Wildfires

Home (Page 4)

Paul Martin & Colin Rooke discuss the impact of wildfires on businesses and on those responsible for managing corporate assets.

Listen to the full episode here, or read the full transcript below.

Paul Martin:

Welcome to Risky Business Commercial Insurance with Butler Buyers. This is Paul Martin, the business commentator on CKOM, and I’m the host of this program. And joining me today, Colin Rooke, the commercial risk reduction specialist with Butler Buyers. Colin, we tend on this program to respond to things that are timely in the news as well as the more broad, general kind of themes that we pop up with, such as, say, for example, cyber or data protection.

But today we’re going to talk a little bit about something that’s really timely in terms of news coverage, and it’s just you’d really be hard-pressed to operate in this country right now without bumping into the news story that says forest fires, wildfires, everywhere you look from BC to Newfoundland. Every province is experiencing it. We’ve got firefighters coming from all over the world to assist us, and it’s got us into the conversation around climate change, all of that sort of stuff. But I’m just wondering, that’s sort of the news part of it. What’s the insurance part of this story? And it’s not something we talk about. So perhaps on this program, we can provide a bit of insight to business owners and those responsible for managing enterprises and looking after corporate assets. These wildfires, something we should be talking about? I mean, is it the topic that business people need to pay a little attention to?

Colin Rooke:

It really is. When it comes to the topic of just wildfires in general, I think there’s a lot to be learned. For example, you think, okay, when it comes to the wildfire itself, there’s actually three different types of damage, four really that occur, and most will not think through that.

I mean, you’ve got direct flames, so that’s the obvious one. I’m way too close to an out of control fire, and as a result, my building, my property caught fire. However, another huge culprit are the airborne embers, where again, pieces, hot coal, burning pieces are in the air and they can travel hundreds of kilometers and start new fires. And then you’ve got impacts from radiant heat. So you might be a ways away from the fire, but then you’ve got this extreme heat that will melt and damage properties. So you see that a ton of all these surrounding buildings that again, didn’t catch fire but then you come back and you say, oh, I dodged that. They wanted us to evacuate. We’re so fortunate that we got out of the path. And then you arrive to your property and everything’s melted. And then sort of the fourth big one, and I think that’s talked about the least, is the impact from smoke. So really anywhere there’s smoke as a rule, there’s damage. So you think about –

Paul Martin:

Where there’s smoke, there’s damage? We’ve just changed that old adage?

Colin Rooke:

Yeah, so you think about the fires that everyone knows about so Fort McMurray fires. And yes, there’s a lot of buildings caught fire, but the resulting damage of those fires to the homes in Fort McMurray were actually smoke related. So there were certainly airborne embers. There was damage, but the real culprit was how thick the smoke is. So if you could imagine you’ve left your home in Fort McMurray, it’s so hot, the windows have burst, but your home never actually does catch flames. Just think about how much smoke was inside those homes for so long and what the inside would be like when you returned. And actually the damage itself got most of the press. And of course it all adds to the overall number. But when you think about damage, you think, again, burned to the ground structures. But again, the major part is the damage that smoke does.

And so why am I highlighting that? It’s really important if you’re anywhere near these zones to take a look at your property. So you might not realize that there was some heat damage. You may not realize that although your building didn’t catch fire, that there’s damage from embers. But don’t, especially you think of these remote cabin communities, vacation homes, that sort of thing, make sure you’re cognizant of any damage that could be resulting from smoke. And I don’t want to promise that on every policy that there is coverage for this, but it is an insured peril, meaning you may be entitled to something, but don’t discount the damage that smoke can do if you are on the fringe of a blaze. And don’t convince yourself that you made it out of it sort of scot-free. Do your due diligence and say to yourself, is there a lasting smell? And that smell could constitute a claim.

Paul Martin:

I think you draw a valid point here is that not very many people talk or think about this aspect of it. And yet here you’re saying this is the bulk of the damage. This is where the bulk of the claims come from as the smoke, as opposed to the outright destructive damage that is very visible. And I guess is what captures the attention of the TV cameras, for example, when you’re doing the coverage. So when you look at a Fort Mac, for example, and there’s not much drama and taking a video of a smokey wall inside a house through a broken window, it’s way more dramatic to see an entire block burn to the ground. But your point here is that from an insurance perspective, it’s a totally different aspect.

Colin Rooke:

It is, and that’s what I find so interesting is that I find it less interesting to stare at rubble because when you look at a total loss, everyone can be an insurance adjuster. You walk in and say, yep, it’s gone, looks like fire. But what I find very interesting is you can have a completely intact house and suddenly there’s a $600,000 claim due to the fact that there is smoke throughout.

