing the unnecessary hearings, you move the file faster, with less overall claim cost, to the final resolution. Review whether opportunities for agreement between counsel are ignored. Defense counsel may avoid agreement because it is more profitable to have a junior attorney attend hearings and collect a large fee. For example, in Connecticut, a claimant’s doctor can be changed, with agreement of counsel, but defense counsel rarely agree even though knowledgeable counsel will know which doctors have reputations for overtreating and overrating disability, which doctors are known for unbiased treatment and ratings and which doctors have a reputation for being conservative in their treatment and ratings. Review whether defense counsel makes unfounded accusations against claimant of misbehavior or wrongdoing (e.g. claimant is not credible or is trying to game the system) on every claim to obfuscate the issues and prolong the litigation. If defense counsel is not totally objective in his assessment of both the claim and the claimant, it is time to immediately identify new defense counsel. Look at whether the attorney charges for lots of research, on many files. Very little research is necessary except in unusual claims with issues of law, so files with legal research should be reviewed very carefully. Adjusters -- with sufficient authority -- should attend all hearings with defense counsel. Sometimes, there are opportunities to settle litigation during hearings. These opportunities should be considered while someone with the requisite authority is present. In many cases, seasoned adjusters are capable of attending hearings without defense counsel. (This is not allowed in some jurisdictions.) Risk managers (or the company human resources manager or the workers’ compensation coordinator) should attend all hearings to be available to testify about the job requirements and efforts to provide transitional duty and to show interest in the injured worker’s well-being. Specify this procedure in the account handling instructions. To verify you are controlling your legal fees, a two-pronged approach is needed. A litigation management review by an independent claims auditor will determine the effectiveness of your adjusters in controlling legal expenses. This should be combined with an audit of the legal invoices by an experienced legal bill auditor.

Rebecca Shafer

Rebecca Shafer is an attorney and risk consultant who is an acknowledged thought leader in cost containment. She is the author of "2014 Your Ultimate Guide to Mastering Workers Comp Costs." She specializes in training employers and has collaborated with companies — large and small — to help them reduce their workers’ comp costs by as much as 50%.

Life & Health

Inoculating Your Wellness Program Against the EEOC

The sky just fell on Honeywell, even though its program complies with the ACA. Don't be next.

Al Lewis

October 30, 2014

Two months ago, a posting appeared in this column titled: Are Obamacare Wellness Programs Soon to be Outlawed? Truthfully, that headline was picked for its sky-is-falling value, treating one EEOC lawsuit against one wacky wellness program as a risk for wellness programs everywhere. As luck would have it, the sky just fell yesterday -- right on the head of Honeywell -- and the EEOC is indicating more lawsuits are to come. The scary part: Unlike the wacky wellness program described in the column two months ago, Honeywell was in compliance with the Affordable Care Act. Compliance with the ACA doesn’t seem to get you a free pass on the EEOC’s own “business necessity” requirement. Essentially, the Honeywell lawsuit means no company doing invasive biometric screenings and mandating doctor visits or measuring health outcomes is immune to prosecution, even if it is in compliance with ACA. The even scarier part: The EEOC is correct that, as this column has noted for almost two years now, wellness programs mandating overscreening and annual checkups have no business necessity. In fact, these “employer playing doctor” programs can harm employees, because:

A workplace screen can find heart attacks… but at the cost of a million dollars apiece, when emotionally draining false positives and potentially hazardous overtreatment are taken into account;
The Journal of the American Medical Association recommends against mandatory checkups;
An embargoed, peer-reviewed article that will be published soon in a major journal concludes that the costs and unintended health hazards of weight control programs generally overwhelm the benefits.

