Blog Layout
Cyber Business Interruption
Jeff Esper
Managing Cyber Exposures from the Inside Out
Many companies are perplexed by trying to understanding their cyber exposures. They may understand the risk and the potential impact of a breach, but they simply don’t know how to measure the total exposure to the bottom line. Some of the costs associated with a cyber attack are not so bad, such as the linear calculations based on the number of records with personally identifiable information, PII. Take the current costs for credit monitoring, notifications, cyber forensics and legal fees, then add them up and you have pretty good idea of the exposure. But what if your business doesn’t have a significant PII exposure? How do you quantify the more intangible side of the risk?
You will not find that answer anywhere outside of your organization. The answer comes from looking within your organization. We call it “managing risks from the inside out.” Any cyber insurance expert will struggle to tell you what limits you should buy because there are no benchmarks to reference and no comparative studies that reflect the inner workings of your operations. The analysis of this exposure is possibly the most complex of any exposure to an enterprise, but it is precisely what needs to be done.
The enterprise wide exposure from a cyber related peril falls into two categories: business interruption and restoration, and they are interrelated.
- Business interruption is a time element loss similar to that from a property trigger. An incident occurs that cripples production causing a loss of earnings. The time element considers the time of restoration i.e. to get back to pre-loss levels. This includes the extra expenses needed to keep the operation running however possible. In addition to lost sales, there may be a loss of customers or contracts that should also be assessed.
- The restoration involves both the costs and steps needed to repair and replace damaged systems to restore operations back to pre-loss levels. How long that takes is your period of restoration. Restoring critical systems may involve various outside consultants to implement the restoration plan and should be factored in to the analysis.
Figuring out these scenarios and adding up the the costs and impact on earnings will go a long way to quantifying your exposure. Since many deductibles are based on a waiting period, this is vital procedure before looking for coverage. To get realistic Cyber BI Value you must consider the realistic, worst case, loss scenarios, known in the property policy world as Maximum Foreseeable Loss (MFL) and the more likely Probable Maximum Loss (PML). If you have security testing protocols in place and have done an impact analysis for critical systems, you have the foundation for quantifying the bottom line exposures.
Cyber claims are some of the most difficult to document, because in many cases records are lost and systems for record keeping may be unusable. The inefficiencies and manual processes not only affect operations, but will also affect claim preparation.
At RWH Myers, we have decades of experience quantifying an array of time element losses including those from cyber perils. We look at cyber as we would any other trigger because the fundamentals are the same. Our claims experiences help clients both understand all financial exposures associated with a cyber event and how to maximize claim recovery.
Insights Worth Sharing
Happy Holidays from RWH Myers & Company
Making a business interruption claim is more than just an accounting exercise. It requires a good strategy, a thoughtful process and perhaps most of all, patience. These lessons come from experience and the team at RWH Myers has earned it from decades of preparing BI claims. Though this topic is of the philosophical nature, it is just as important as the details behind a business interruption calculation. So let’s dive in and see what you really need to make a BI claim. Strategy Every loss is different. You can’t apply the same game plan and the same approach to every claim. You have to assess the situation and all its parts to devise a specific workable strategy. Experience will help ensure your strategy is appropriate for the situation, but the claim will take on a life of its own. The initial loss assessment is derived from the loss information such as what happened, the timeline of events, the impact to operations and how long it will take to get back to normal. As forensic accountants, we will look at the entirety of the situation and dissect it from every angle to figure out the full scope of loss and then determine the best approach to measuring and supporting the claim. We will also anticipate how the claim will be adjusted and plan for arguments against the claim. Taking the time to develop a proper strategy will pay off at every stage of the claim process. Process Once you understand the situation and have designed an effective strategy, you can lay out a process to get to the desired result. The process starts off with identifying and assembling the team to execute the plan. The claim will require data from various sources and input from key internal experts to provide insights as to the impact on operations, both upstream and downstream. The process also includes managing claim adjustment, from setting the timeline to handling requests for information. During the process, your claim preparer will work to keep all phases of the claim moving forward whether with data gathering or insurer feedback. Claims tend to start out with a high level of attention, but it is common to lose momentum. Simply put, a well-defined process will keep the claim moving, limiting distractions and roadblocks. Patience Patience doesn’t equate to conceding to a lengthy and arduous process. It’s just the opposite. By definition, it means, “quietly and steadily persevering or being diligent, especially in detail or exactness.” It is important to understand that certain parts of the claim take time to develop, and that time is critical to ensuring a thorough and well thought out claim presentation. For example, taking your time in the beginning of the process to lay out the foundational elements of the claim will avoid obstacles that may delay claim settlement and the amount recovered. It’s best to set expectations early and commit to the process. Again, practicing patience will expedite the claim process and improve the outcome. You can rely on the experience of your forensic accounting team to lead that effort. So, you see, it’s not all about the numbers. There is more to the intangibles than you may have thought. Every claim has its own unique challenges. You should be prepared for anything and everything. Again, preparing a claim is just as much strategy, process, and patience as it is the technical elements of claim preparation.
Property damage insurance claims are among the most infrequent for corporate policyholders, but this year Louisiana has suffered through a record number of Hurricanes. When catastrophe strikes, recovering insured losses essential to rebuild and resume operations. Effected policyholders will need expert help to evaluate, organize and document their claim to present to insurers. Forensic accountants that devote their practice to preparing claims for policyholders have every day experience just as adjusters and auditors do, so it is certainly to your advantage to hire a firm of experts to represent your interests throughout the property damage and time element claim process. Though the specific insurance claims and the policyholders may change, the vital steps to recovery remain the same. One thing both sides agree on is that the claim process goes smoother when the policyholder is well prepared for demands of a claim from start to finish. The partners at RWH Myers prepared a detailed guide to assist policyholders in preparation for claim recovery. It is designed to serve as a resource and a framework for the claim process and includes the following sections: Establish Appropriate Accounting Methodology: Provides guidance and an organizational framework for post-loss activities, establishing specific accounts to capture the loss. Property Damage Expense Categories: Explains the types of expenses that may be included in each category of coverage and the documentation required for these costs. Claim Preparation Objectives and Overview: Identifies objectives for the claim preparation process, and provides a conceptual framework for achieving them. What is Covered: Examines the direct and indirect exposures to loss that are typically encountered, and provides guidelines for determining whether specific types of property damage losses are covered under the policy. Claim Preparation Procedures: Suggests timetables for the submission of inventory, property damage, and discusses the format and content of standard claim submissions. Audit and Settlement Guidelines: Discusses the procedures undertaken by the insurers adjusters and experts, and provides an overview of the settlement process. Click here to download the full guide.
Questions?
Give us a call or send us an email.
Phone: 412-498-2802
Email: ChrisHess@rwhMyers.com
© Copyright 2023 | All Rights Reserved | Sigma7 RWH Myers