And to give a good example for those that are listening, protein fire. So you see it all the time in personal lines, home insurance, condo insurance, tenant insurance. So you fire up the pan, you throw the steak on, you’re cooking it inside, you fire up the pan, you throw the steak on and the phone rings or you’re drawn away outside, you forget that you’ve left it on high, it starts to char, it starts to smoke, and then a small blaze ensues. Now maybe it goes on for a few minutes. The home never actually does catch fire, but the smell created by the burned meat will not go away on its own, and it can cause a significant amount of damage. And again, similar to plastics, oils, petroleum. So if you think of it in those contexts, if you had a protein fire that the smell doesn’t go away, think about the damage that again, wildfire smoke could have caused or is causing to your structure as well.

Paul Martin:

I never cease to be amazed at what we learn on this program. So I’ve now heard a new term, a protein fire. So I’ll put that one on my-

Colin Rooke:

Yeah, we use it all the time. Yeah.

Paul Martin:

I’ll put that in my library. But that’s something that you guys in the insurance industry talk about on an ongoing basis, I assume. That’s just parlance for you. But for those of us who are not in the industry, and that’s why we have this program, it’s that we can provide this kind of information and insight into people who don’t live what you live on a daily basis.

Now we’ve got to take a little break. So just to stand by, Colin. You’re listening to Colin Rooke, the Commercial Risk Reduction Specialist with Butler Buyers. This is Risky Business. We’re going to take a little break. We’ll be back after this.

Welcome back to Risky Business Commercial Insurance with Butler Buyers, Paul Martin here, your host, and joining me, Colin Rooke, the commercial risk reduction specialist with Butler Buyers and the primary voice on this program for the last few years.

Colin, before the break, we were talking about smoke damage and how as a property owner with these wildfires going on, you don’t necessarily have to be right next door to the fire, but you could suffer some kind of damage. I’m wondering, the thing that we talk about frequently on this program is step-by-step plans, risk reduction, helping business owners and those responsible for running businesses to make preparations, to take the steps in advance of something happening and to try and foresee what might go on. I’m wondering, with this conversation we’re having in Canada right now about wildfires, do you have one of those step-by-step guides available for business people to look at, to say, what about wildfires? What steps do I need to be aware of?

Colin Rooke:

Yeah, we do, and it’s a timely topic. So if you look at the 10-year average for forest fires in Canada, it’s about 3,400 a year. And as of right now, we’re almost in excess of 4,500 and the season isn’t over. And so the idea of giving a wildfire preparedness guide or planning for wildfire is very relevant. So in the last few episodes, we’ve talked about the oldie but a goodie, the disaster recovery plan. And then we had Grant from Apex Consulting come on and say, okay, as part of the plan, you want to talk about the people plan. What are you going to do with your staff and make sure everyone’s educated. But what we do is, so if we’re looking at a typical disaster recovery plan, there are certain categories or certain sectors or depending on where you are in the world or the exposure you face, that we will build it out further.

So if you have a disaster recovery plan, you will have more than the basics complete. What do we do in the event of, but then we’ve taken it a step further and said, okay, we have a complete guide for getting ready for a wildfire. And so yes, it talks about who does what, who’s going to make what phone calls, what are the critical operations, what are the non-critical, how long will it take to get back up and running? But it also goes through everything you would need to proactively prepare your property, your business, for a pending wildfire.

So one, it talks about really, I’ll start with the basics. Do you have the appropriate insurance coverages in place? And so it’s going to force you to review that and say, what are our policy limits? If we haven’t reviewed the building in a while and now we’ve got 300 kilometers away ablaze, do we need to get on that? Do we have the appropriate business interruption coverage? Do we have enough extra expense coverage to find a temporary location? Maybe if your area burns, you have to be in a completely different city center to operate temporarily while you rebuild. So it covers that.

But then it also talks about all the little things that you can do and who should do them. And it is pretty sophisticated. So they talk about zone one, zone two, zone three in fire preparedness. And I won’t go through them all and what they entail, but for example, it’s zone one is zero to 1.5 meters from any building. So what can you do or should you do? And it defines what that is and the steps you should take. And then you’ve got zone two, 1.5 meters to 10 meters. So you expand the area and what can you do there to be completely fire prepared and it takes it further 10 meters to 30 meters.

And it’s a really good, and it walks you through again, all the little things that if you really thought about it, maybe you’d come to that conclusion. But it’s just as simple as is there any debris up against the building? Is there a clear path for the fire to travel right through the yard and to the building? And if there is, you can do the following to deter it. And so very, very good tool for that. Very educational. It talks about how to create a wildfire evacuation plan, which is very different than an internal fire plan. It doesn’t just say, well, there should be a muster point out in the yard, X amount of meters away from the manufacturing facility because right now we could be in position where we’ve got a wall of fire heading towards the muster point, and sometimes the facility is further from danger than the actual muster point. So how do we build that out? How do you review it with the employees? How do you communicate with everyone of what to do in the event we get a notice saying you’ve got hours?