Companies could still claim business necessity if, indeed, these programs save money despite the harm to employees. (OSHA might raise issues, but those are hypothetical whereas EEOC is an elephant in the room.) And a few of you might ask: “Didn’t Seth Serxner of Optum and Ron Goetzel of Truven just write a journal article and show a webinar saying: ‘The overwhelming majority of published studies show positive results’?” Unfortunately, those “positive results” -- as is well-known to the presenters, who, after all, have access to the Internet -- fail any sniff test. These two true believers continue to cite Professor Katherine Baicker even though she has stepped back three times from her old (2009) conclusion that wellness provided a significant return on investment (ROI), including a “no comment” to ITL’s own Paul Carroll. More recently, she has, with great justification, blamed overzealous readers for selectively interpreting her findings. Goetzel also continues to cite the state of Nebraska, which his committee gave an award to as a “best practice” despite the revelations that the state’s vendor lied about saving the lives of cancer victims and that the vendor also paid off his award committee with a sponsorship. Likewise, Goetzel's misinterpretation of a RAND study has drawn a rebuke from the author of the study, in a coming letter to the editor. [Editor's Note: ITL emailed a link to this article to the press offices at both Truven and Optum on Oct. 30 offering them a chance to respond to the author's allegations. Both were told that they could either comment at length in this article or could write separate articles that would lay out their position and that ITL would publish. Neither company has yet responded.] Clearly, the EEOC is on to something about a lack of business necessity, when even the alleged best-and-brightest wellness defenders are forced to rely on misstatements and half-truths. Not to mention selective omissions -- the presentation’s extensive section on “critics” had no mention of me, despite a recent cover story citing me as the field’s leading critic, because both these two presenters know my math is irrefutable. These industry defenders also have spotty memories, as when they claim that it is valid to compare the performance of active, willing participants against a control group of unmotivated non-participants and dropouts -- forgetting that they gave out a Koop Award to one of their sponsors who showed exactly the reverse. Inoculating Your Programs A problem with the EEOC does not have to happen to you or your clients (if you are a broker). Taking three steps -- the first of which is free and the second of which costs only in the four figures -- essentially guarantees that you will not end up on the hot seat with Honeywell. First, sign and adhere to the Workplace Wellness Code of Conduct. This will allow you and any clients to focus your own efforts on avoiding employee harm and creating a framework for business necessity. This document is provided gratis for ITL readers, from the author. Second, employers who sign this and get at least one vendor/carrier to sign and implement its counterpart, the Workplace Wellness Vendor Code of Conduct, can have their own outcomes validated by the GE-Intel Validation Institute (itself the subject of a forthcoming ITL posting), to create an audit trail that, in fact, outcomes are being measured. Third, I personally -- along with colleagues -- will do an in-depth walkthrough to see if, indeed, your wellness program complies with U.S. Preventive Services Task Force guidelines. If not, we will provide a list of next steps to get into compliance. The inoculation? A six-figure guarantee that you (or your client, if you're a broker) will not be the subject of a successful EEOC lawsuit. Besides providing some protection on its own, this level of financial commitment may create a self-fulfilling prophecy. Your actions will be a pretty convincing piece of evidence that business necessity and employee health are the goals, as measured by an objective and qualified third party. Yes, I know it’s not always about me; you can protect yourself in other ways. My ex was quite clear on the subject of whether it's always about me. However, in this case, my ex would seem to be wrong. It appears that every screening vendor, every alleged wellness expert and most of those in large benefits consulting firms have done just the opposite of what I'm suggesting: They have proposed massive wellness programs with hefty financial incentives or penalties that get companies into fine messes like Honeywell’s. But, in case I'm wrong, I welcome names, websites and contact information of other consultants taking the same approach that I am. Please note them in the comments boxes below. All will be published.

Al Lewis

Al Lewis, widely credited with having invented disease management, is co-founder and CEO of Quizzify, the leading employee health literacy vendor. He was founding president of the Care Continuum Alliance and is president of the Disease Management Purchasing Consortium.

Agent & Broker

Spending on Agents Beats Spending on Ads

Despite claims in a recent study, winning takes more than discount prices and a cute mascot. Winning requires agents.

Brian Cohen

October 30, 2014

A recent research report published by Cliff Gallant and Matthew Rohrmann of Nomura Equity Research concludes that spending on advertising beats spending on insurance agents. Once again, Wall Street gets it wrong.

Their logic is flawed. The authors choose to focus only on advertising spending in 2013 and limit their analysis to the top-10 auto insurers. They then compare the advertising spending to premium growth that year. Because GEICO spent the most on advertising and had the largest premium growth, the authors conclude that advertising beats spending on agents.

