We are all on a quest now for "R" as corporate entities, as families, as individuals - we all need a better grasp of "R" and quick.
What is "R", you ask? Resilience.
COVID has performed an amazing job of sniffing out and exposing every rigidity, inconsistency, and fragility in our supply constructs, our financial arrangements, even our ways of doing everyday things like getting a haircut. Let's talk about what this means for risk management. After all, if we're not the experts on "R", who is?
A neat overview of resilience and risk appeared last week in the Insurance Innovation Reporter (IIR). A few highlights:
Demand models: Sales, distribution/fulfillment, client services - everything is driving towards better, more consistent use of digital channels. We are all moving towards the new fast food experience where you can order, pay, and pick up your lunch without touching (or speaking to) another human. We take large measures of known human risks out, but we also incur new types of system/cyber risks in pursuing multi-channel "R".
Supply models: Supply chains, whether global or local, are looking for greater diversification and redundancy. The trade-offs between single-threaded hyper-efficiency and robust redundancy (supply chain "R") are changing.
Operating models: Global web traffic is up 25 to 30%, as is VPN usage, and every form of telepresence. The less travel we require, whether local or global, the greater our operational "R".
In every case, we are swapping out old risks and replacing them with - well, what, exactly? As we've discussed in recent issues of this Journal, cyber risks are growing off the charts, but other changes also bring new potential issues. On-shoring (a big trend right now), multi-sourcing (likewise), digitizing everything, all these trends bring new or increased exposures in their own right. Our current experience with COVID is turbocharging any number of trends bearing on risk and exposure management which were already bumping along.
The IIR essay ends with an address to the insurance industry which is worth quoting because it encapsulates so much of the work waiting for us in the insurance-risk nexus going forward:
For the insurance industry, the mandate is clear: we need to increase our capabilities to understand and help manage cyber exposure, at the probability and economic loss levels, and support households and organizations with solutions that are relevant given the evolving 21st century risk landscape.
My French stepfather used to say: C'est une belle vie, si vous ne faiblitz pas. A good motto, I think, for risk managers everywhere in 2020: It's a great life, if you don't weaken.
Who Watches the Watchers?
You're working from home. You're meeting all your deadlines. All your projects are turned in and the quality is high. You're on all of your conference/Zoom calls, awake, lively, and contributing. If your current workload doesn't take all day, that's your business, right? So you take a few minutes here or there to relax with a cup of coffee and one of those neat short stories they run on You Tube. No problem.
Well, consider this little stat from the Society for Human Resource Management:
During the past six weeks, almost 20 percent of organizations purchased some form of software or technology designed to track and monitor remote employees, according to data from Gartner, a research and advisory firm in Arlington, Va. That research suggests these tools will continue to be used even as the COVID-19 pandemic recedes.
Such software can monitor keystrokes, web use, and sites visited. If your personal computer is on the same router, it may also check out what you're doing on your own keyboard. Some even use your laptop camera to see if you're really at your desk. Got the picture? How does that make you feel?
OK, let's swap roles. Now you are the risk manager of a company which is implementing this software. Congratulations - you've just entered a whole new area of regulations and risks. Various states have different regs and allow certain types of snooping, but not others, so careful legal review is a must before anyone hits the "Go" button. Even more, you need to be completely up front with your employees. Human relations experts also say being transparent about the use of such monitoring tools not only is essential to avoiding legal pitfalls, it's also key to building trust in the workforce around privacy issues.
Is risk management at the table as these new systems are designed, purchased, and installed? If you've never used systems like this before, do you know what your coverage is, should an employee - or a group of employees, file suit for invasion of privacy, wrongful termination, or heaven knows what? We set that little scenario up in the first paragraph for a reason. Yes, I loaded the dice, but here's the point: Your employer has said nothing about monitoring your working from home then, suddenly, you're called on the carpet for visiting a forbidden web site (quite possibly on your own laptop) during work hours. If you're penalized or even terminated, might you think long and hard about calling a lawyer?
There is nothing wrong in monitoring work from home - but you have to do it the right way. Know the applicable regs and be totally up front with your people. Risk management and HR need to be completely in synch before monitoring commences. This is just one more little-explored risk swamp that COVID has thrust us into.
Laptop with the C-19 WFH option
Quick Take 1:
Does Your Comp Program Include a Family Plan?
Of course not, you say. Ah, let's think about that for a moment. The good folks at Praedicat (was part of the Rand Corp until a few years ago) have been getting ready to model COVID in all its potential glory in terms of total probable exposure. Thanks to Oxbow Partners we have a pre-release peek at some of their findings.
Here's one highlight that may make working from home more palatable, since both the medicine and the liquor cabinets are close by. They note that the most typical COVID exposure for most businesses is workers' comp, but then they poke a bit further: "The model then assumes that family members become infected and bring claims against the worker's employer. These types of claims could occur in a wide range of industries, and may also involve significant defense costs..." Yikes.
Note that Praedicat refers only to defense costs at this point. Who knows what courts may decide when faced with such a case, especially if the employer does not offer medical insurance? What do you suppose a plaintiff's attorney could do with that scenario? Oh yes, what's the big ticket? According to this report, total COVID losses for US carriers may range from $8B to $50B. That's just the insured risks.
Quick Take 2:
Hurricanes and the Daily Racing Form
Your faithful correspondent's father owned race horses, which is how I learned to read the Daily Racing Form in junior high. This hardy little tabloid dates back to 1894 and it tells you everything you need to know about upcoming races and how to handicap the ponies. Better than most stat courses for learning risk*.
Trying to predict upcoming hurricane seasons is much the same business, lots of horses to handicap. Colorado State and the Barcelona Supercomputer Center have teamed up to offer a racing form for the new season which starts next month. This neat site actually amalgamates predictions from several outfits that track weather professionally. In other words, it looks at all the touts and handicappers from all the tracks.
The bottom line for 2020 is a heavier than average season with eight serious storms. No El Nino is in sight this year and the Atlantic is warmer than usual - usually a dire combination. Good reasons to keep a weather eye on the forecasts and recheck your property coverages for all those coastal area facilities. Everything up to date? Are recent equipment upgrades scheduled where appropriate? Have you modified your cold site and hot site and back up recovery plans for social distancing?
Mother Nature doesn't care that we are distracted with COVID.
Historically, warmer than normal sea surface temperatures in the eastern Atlantic correlate with a more active Atlantic #hurricane season. Currently, most of the eastern Atlantic is warmer than normal, except for north of 45°N.
*One of my father's horses was a famous "mudder"; the worse the weather on race day, the more likely he was to win. Great training for the insurance business.
Say It Isn't So...
Still missing RIMS? Well, the Society for Human Resource Management just made official what we were all expecting. SHRM's annual conference, planned for later this summer in San Diego, has also been cancelled for the same reasons. The SHRM event is about three times larger than RIMS, so you can imagine the spread of disruption across thousands of vendors, hotels, airlines, and so forth. RIMS Canada just cancelled their annual meeting as well. If any part of your organization was planning to exhibit at SHRM or other major conferences, you might want to check on how they are handling the stand down and possible penalty clauses in contracts. There's a risk in attending - and a different risk in cancelling, especially with relatively short notice. Help your colleagues in marketing and event planning make certain these and similar event cancellations don't create unnecessary liabilities.
Words to Remember
A look at the coming hurricane season from King Lear:
Blow, winds, and crack your cheeks! rage! blow!
You cataracts and hurricanoes, spout
Till you have drench'd our steeples, drown'd the cocks!
You sulphurous and thought-executing fires,
Vaunt-couriers to oak-cleaving thunderbolts,
Singe my white head!