Paul Martin:

And that’s usually the way it works, isn’t it? And the officials come along and the emergency measures people and just sort of say, we’re evacuating, or you’re on a one-hour notice or something. If you get one hour’s notice to evacuate, you don’t really have time to build a plan, do you? Or to start to look at your yard and rearrange things. This is like everything else we talk about, the preparation, preparation, preparation, get ready in advance storyline.

 

Colin Rooke:

It is. And just to give you sort of a personal example at Butler Buyer’s Insurance. So we do have a full and complete disaster recovery plan that gets reviewed quarterly, like I portray on the show. But based on where one of our office is located, we are in a position where we often have our water shut off. And so we don’t know when that’s going to happen. They don’t say, Colin, in about three weeks, there’s going to be a water main and you’re going to operate, no water. And so we’ve been in a position where it’s happened a few times, and it’s usually we get to work, you use the tap, nothing comes out. And depending on when the incident occurred, we may have notice from the city, sometimes we have to reach out and find it for ourselves.

But we’ve talked about and said, okay, we need a preparedness guide for what exactly to do when the water’s turned off so then nobody misses a beat. Everyone knows who stays home. Everyone knows who stays here, where we go. And it’ll be a simple guide, but it’s an exposure that we have as an office. And so if you look at it in that context, if you are anywhere near an area where you’re prone to wildfire, do the work now, and hopefully you never have to use this, but in the event you do, and maybe it’s just a simple evacuation, you know exactly what to do, how to do it, what critical documents need to leave, because that’s the other thing. If you’re given three hours notice, who knows what they need to grab on the premise that you might never see that again. And that’s a big component of this guide itself.

Paul Martin:

Well, I mean, this is a hypothetical situation, preparation in advance for something that hasn’t occurred yet. And people might be saying, gee, you guys, come on. I mean, this is the prairies and you’re talking forest fires and whatever. But were also some parts of Saskatchewan in a drought. And so grass fires would probably be equally as substituted for forest fire. You say wildfire probably an accurate description.

Colin Rooke:

Exactly. We have clients all over, but very, very dry conditions. And back to where there’s smoke, there’s damage comment. If you’ve ever burned a whole bunch of leaves or a whole bunch of grass, that’s particularly potent, strong smelling smoke. And so you think about, okay, now I’m in a position where the farm has fires all around, you could have smoke damage.

Paul Martin:

Yeah. Listen, Colin, we’ve run out of time. This always goes by so quickly. Thank you for this very insightful, and I just again, want to say thanks for providing this sort of advice and guidance to people who are listening to us today.

You’ve been listening to Colin Rooke, the Commercial Risk Reduction Specialist with Butler Buyers. I’m Paul Martin. This is Risky Business. Thanks for joining us. We’ll talk to you next time.

People Plan

Home (Page 4)

Paul Martin and Colin Rooke discuss the people planning side of disaster recovery with special guest, Grant Douziech.

Listen to the full episode here, or read the full transcript below.

Paul Martin:

Welcome to Risky Business, commercial insurance with Butler Byers. This is Paul Martin, the business commentator on CKLM, and joining me, Colin Rooke, Commercial Risk Reduction Specialist at Butler Byers. And we have another special guest joining us today, and I want to welcome Grant Douziech with Apex Performance Consultants.

And Colin, you invited Grant to come along today, and maybe just a little background about why you did that, and then, Grant, we’ll haul you in here and you can talk about why you’re participating in our show today. So, Colin, over to you.

Colin Rooke:

Yeah, so in the previous episode we were talking about disaster recovery planning, and we’ve touched on it several times throughout the years. And it’s one of those topics where it’s an old one, but it’s always relevant. So we talked about, okay, how can we help plan for disaster, whether it’s a small loss, major loss, total loss. We talked about why the plan’s important. It’s absolutely crucial when trying to get back up and running as soon as possible. It outlines what everyone’s role is within the plan, who’s going to call who and why.

And then most importantly, we take that plan and we talk with the insurance market and say, “This client is prepared.” During that show I did allude to that I wanted to bring Grant on and talk about, okay, the plan addresses getting up and running from a physical standpoint, but it doesn’t really talk about the people, what they’re supposed to do, who’s staying on, is everyone staying on, what planning can you do around people planning.

And, you know, I’m not the expert, and I talk about, we identify the risk, we quantify the risk, and then we reach out to third parties to say, “Can you help us with this?” And Grant from Apex Performance Consulting is one of those people. And so I thought, “Bring him on the show, he can explain what he does and why it’s important to have a people plan as part of a disaster recovery plan, or just really proper planning altogether.”