But one year of advertising spending does not account for GEICO's 2013 premium growth. The company has spent decades building its brand awareness. Since the mid-1990s, GEICO has spent billions of dollars to become top of mind as the company to consider if you want to purchase cheap auto insurance (a.k.a., "1-800-cheap insurance"). If GEICO stopped advertising, its growth would stop because it has almost no other way to reach the consumer ("almost" because even the king of direct-response insurance has 150 insurance-agent locations.)

Instead, other important factors account for GEICO's performance in 2013: namely, its strategy to grow premium even if unprofitably. GEICO can afford to grow unprofitably because its owner, Berkshire Hathaway, is more interested in generating funds to invest than in consistent profits. In 2011, for example, GEICO saw its profits plunge 48% while its advertising costs increased 9.4%.

A better way to evaluate whether to advertise or invest in agents is to look at the costs of acquiring and retaining customers. While GEICO scores high in initial consideration, it lands in the middle of the pack when it comes to the actual insurance purchase, according to the McKinsey 2012 Auto Insurance Customer Insights Report.

It costs GEICO relatively little to get a consumer to make an inquiry, but a lot more to have someone buy a policy. And agent-oriented insurers score much higher in retention than GEICO and other direct-to-consumer auto insurance companies do, according to the McKinsey report.

The high retention numbers for agent-based insurance companies demonstrate that companies that underinvest in their agents do so at their peril. Local agents build long-term relationships with consumers. Advertising doesn’t.

With the advent of the Digital Age, companies can generate bigger returns on their investment in agents. This goes against conventional wisdom. However, cloud computing, digital marketing, and social media let agents compete against the industry's "brand behemoths" in their local community.

Forward-thinking insurance companies are designing programs for their agents to leverage these new capabilities. These companies are finding they get a much bigger return on investment than with traditional advertising spending. Consumers want choice today, and they expect to do business with companies that can provide a multi-channel experience.

A local agent whom a consumer can visit, call or access via a website provides the experience that today's consumer demands. Insurers that focus on investing in their agent distribution channel will win.

Pressure on companies to increase their advertising led to the insurance advertising wars of the last decade, and many companies diverted dollars from their agents to pay for increasing their advertising. But that trend appears to be changing as companies realize the power of agent-based distribution in today's auto insurance market. For example, Allstate recently announced a renewed commitment to grow its agency distribution channel after years of neglect.

A strong agent-based distribution channel creates a long-lasting and compelling strategic advantage. Blindly ramping up the ad budget is a simplistic, ineffective solution. Spending on ads just creates an indistinguishable commodity product where price and a cute mascot are the only differentiators.

Brian Cohen

Brian Cohen is currently an operating partner with Altamont Capital Partners. He was formerly the chief marketing officer of Farmers Insurance Group and the president and CEO of a regional carrier based in Menlo Park, CA.

Commercial Lines

How to Pick a TPA for Work Comp Claims

Here is a series of questions that get beyond the third-party administrator's fee, which is typically just 8% of total claims costs.

Tim Stanger

October 30, 2014

Many self-insured employers choose to outsource their workers’ compensation claims handling to a third-party administrator (TPA) instead of creating their own internal operation. Choosing the right TPA is crucial because TPAs will be coordinating essential functions like managing loss reserves, facilitating claims investigations, issuing claims payments and settlements, coordinating medical management and organizing transitional work. When picking a TPA, it is important for companies to first determine what they are looking for. There are several effective fact-finding questions that can help. Capabilities First and foremost, employers must find a TPA that can meet their company’s individual needs, which can vary by type of business and location. Many states are complicated, so the insured must confirm that the TPA has the appropriate expertise by state. Questions that can help uncover the TPA’s ability to handle the employer’s specific business include:

Do you have the appropriate resources to handle all jurisdictions applicable to my company?
Can you provide references within my jurisdiction to support your capabilities?
Do you have the capabilities to handle my company’s various business operations?
Can you handle all of my company’s claims so that I do not need to enlist multiple TPAs?
Are you approved by my insurance carriers?
Are you following best-practices procedures, and can you provide claims handling results to prove it?
What quality assurance processes do you have in place to guarantee consistent results between offices and adjusters?

