When encountering the term “catastrophic risk”, most people will think about extreme weather, climate change, earthquakes, and other related concepts involving nature. However, Marsh’s Technology Industry Risk Study 2020 has highlighted a widely underestimated risk that could potentially lead to catastrophic results: the failure of technology to perform.
This risk, according to the report, can have devastating consequences in today’s global and digitally interconnected economy.
According to Tom Quigley (pictured), technology industry practice leader for Marsh in the US, when people discuss business interruption due to technology, it is often linked to intentional acts such as hacking. But sometimes, technology simply does not work as intended, and individuals and businesses fail to perform their business operations.
Another related risk that Quigley identified was the possibility of injury or property damage arising from technological failure. In applications such as autonomous vehicles, the Internet of Things and artificial intelligence, the likelihood of real-world damage is very possible.
“If we talk about autonomous vehicles and insurance, the liability moves from individual drivers to the manufacturers,” Quigley said. “Even now, there's so much technology in cars that we are already seeing technology companies being held contractually for liability and product recall for the components in their cars. So, these expanded liabilities are already there.”
Many of the 150 technology risk professionals Marsh interviewed for the study believe that insurance solutions for emerging risks are less than adequate. The majority had negative or neutral opinions on the adequacy of insurance solutions for key risks such as data security and privacy, IT resiliency, intellectual property, regulatory compliance, and multinational exposures.
Other more established risks, such as tech E&O and business interruption, received slightly higher ratings, but these were outnumbered by risks perceived as inadequately addressed by available insurance solutions.
According to Quigley, a lot of Marsh’s clients have brought up this subject.
“For every technology client, it starts with deep diligence and customization of every insurance policy,” he said. “No off-the-shelf policy is going to give any tech company what they are looking for so we need to customize the terms and conditions. That's where we start. One of the biggest issues we're seeing is that more and more technology risks cross traditional first and third party lines of coverage.”
Insurance, Quigley said, is mostly sold in silos. But technology risks do not care about those silos.
“For this reason, we are seeing more and more interest in integrated risk programs which provide a significant shared layer of coverage across multiple lines of risk,” he said. “So companies are looking at this from a coverage standpoint to make sure nothing falls between the gaps of the traditional silos. This is also a way to essentially shift risk premium dollars away for more traditional coverages to the emerging risk areas within that integrated layer of coverage. And then lastly, we're also seeing more interest in both captives and parametric risk programs.”
A trend Quigley noted was that an estimated 75% of clients that showed interest in captive insurance and parametric risk programs were the more innovative firms.
“While they have not all implemented them yet, that's taking up most of the discussion of where they need to go,” he said. “It reflects two things: their desire to accept higher levels of day-to day-risk, and wanting to protect themselves against the more catastrophic risk scenarios.”
Balancing between technological risks and natural catastrophe risks
Quigley said that in order to strike a balance between more traditional risks and newer, often technological risks, organizations must conduct more scenario planning around what the new catastrophic loss scenarios are. This can help identify which events can truly disrupt a business’ revenue stream.
“When we say achieving a balance, what we're encouraging is more time spent on thinking through the scenarios of what those new catastrophes could be. Not just renewing insurance policies year over year,” he said. “Technology companies are moving very fast and they are involved in more of our day-to-day lives. Based upon that, technology companies are going to continue to see the risks of their products change and so technology companies need a very strong discipline around being agile and adaptive and aware in their risk management programs.”
While there is a huge difference in the risks a technology-oriented business and a traditional non-technology business are exposed to, Quigley said it would be helpful for both types of business if they could learn from each other. Technology companies are increasingly coming into contact with the physical world, such as through the Internet of Things and the sharing economy. Meanwhile, non-technology companies are now relying on more complex IT systems to sustain their operations.
“We talk to technology companies about the need for them to think about the risks of a traditional physical world company because technology is getting into these new risk areas. At the same time, when I'm talking to non-technology clients, we are encouraging them to start thinking like a technology company,” Quigley said.