Paul Martin:

All right. Well, Grant, welcome to the show. It’s always great to have these trusted advisors that Butler Buyers works with, and that provide some deeper insight into some of the more detailed parts of the program that Colin likes to talk about.

In terms of preparation, this concept or notion of step-by-step planning, and on the people side… And clearly people are the big issue right now, I mean, you hear about job vacancies, employers scrambling to find people… You’ve got to work as an employer and a business owner very, very diligently to make sure that you keep your team in the loop, if I can put it that way. And also figure out how to actually turn into reality this notion that my biggest assets go up and down in the elevator every day.

So Grant, jump in on this. And when I toss that out to you about, and as the way Colin framed it up, is the people side or the people planning side of disaster recovery, I mean, what bells go off for you? What are the key messages you want to deliver on that one?

Grant Douziech:

The key messages, and thanks, Paul and Colin, for the invite, it’s really about preparedness. As Colin mentioned to you, disaster recovery plans, it’s sometimes easy to think about your physical location, easy to think about IT and technology, putting into place, but people sometimes forget what do I with the people that I have. So for example, if you have a manufacturing facility that undergoes a catastrophic fire and is no longer operating, what do you do with the people that work there? What about the office staff? How do you continue to maintain some level of business when you have issues with people that now have to work from home or don’t have a location to work from?

So it requires a lot of communication and pre-planning to ensure that people understand what happens to them. Because at that point too, you don’t want people to suddenly think, “Well, I’m out of work. I need to go look elsewhere,” especially in this environment where they could probably easily find work somewhere else. And how do you keep them intact, and how do you keep your payroll intact? So those are big questions that companies should be answering before an event happens, because you don’t want to be planning it while you’re in the middle of a crisis.

Paul Martin:

Yeah, Grant, you raise an interesting point about virtually every business will [inaudible] of some form of business interruption insurance, but I’m assuming we think about that in what comes to mind for us is the customer. How do we get the customer and get paid, keep the transaction stuff going. Often we don’t think about the personnel side, the HR and payroll side of the people that we’ve got, their life interrupted too. And so I mean, do business owners in your experience kind of miss that one a little bit?

Grant Douziech:

Yeah, I think it’s something that you think of the last moment after an event happens. And like you said, Paul, a lot of these people have families. They’re not necessarily going to wait around for an owner to come up with a solution. They may have to be proactive because they have bills to pay, they have a lot of anxiety… I think it’s important that you’re on top of that communication to how long they’re going to be off, how are they going to get paid, and when do you plan to spool back up.

And it’s also different for people that are in an office environment, because you might be able to transition some of the work that they would do in a physical office to now working remotely, similar to what happened for us, majority of people, during COVID.

Paul Martin:

And it’s an interesting point, because we’re still having that controversy and that conversation about working from home. I mean, that’s one of the legacy pieces that came from that. For those businesses who thought, “Hey, that’s behind me, I’ve got that baby resolved, now they’re all coming to work in the office every day,” or, “we’re not going to build a policy around that,” probably, you know, this is another reason to have that policy, isn’t it? It’s not just pandemic.

But if you have some kind of a disaster that you have to deal with, all of a sudden this is back on your table again. And as Colin likes to say, you got to plan in advance. You can’t plan after the crash, right? You’ve got to plan before. So what do you counsel business owners to do on this front?

Grant Douziech:

Well, really it comes to sitting down and not necessarily getting into the weeds or the details of what event you’re trying to mitigate, because there’s several external things that could cause your business to be disrupted, but rather a detailed plan for each employee as to where would they work, how long would they be off, and how would we retain them in the event that they for some reason couldn’t come into work. And identify those roles that can be worked remotely, and what material, and supplies, and resources, they would need to do so.

You need to be able to pivot quite quickly in these cases, otherwise you lose people’s confidence and that’s where anxiety starts to kick in, and people start thinking about working elsewhere.

Paul Martin:

You just raised a couple of important words that I want to make sure that we get covered through this. And one of them is trust, that the worker has to trust that the boss has a plan, has this thing in hand. And you’ve used the word anxiety a couple of times in this, and clearly this is a part of the conversation or the vocabulary these days, and that people are talking a lot about this. We’re talking more about mental health issues and all of that.

So I mean, this is way more than just we got to close the door for a day or two here while we clean up the water spill or whatever, I mean, that’s the stuff that I want to dig into.

So if you don’t mind, just stand by, we’re going to take a little break. When we come back, those are the areas that I want to dig into, so maybe lend some thought to how you want to address that.