Claims System A TPA’s system is very important to the entire process. Effective claims management requires a system that is easy to access, with enough information readily available when the employer asks for it. Poor and inaccurate data can cause major headaches if it ends up in the employer’s financial reports. Questions that can help evaluate claims systems include:

How can you ensure that your claims system will provide clear, accurate data?
Does your claims system meet my company’s financial data reporting requirements?
Does your claims system meet my company’s analytic needs for benchmarking, stewardship reports, etc.?
What measures do you have in place to help prevent data breach?

Personnel Personnel issues often affect the claims outcomes that an employer receives from its TPA. The employer will want to ensure that it is working with an experienced adjuster who can make informed decisions, as opposed to an adjuster using automated responses based on decision trees. Caseloads at the TPA, employee turnover rate, supervision and other personnel issues can also factor in. Questions that can help identify troublesome factors include:

Would my company be issued a dedicated account manager or team?
Who would be my key contact and provide information and answer questions?
How do your adjusters make decisions on their cases? Are they educated and capable of making flexible decisions based on circumstances, or do you use an automated response process?

During the RFP process, most TPAs will insist that they have the staff to meet the employer’s needs. It is best to ask for validation. Thinking Beyond the Fee Although employers regularly make TPA fees the deciding factor, estimates show that fees only represent 8% of total claim costs. What many fail to realize is that paying higher fees for a TPA whose adjusters have lower caseloads and are more experienced can significantly reduce overall risk costs. Rather than focusing on the 8%, insureds should focus on the remaining 92% -- the other aspects of the claim that come into effect. This includes evaluating if the TPA can ensure:

Effective medical management
Timely disposition of claim issues
Return-to-work or settlement success
Transparency of third-party vendor use in the claims process
Ability to minimize leakage and avoid excessive expenditures because of mistakes, errors in judgment, ineffective litigation management, penalties and fines
Measures in place to prevent fraud
Transparency of managed care capabilities, including bill review and preferred provider organization (PPO) and case management

Choosing the right TPA takes time and due diligence, but it is worth the effort to find the best fit for an employer’s industry and jurisdiction and meet risk-management needs. It is important to look beyond fees and consider all variables, including staffing, adjuster education, claims systems, reporting capabilities and the TPA’s ability to apply a teamwork approach to supporting your organization’s claims efforts. Considering that a TPA plays a large role in an employer’s workers’ compensation claims outcomes and costs, finding the right one is one of the most important decisions that an employer can make.

Tim Stanger

Tim Stanger is vice president, claims at Safety National. He currently oversees the large casualty claims unit that encompasses deductible workers’ compensation, auto, general liability and Texas non-subscription claims. In addition, Stanger oversees third-party administrator (TPA) relations and State Children's Health Insurance Program (SCHIP) compliance.

Cyber

What to Consider When Buying Cyber

The devil is in the details. There are inconsistencies in the coverage provided, and minor variations can have significant impact.

Roberta Anderson

October 29, 2014

No industry or organization, wherever situated and whatever the size, is immune to the threat of cyberattack, and the impact can be catastrophic, both financially and in terms of reputation. For example, eBay recently announced a massive cyberattack that may have exposed the personal data of 128 million customers globally. The management of cyberrisk clearly needs to be high on the boardroom agenda. Network security alone cannot fully address the issue: Experience has shown that even top-notch, state-of-the-art cybersecurity is vulnerable. Boards need to ensure that they identify key risks and prioritize the protection of critical information. Internal policies and procedures should be put in place to ensure that staff are aware of risky behaviors, such as disclosing passwords and opening suspicious documents in unsolicited emails. Companies need to see that network security systems and controls are regularly tested and monitored, and that response procedures are in place in case of a cyberattack or data breach. Insurance can also play a vital role in managing cyberrisks. As part of the board’s risk assessment, it needs to understand the types of cyberrisk, and the potential losses and liabilities that follow. This is the first step in understanding the organization’s insurance requirements and the extent of coverage required for cyberrisks. Consider the Company’s Risk Profile An initial assessment of the company’s risk profile and areas particularly vulnerable to cyberattack is crucial. External advice may be needed. The risk assessment should extend across the organization. The assessment needs to consider the amount and type of personally identifiable information, customer data and confidential corporate data the organization maintains and how such data is used, transmitted and stored. The company’s technology infrastructure should be evaluated, as well as potential threats to network security and the likely consequences of significant interruptions to online working or customer transactions. Also consider the risk of third-party claims arising from the company’s media content and the services provided to support e-commerce. The company needs a complete understanding of any potential impact of a cyberattack or data breach, including the wider impact on business strategy. Performing a thorough risk assessment not only helps the organization identify and address risks and potential gaps in security but can facilitate underwriting of cyberrisks and may even result in premium reductions. Once the organization has a grasp of its risk profile and potential exposures, it can consider its insurance needs. Examine Existing Insurance Policies Some coverage for these potential losses and liabilities may be available under existing insurance policies already held by the business. These include general liability, directors and officers liability, professional indemnity, crime and property and business interruption policies. Careful assessment of the coverage provided by these policies is essential, however, as there are likely gaps in coverage because such policies have not historically been designed to cover non-tangible assets and network-related risks. The company will need to consider whether to fill those gaps with enhancements to existing policies or through new cyberrisk products now being offered by insurers. Consider the Need for Cyberinsurance There are now a number of cyberinsurance products available, and the scope of coverage varies from insurer to insurer. These policies typically cover losses and liabilities such as:

Data liability. This covers damages and defense costs resulting from any claim against the insured from a data breach that compromises personal information. It should also cover claims alleging that information has been lost or compromised as a result of unauthorized access to, or use of, the insured’s computer systems. It is important that the policy covers not only an individual’s personal information but also employee data and confidential corporate information. Many organizations possess third-party trade secrets, customer lists, marketing plans and other information that could be beneficial to competitors and may result in liability if compromised.
Media liability. This insures damages and defense costs resulting from any claim against the insured for infringement of copyright and other intellectual property rights, as well as misappropriation or theft of ideas or media content. While coverage may not extend to content published in a personal capacity, this should ideally be included, as organizations may face significant liabilities as a result of employees using Twitter, Facebook and other social media.
Regulatory coverage. This covers the costs of response to any administrative, government or regulatory investigation following a data breach or cyberattack, as well as any fines or penalties imposed. However, this coverage is typically limited to civil fines and penalties, as criminal fines and penalties are not insurable in many jurisdictions. Some regulators, including the Financial Conduct Authority (FCA) and the Securities Exchange Commission (SEC), prohibit regulated firms from recovering from insurers any fines or penalties the regulators impose.
Remediation coverage. Most policies provide coverage for additional costs associated with a data breach, including the costs incurred to notify those affected and relevant authorities, provide credit monitoring for those affected and set up call centers to field inquiries from concerned clients. Coverage may also extend to the costs of forensic services to determine the cause and scope of a breach, as well as public relations expenses and other crisis management costs.
Information assets coverage. The policy may include coverage for costs of recreating, restoring or repairing the company’s own data and computer systems. This may also extend to third-party data that has not been captured by back-up systems or that has been corrupted or lost because of negligence or technical failure.
Network interruption coverage. The policy may cover lost revenue from network interruptions or disruptions because of a denial of service attack, malicious code or other security threats.
Extortion coverage. Many policies insure the costs of responding to ransom or extortion demands to prevent a threatened cyberattack.

Cyberinsurance policies vary significantly, so the specific policy terms and conditions should be analyzed carefully to ensure that the coverage meets the company’s likely loss scenarios and potential exposures. It is particularly important to consider whether the coverage extends to information in the hands of third parties where data handling, processing and storage has been outsourced to third parties, including cloud service providers. If the organization has outsourced data handling, then it should secure coverage for any loss or business interruption arising from data that is managed by third-party service providers. Consider the “retroactive date,” as policies often limit coverage to cyberattacks or data breaches occurring after a specified date, such as policy inception. It is important to request retroactive coverage for network security breaches that may have occurred before the inception date, as it is not uncommon for cyberattacks to remain undetected for a considerable period. Review Defense and Settlement Provisions Cyberinsurance policies include defense provisions that typically limit coverage for defense costs to those that are reasonable and incurred with the insurer’s prior written consent. While many insurers include these types of provisions to insist on the appointment of their own choice of defense counsel, selection of defense lawyers is an important issue. Some companies prefer to appoint lawyers whom they know well and who are familiar with their business. Moreover, certain claims arising from the use of technology, such as claims for breach of confidence, breach of copyright and defamation, require specialist counsel with particular experience. The company should therefore consider requesting a specific provision reserving the right to choose its defense lawyer, although the decision will usually be subject to the insurer’s prior approval. Check the Fine Print The “devil is in the details,” especially with cyberinsurance. While the market has developed rapidly in recent years, there are inconsistencies in the cover provided, and minor variations can have significant impact on the availability of coverage. There will likely be efforts by the insurer to exclude risks that should be covered under other types of policy, and this is not unreasonable. It is important, however, to avoid broadly worded exclusions that could extend beyond that concern, or attempt to undermine the initial purpose of the insurance. For example, insurers might seek to impose exclusions based on possible shortcomings in the company’s network security. These types of exclusions should be resisted. Insurance can play a vital role as part of an overall strategy to mitigate cyberrisk, but it is necessary to look beyond the policy limits to ensure that the coverage provided -- whether under traditional policy forms or specific cyberinsurance policies -- is as broad as possible. Ms. Gates wrote this article with Sarah Turpin, a partner in the dispute resolution and insurance coverage groups in K&L Gates' London office.

