With the convergence of media content and distribution, communication networks, and information technology, organizations' risk management programs — including risk mitigation and risk transfer strategies need to be adapted to manage the new risks brought on by the convergence.
As companies in all industry sectors adjust their business strategies to stay competitive and relevant, they are developing or acquiring new products, services, and capabilities. The internal and external changes brought on by convergence are driving a change in companies’ liability risk profiles, increasing complexity, and the risk of catastrophic losses, most dramatically for media, communications, and technology companies.
The rise of social media, privacy concerns, and cloud exposures are contributing to the shift in risk profiles. Many companies have embraced social media in some way, whether creating a page on a public networking site or an internal social media site. This evolution creates additional risks.
Every company has some level of privacy risk due to holding employee and customer data, confidential corporate information of a third party, or some combination thereof. Using cloud services is becoming a popular choice due to scalability and reduced costs; however, these services come with their own risks, including availability, responsiveness, and data security.With high profile data breaches increasing in number and severity, many risk managers are concerned about their company’s risk.
Comprehensive risk management programs—including risk mitigation and risk transfer strategies—need to be adapted to the changes brought on by convergence and new exposures. Many risk managers are not confident that they can identify and quantify the risks emanating from these new exposures, most of which are outside of their traditional core business. Several multinational media, communications, and technology companies have approached Marsh asking for assistance in understanding how these new risks are reshaping their risk profiles and exposures.
In response, Marsh developed a proprietary suite of risk assessment tools to identify and quantify media liability, errors and omissions (E&O), privacy, and network security risks.
Marsh’s E&O risk profile and E&O risk maps provide a summation and analysis of the information gathered through our risk identification process. The six phases to the risk identification process are:
- Marsh reviews publicly available information, including 10K, annual report, web site, analyst reports, and more.
- Marsh constructs a short questionnaire to be distributed to a few key individuals in the organization to obtain critical information that is not publicly available.Risk managers complete Marsh’s proprietary privacy and information security assessment to help evaluate internal policies and procedures related to human, physical, and network security, privacy, and breach preparedness.
- Marsh conducts targeted interviews to round out the information already gathered.
- Marsh drafts the E&O risk profile and E&O risk maps and leads a collaborative review with the company’s risk management team.
- Marsh and the company finalize the E&O risk profile. At the company’s request, the risk profile will be updated to address evolving and emerging risks.
- Marsh conducts an E&O gap analysis by reviewing the entity’s insurance program in conjunction with the E&O risk profile to identify potential gaps and overlaps.
The E&O model
, developed in collaboration with Marsh Business Analytics, helps quantify the risks identified in the E&O risk profile and estimate risk bearing capacity, resulting in a more efficiently designed risk transfer structure.
- The loss distribution model is developed based on a company’s historical E&O loss data and supplemented with peer claims from Marsh’s proprietary E&O claim database in order to improve credibility. The output from this model provides insight into the probability of E&O loss frequency and severity for the coming policy year.
- The risk bearing capacity is an estimation based on a financial analysis of the size of loss that a company is able and willing to sustain in one quarter without experiencing adverse effects, such as a significant drop in stock price or a need to reduce research and development or capital expenditures.
- Insurance program optimization is achieved by combining the loss distribution model and the risk bearing capacity to estimate the value of transferring risk in each layer of the insurance program. This value can then be compared to the actual premium proposed by insurers to determine if transferring the risk represents a good value.
In addition to the structure of the program, the scope of coverage is also critical. Marsh uses several tools to translate the information contained in the E&O risk profile into an effective E&O insurance policy.
- The coverage prioritization tool is a list of priority terms and conditions that is constantly updated to reflect changes in the market. It is a proprietary list that covers important requirements for each section of the policy from the insuring agreements and definitions through the exclusions and conditions. This provides the baseline for reviewing an existing policy or establishing requirements for a new placement.
- The contractual requirements review tool guides a detailed review of insurance requirements that a company has received historically from its corporate customers for certificate or other evidence of insurance requirements. This is used to determine how the policy addresses insurance requirements received from a customer. During this process Marsh also shares trends that we have identified so that the policy can anticipate future requirements.
- The coverage database is a library of negotiated preferred forms and endorsements from our practice experts around the country. It is frequently updated to include the preferred or ideal wording for each section of the policy form.
These tools help companies define their E&O exposures and needs, and inform a range of risk management decisions such as scope of coverage, program design, risk mitigation, and go-to-market strategy.
Many companies that suspected their risk profiles were changing have engaged Marsh to assess their risk profile. We deployed the appropriate tools from the suite above in order to address the concerns of each client. Based on the results of these assessments, our clients have adjusted risk mitigation strategies, altered insurance program structures, and broadened the scope of their coverage. Some specific examples of these changes include:
- A large media company made several significant acquisitions outside of its historical core of operations. Based on the E&O risk assessment and quantitative analysis completed by Marsh, the client decided to increase its E&O and media liability program limits due to the increased risk of catastrophic claims. The company also determined, based on the data provided by Marsh, that they had the ability and the appetite to retain more risk, so they increased their self-insured retention.
- A multinational technology company developed several new products and services in addition to acquiring a few small entities. The E&O risk profile and related insurance gap analysis revealed that the definition of professional services needed to be broadened in order to ensure the policy would cover the new products and services. Several exclusions were also identified that limited or eliminated coverage for these new exposures. Marsh was able to successfully negotiate these changes on behalf of the company.
- A large media company was concerned by the publicity surrounding data breaches and asked Marsh to assess their risk for a privacy loss. Based on Marsh’s assessment of the types and quantity of data and the information security policies and procedures, the company decided to purchase coverage for its privacy exposure.
As a result of these changes, these companies now have confidence that they purchased appropriate insurance protection for their balance sheet and income stream through an insurance program that matches for their new and emerging exposures.