You’re listening to Risky Business Commercial Insurance with Butler buyers, Paul Martin here. We’ll be back after this break.

Welcome back to Risky Business, commercial insurance with Butler Buyers. Paul Martin, your host, and joining us today, Colin Rooke, Commercial Risk Reduction Specialist with Butler Buyers, and a special guest, we have Grant Douziech with us, who is with Apex Performance Consulting. And they specialize in the HR side of this, and we’re talking about disaster recovery.

And before the break, Grant, you were using terminology that is probably relatively recent in the vernacular of the business world these days. Words like mental health, anxiety, that 5, 10 years ago, that wouldn’t even have been a part of the conversation, now it’s pretty mainstream. I mean, what are you advising your business clients on this one? Like, how should they be looking at this? And you try put it in the context of what we’re talking about here is like, how does insurance factor into all of this, so…

Grant Douziech:

Yeah, that’s a good point, Paul, years ago, it wasn’t something that they would look at. However, having worked with some clients that have been through some catastrophic business interruptions, nowadays people are, they need to have confidence and trust with the owner, because people do feel challenged by everything that’s going on around them.

And they’re just trying to provide some stability and security to their own lives. And they do have loyalty to the company they work for, but at some point they have a spouse or a family that they’re accountable to, and they will need to make changes if they don’t feel there’s a plan, if they don’t hear anything from an owner till, you know, 48 hours after an event has occurred. You don’t want to create that thought that they might be out of work for a long period of time.

Paul Martin:

Colin, you’ve been listening in on this thing, I mean, what are you hearing here and what is resonating with you?

Colin Rooke:

Yeah, a couple of things. One, you mentioned how is this relevant to insurance, and I was thinking too, as part of the story we tell to the insurance market, I mean, which I’m primarily focused on, I was thinking how you could use this as a retention tool, or even a recruitment tool, to say, “We have a plan in place and obviously we hope there isn’t a disaster, however, we can share that in the event of a total loss or a major loss, we could be up and running in X amount of time. And also, with the insurance coverage, based on that, we carry ordinary payroll coverage up to 90 days or 180 days.”

So you could share that to the workforce and say, Look, this doesn’t often come up…” And it’s rare that the employees or even management are involved in a commercial insurance renewal, but something that you could share would be, “We have a plan in place for disaster.”

You could share your people plan, call it, and then you could add to that to say, “And we want people to know in advance, just in case there is chaos and we can’t get to everyone, or people forget, that we have coverage in place. So your pay would be secure even if we were closed and then unable to pay.” I think that could go a long way with, yeah, retention, just to share that, which admittedly I haven’t ever suggested to any of my clients they do until I had the thought now.

But also, furthermore, we can share that with the insurance markets to say, “Outside of insurance, they’re working on a people plan too,” which again, if everyone’s aware of their role and you think about getting back up and running to profitability, or at least the same level you were at prior to the loss, the more people that are on board, the less people you lose, the more anxiety you alleviate, the better the organization and the quicker you recover.

Paul Martin:

Grant, I want you to jump in on this one because I think Colin’s really touched on something interesting about using it as a recruitment retention tool as well.

Grant Douziech:

Yeah, absolutely. What a difference that would make in my mind when you’re recruiting a position and you’re letting someone know not only what you’re offering for benefits, and pay, and the value of working with your company, but also that you care for your staff and your people to a point where you have a plan in case something happens. You don’t hear that during an interview process very often. But for somebody who’s making a decision of, do I go with company A or company B, that could be a significant difference for them.

I also agree with Colin that I think it’s good to every six months or a year, just remind staff that you have a plan in place in case something becomes disruptive, and that you’re prepared, and that you’ll make sure that they’re looked after through the mechanisms of insurance and other programs that might be available after.

Paul Martin:

Well, I’m thinking just to, sorry, Colin, to doubly reinforce this is that this is a very, very competitive marketplace right now for talent, and every ledge will, well, could use every tool in the kit. And this is one I don’t hear very many people putting in the kit. So maybe it’s an interesting new idea that’s out there, that you may want to just share whether it’s as part of the interview process or onboarding if nothing else. But, Colin, you wanted to jump in?

Colin Rooke:

Yeah, just a similar thought, Grant being someone that would be involved very, very regularly in the interview process, I just wanted to know… And I think I know the answer to my own question. So you would say that it’s fairly rare that an employer would say, “And just so you know, we ensure a half-year’s worth of payroll in the event of a disaster. So if you joined us and something did occur, rest assured, one, we can be up and running in six months, and two, your wages would be safe,” and use that as a difference maker?

Grant Douziech:

And just to add on top of that, I think that also puts you in a position as a small and medium business owner to be competitive with a much larger company or corporation, because you’re now providing security through that offering. And that to me would probably be very reassuring to some people that are making that choice of joining a much larger company versus a small and medium business, which has its own rewards.