Roberta Anderson

Roberta Anderson is a director at Cohen & Grigsby. She was previously a partner in the Pittsburgh office of K&L Gates. She concentrates her practice in the areas of insurance coverage litigation and counseling and emerging cybersecurity and data privacy-related issues.

Underwriting

Modernization: Actuaries Must, Too

Traditionally, actuaries have provided a retrospective look at performance; they must now provide forward-looking insights.

Steve Knobloch

Louis Lombardi

Marc Oberholtzer

October 29, 2014

To effectively produce a variety of new financial reporting, reserving and risk metrics, actuarial departments will need to modernize with new tools, hardware, processes and skills. This will be a significant undertaking, especially considering how most organizations and regulatory environments are constantly changing. Re-engineering projects will require careful planning and will affect people, processes and technology. Developing a modernization strategy that provides a path to real change includes visualizing a compelling future state, articulating and communicating expectations, defining a roadmap with achievable goals and avoiding overreach during the implementation. Case for change The insurance market has changed significantly in recent years, which has had a particularly pronounced effect on how companies operate, meet internal and external demands, report externally and comply with regulations. However, many insurers have not modernized their actuarial functions to keep pace with these changes and are struggling to effectively meet not just existing demands but also impending ones. Specifically, drivers of actuarial modernization include:

Internal drivers – The audit committee seeks assurance that reserves and risk-based capital are sufficient and being determined in a well-controlled environment. Senior management wants actuarial departments that work toward the same strategic goals as the rest of the company. Business units are looking for trusted actuarial advisers who can collaborate effectively with them, as well as develop practical solutions to complex problems to help them meet their business objectives. Lastly, the finance department needs timely insight into how the reserve movements affect earnings and equity.
External drivers – The need to issue financial reports under multiple accounting bases necessitates the adoption of new processes as well as the collection of additional data. Similarly, regulatory requirements have mandated additional analyses, various views of the book of business and a push toward more forward-looking information. Other external parties, including investors and rating agencies, demand more information with a greater degree of transparency than ever before.

The modernized actuarial function In a modernized company, the actuarial, finance, risk and IT functions have clearly defined, collective expectations and utilize common, efficient processes. More specifically, the following characterizes a modernized actuarial function:

Data – The organization, with significant actuarial input, clearly defines its data strategy via integrated information from commonly recognized sources. The goal of this strategy is information that users can extract and manipulate with minimal manual intervention at a sufficient level of detail to allow for on-demand analysis.
Tools and technology – Tools and technology enhance the effectiveness of the actuarial department by delivering information faster, more accurately and more transparently vs. the traditional, ad hoc computing done by end users. Specifically, tools that use data visualization can more effectively convey trends and results to management. Algorithms can be programmed to automate first-cut reserving and other actuarial analyses each reporting period based on rules that can help point staff to business segments that may require deeper analysis in the quarter.
Methods and analysis – Modernized actuarial organizations enhance traditional actuarial methodologies with additional cutting-edge methods that yield superior insights (e.g., predictive analytics, which have transformed personal lines pricing and are being adopted in the commercial arena). Another example is stochastic analysis, which enhances deterministic approaches with statistical rigor, helps actuaries prepare transparent reserve range indications and enables management to better understand uncertainties.
Processes – Operations are reviewed from the top down and well-defined in terms of controls, responsibilities, timing,and outputs, particularly in the quarter-close procedures for reserves. Automation of key processes is a primary organizational objective. Modernized actuarial organizations have streamlined processes that eliminate unnecessary or excessive evaluation.
Organizational structure – The ability to deliver superior business intelligence to management often depends on how an organization uses its actuarial resources. Many companies are debating the merits of centralized, decentralized or hybrid organizational structures. While each structure has its own set of advantages and disadvantages, organizational structure is not the most vital factor in a function’s success. Rather, it is much more important that actuaries serve as trusted advisers to company stakeholders while fostering a culture of innovative thinking that identifies new information and opportunities to test, learn and scale.
Reporting and governance – Strong governance, particularly around data, analysis review, challenge, issue escalation and resolution and reporting are cornerstones of a modernized actuarial function. Actuarial functions solicit stakeholder input on information demands and provides consistent, quarterly reporting packs that satisfy these stakeholders’ reporting demands. Additionally, modernized actuarial functions have formal policies and procedures that clarify the roles and responsibilities of management, reserve committees and the audit committee.
Business intelligence – Modernized actuarial functions focus on providing operational metrics that meet individual stakeholder needs and objectively relate business performance. For example, senior managers often desire corporate dashboards that provide them access to real-time information on business performance to help them make strategic decisions.

Benefits of insurance modernization A modernized actuarial function produces insightful, strategic information and allows the actuarial function to deliver the value management desires while meeting external stakeholders’ regulations and demands. Modernized actuarial functions have robust feedback loops within pricing, reserving and capital management. Additionally, the modernized actuarial function understands the business’ fundamental performance and takes an active role in helping management define the company’s future direction. Modernization represents a fundamental shift in the actuarial function priorities. Traditionally, the actuarial function has provided a retrospective look at business performance despite various data, technology, process and personnel limitations. However, modernization seeks to address these limitations and allow the actuarial function the freedom to innovate, dig deeper into the business, provide forward-looking insights and have a strategic partnership with management. At modernized insurers, tailored reports direct actuaries’ attention to portfolios with unusual characteristics. Automated programs quickly populate various templates for additional ad hoc analyses and drill-down investigation. Data visualization tools provide management comfort with findings and remediation recommendations. Cross- functional reporting and implementation teams fluidly improve on-the-ground results. Research features exploratory environments (“sandboxes”) and widespread data access that helps innovators discover emerging trends early, leading to potential differentiators. As an added benefit, actuarially modernized functions operate at a much higher level of efficiency, with greatly reduced levels of time needed for manual processing and data manipulation. Factors for successful modernization/ key considerations The thought of overhauling entire systems, processes and functional areas may feel overwhelming for company executives. This is understandable, as comprehensive modernization is a long journey that likely will have a significant price tag. As a result, many companies address modernization in steps. Although, in an ideal world with limitless resources, modernization could occur in a “big bang,” there is significant value in first addressing the areas in most need of modernization (while maintaining an overarching focus on holistic modernization). As one area becomes more streamlined and efficient, other areas will start to reap the benefits. Regardless of the breadth of modernization initiatives, modernization strategies will require a holistic consideration of data, methods and analyses, tools and technology, actuarial processes and human capital requirements. These strategies will also need to address the business and operational changes necessary to deliver new business intelligence metrics. Any weak links between these closely connected components will limit the realization of actuarial modernization. Although a modernization strategy should be holistic to avoid “digging up the road multiple times,” it is possible to tackle modernization issues in logical, progressive ways. Achieving the vision The first step is a comprehensive assessment of current processes and identifying the areas in greatest need of modernization. If we consider each modernization dimension (e.g., data, processes, technology, etc.) as a gear in motion, the first step to modernization involves identifying which gear in the function does not work in concert with the others. Stakeholders should collaborate on creating a comprehensive plan of action with an objective view of the dimensions that require immediate attention, while keeping in mind how each gear affects the organization as a whole.

Steve Knobloch

Steve Knobloch is a director in PwC's P&C actuarial and insurance management solutions practice and is based in New York City. He joined PwC in 2005 and has nine years of experience in the P&C insurance industry. Knobloch has spent six months abroad through a secondment to PwC UK, where he worked for a London market client.