Paul Martin:

I would assume you’d have to kind of define what a disaster looks like and that sort of stuff, because losing a big client isn’t necessarily a disaster, it may feel like one, but it wouldn’t be an insurable one. So you’d have to kind of refine and define that a little bit.

But I think we’re into some really interesting territory here. And the purpose of this program is to inform business owners, and employers, and managers of some of the things that they should entertain when they’re thinking about business planning. And we’re covering some ground today that I’ll guarantee you nobody else has had a conversation about, this is a very fresh type of conversation.

So, Grant, I want to thank you for bringing that perspective here and getting us moved off into this territory, because I think it’s really unique. And we’ve got maybe a half a minute left, so I just want to kind of close on this notion you’d put forward about the idea of trust.

And I think many of us forget that as young people, we’ve got to pick a partner out of the herd and we got to hope that that partner will do what we need done. Then we got to go to the next step, which is pick an employer out of a herd, and hope that one actually knows what they’re doing and can guarantee a paycheck for us. And that then we can go about planning our own family lives, and planning the larger things in life.

And you’ve really put a finger on that today, and Colin is offering up this notion of, “[inaudible] and actually to protect that, we can provide you with some coverage, so…” I want to thank you for taking the time to join us today, Grant, that’s been very insightful.

Grant Douziech:

Thank you, it’s my pleasure.

Paul Martin:

And, Colin, as always, great to have you aboard and have this conversation. So we’ll pick this up on the next program.

You’ve been listening to Risky Business, commercial insurance with Butler Buyers, Paul Martin here. Thanks for joining us, talk to you next time.

Wild Fires and Disaster Recovery

Home (Page 4)

Paul Martin & Colin Rooke discuss the impact of wildfires and disasters on insurance.

Listen to the full episode here, or read the full transcript below.

Paul Martin:

Welcome to Risky Business Commercial Insurance with Butler Byers. This is Paul Martin, the host of this show, and the business commentator on CKOM. You hear me on an ongoing basis. Joining me as always is Colin Rook, the Commercial Risk Reduction Specialist with Butler Byers. Colin, I think we’ve just got to look at what’s going on in the news right now. The coverage is just wildfire, wildfire, wildfire. I mean, we’re talking massive disasters, everything from actual losses to the fire, but to air quality to you name it. I mean, this is a story that’s really dominating the coverage these days.

I’m wondering, anytime you talk disaster, you’ve got to talk insurance. There’s implications for this. So walk me through, what does this mean? I mean, first of all, if you have a cottage or your house burns down due to a forest fire, I mean, what’s the coverage there? Or after that, if we’re going to end up, probably there’ll be some big claims that’ll go here and that’s bound to affect premiums over the course of time. Just when you see and hear these kinds of stories, what bells go off in your head?

Colin Rooke:

Yeah, it’s funny. If you’re in the insurance industry, you’re inundated with natural disaster or claim information, and I bet in the last month, two out of every three articles from various insurance related sources are all centered around the fires. Certainly there’s an insurance twist. All the time, the impact on future reinsurance, the impact on profitability among Canadian insurers, how many people are forced to flee, what role government will play, where does the coverage begin, where does the coverage end. It’s funny, you asked about what coverage is available, for example, if the cottage burns. Well, it’s hard to answer. It depends on what you bought, how many others burned, what province, what area. So it’s a pretty situational type question.

Paul Martin:

It’s like asking how long is a piece of string.

Colin Rooke:

Exactly. And depending on the magnitude, eventually the insurance, if it’s a true plot loss, insurance companies, they’re not required to rebuild whole cities, as an example. It’s just not possible to do. So that’s where you’ve got both provincial and the federal government involved, but the more you read about these fires and the impact they’re having, it just brings you back to an original topic from this show and something that we revisited, but it’s always important, it’s always something that needs to be top of mind is as a business owner, I mean even for your own household, but I mean, as a business owner, do you have a disaster recovery plan or an incident response plan? Are you prepared? What would you do if you got to work and you’re truly staring at rubble, there’s nothing left, or maybe it’s a partial loss, it’s water, but you’re unable to operate?

That’s immediately where my mind goes when you read all this literature is, how many people will never reopen because the stats are against them if you do not have a working plan. It’s one of those situations where every second matters. If you can imagine that you’re in northern Alberta or you’re in and around Quebec and you have maybe one or two key competitors in your industry, and then now your business has burned, if you don’t get up and running as soon as possible, you’re losing market share by the second. And when it comes to coverage, I mean, if you’ve purchased properly, yes, they’re going to rebuild the building. You’re going to get a check for the inventory. You’re going to have business interruption that’s going to make you whole. But business interruption does not repair the damage of being closed. I mean, there’s some financial relief there, but the cost to acquire those customers, certainly if it’s contractual arrangements, what would you do if you couldn’t operate for nine months and what would you do to shorten that timeframe is immediately where my mind goes.

Paul Martin:

In a way, this is hypothetical, but frankly, the news coverage would tell us today it’s getting a whole lot more less hypothetical and more practical, more real. So what do you counsel people to do? What preparations can a homeowner make? What preparations can a business owner make in advance? You can’t predict where the fire’s going to be, but can you actually take some steps? What do you recommend to people when they say, “How do I go about this?”

Colin Rooke:

Yeah, so there’s quite a bit we can do. It’s dependent on the size of the organization. I mean, we’ve got documents as simple as a disaster checklist that are one or two pages long. We’ve got e-function checklists that you can identify two or three e-functions that need to be restored, or if you realize there’s seven, 10, whatever, you can keep using the form. But we’ve got as simple as one-pagers that will get you thinking of the right framework or at least the basics of what you could do if you had a loss. And then from there, we’ve got everything from very, very broad to very, very specific incident response plans. We even have developed a guide on … So it’s a guide that goes with the disaster recovery plan, and the guide is just as large as the plan itself because the guide walks you through what should be in your plan, who should be involved in your plan, and then how would you fill out the actual disaster recovery plan.

So that would be the most involved situation, but it covers every single function, every core function of the business. It covers multiple types of disaster, but it gives everyone a role. The reason why you would do that is it gives you a really good idea that if worst case scenario, you would know, you could be up and running in X or these are the core functions that we could do from anywhere. Now, COVID has taught the world a lot around pivoting and adapting and what you can take home with you and how you can still run a business. I think COVID really has made this task a lot easier because it forced everyone to change the way they think about how business is done, how work flows. And I think if you put in the time now, in the event of a major loss, again, it allows you to prep, plan and then mitigate the long-term damage of being closed.

Paul Martin:

I’m wondering too, let’s say you do that, you put that plan in place, who do you share that with? Should the staff know about it? Is this something you want to have in your file so you can talk to insurance companies about, “Hey, look at the quality of this company.” They’ve got all of these plans in place and they won’t mitigate damage or prevent a forest fire or something like that, a catastrophe. But look, this is just an indication of how they conduct themselves. Am I on the right track with some of those suggestions?

Colin Rooke:

Yeah, absolutely. Certainly as the bar raises, as the organization is larger, so when we talk about larger, I think about property schedules, meaning just more overall value, bigger buildings, more stuff in those buildings. I mean, there’s always a concern, especially if you’re in an area prone to fire, if you’re in an area prone to any type of flooding, and certainly if you’re in BC along a fault line and there’s a concern for earthquakes, it allows us to lobby on behalf of our clients and say, “They understand that this could be a $40 million loss. They’ve taken the proper steps to plan for this in advance, and they can predict and mitigate up to X damage.” Depending on the type of business, so big manufacturing as an example, a lot of revenue, a lot of people, the business interruption plain alone can get out of hand, which we can touch on a little later.

Paul Martin:

Yeah, we’ve got to take a little break and I do want to come back to that because I think we’re into something here that business people can really put their … It’s tangible to them. They can put their hands around this. You’re listening to Colin Rook, the Commercial Risk Reduction Specialist with Butler Byers. I’m Paul Martin. You’re listening to Risky Business. We’ll be back after this short break.

Welcome back to Risky Business Commercial Insurance with Butler Byers. Paul Martin here, and joining me, Colin Rook, the Commercial Risk Reduction Specialist with Butler Byers. Before the break, we were talking about basically that line that you use a lot about demonstrating to an insurance company that you’re best in class as a potential risk, and insurers like that. They will look upon you more favourably than your competitor or the business down the street. And at a time when natural disasters are starting to become big time headline generators, again this is going to get more important in the day-to-day life of those of us who are in business.

Colin Rooke:

Yeah. We’ve talked about the idea of capacity, just back to the insurance market and why tell the story and what we’re sharing, but we’ve talked about capacity on this show, and that means the dollars that insurance companies are prepared to commit either to a certain line of business or just business overall. But you hear capacity all the time. That would be all of my earthquake capacity, all of my flood capacity. So when capacity is scarce, and that’s the dollars that insurance companies are prepared to deploy, you really look to, okay, sell me on it.

I’m an underwriter. I think I’m staring at a potential for a major loss. Explain to me why you’re able to mitigate that better than anyone else in your field. And that’s where we walk through, well, they have a business continuity plan in place. It’s reviewed quarterly. They have every manager, every staff sign off, read through. Everyone knows their role, and they know worst case scenario, it would take X amount of time to be fully operational. Now, if you have a building and you’ve got $40 million worth of building equipment stock insured, so company A and then company B has the same 40 million, and we’re both faced with the same total loss, you think, well, 40 million is 40 million, and why would the plan help in any way to an insurance company if everything has turned to rubble?

Well, you get into business interruption claims where they are paying ongoing expenses, and depending on what form you buy and the coverage available, it could be up to two years of lost profit while they are desperately hoping you get back to operational, and having a plan can dramatically reduce or even eliminate a lot of those costs to the insurer, or sorry, insurance company if you have a plan and if you can show pending a disaster, we could be up and running in a few days and we may not need this coverage at all, versus we have absolutely no plan. We have no idea how long it would take. We don’t know how much business interruption we need. It would be an awful lot. We’ve got specialized equipment that could take up to 17 months to get back to us. So it’s the little things that turn the same claim into a huge number that could have been mitigated.

Paul Martin:

One of the key themes that we always talk about in this program is managing risk. I’m just wondering if in this conversation, as we look at this, sometimes if it’s natural disasters, you can’t manage that risk, but you can prepare for it. We talk about step-by-step plans. You’ve already alluded to the guides that you have available. You actually have a fair bit of information and resources available to businesses if they just want to give you a call. You’ll pass that on to them and help them prepare. But once I’ve got a plan prepared, who do I share it with? Is there any merit … For example, I mean obviously I’ll give it to you as my broker, but do I give it to my staff? Do I give it to customers? Do I give it to suppliers? I mean, what do I do with this thing?

Colin Rooke:

Yeah, so that’s the beauty of the work that we put in. In the implementation, the planning guide, it walks you through who should see this. This section, everyone. These sections, just management. This is the section that would go to third party suppliers. This would go to other vendors. So it does walk you through. We wouldn’t share the whole plan to the insurance company because they don’t need to know that Dave is going to meet with Cindy at Tim Horton’s for a coffee, but what we share is the meat and potatoes, how long, how much, where they would go and why.

When you’re talking about disaster recovery planning, it also sparks a lot of very good conversations like if the building were to burn to the ground, would you rebuild at all? Would you rebuild here? Would you rebuild the same building, larger building, smaller building, different material? That’s part of the planning stage, and that also impacts the type of coverage you may want to buy. So we learn a ton from those conversations about the future of the company and then how to properly insure our clients when we have these conversations about what they would do in the event of a major loss.

Paul Martin:

I guess just before, we’ve got maybe a minute or two left before we run out of time here today, so if we could just wind this up with what guidance do you give to those who are listening and to us today to reach out to you? I am assuming you will encourage them to give us a call, ask us some questions. If I am dialing you up, what should I expect or what should I be asking you?

Colin Rooke:

Yeah, I mean, you could reach out and then say, “Look, I’ve got some questions about disaster recovery planning or business continuity planning.” If you’re a small organization, you don’t need the 55 pager. We won’t provide the 55 pager. I mean, there is a process you’ll go through and we’ll only give you what you can truly benefit from. So that’s why I say we’ve got different types of incident response plans, and everything from we can build out a grouping of policies and one-pagers that could formulate your plan. We have a simple 3- page plan for the types of businesses that don’t really need a ton. And they could be large. It would be fairly simple to move a group of consultants somewhere in Saskatoon or anywhere else in the province where there’s available space. So it doesn’t have to be that involved, but we’ll get you something, but it allows you to plan.

And then just skipping ahead to a future show, I’d like to have an HR specialist that’s going to talk about the people plan. What do you do with your people? What is your role as an employer? And then what does everyone do about work in the event of a major loss?

Paul Martin:

Colin, as always, the time goes by so quickly and the insights are so useful. You’ve been listening to Colin Rook, the Commercial Risk Reduction Specialist with Butler Byers. This is Paul Martin. Thank you for joining us. This is Risky Business. We’ll talk to you next time.

Cyber Liability for Directors and Officers – Part 2

Home (Page 4)

Paul Martin & Colin Rooke continue the discussion on the implications of cyber liability for corporate directors.

Listen to the full episode here, or read the full transcript below.

Paul Martin:

Welcome to Risky Business Commercial Insurance with Butler Byers. This is Paul Martin, the business commentator on CKOM, and joining me today, Colin Rooke, commercial risk reduction specialist with Butler Byers. And Colin, the last time we got together and had a conversation, the topic de jour was just an update on sort of the newest nuances around cyber liability, cyber security, and obviously we’ve talked a lot about how businesses need to be very proactive and really be on top of this thing. But there’s some legal subtleties around this too and in particular, those who have in your corporate world, there are directors, there are officers, and sometimes boards of directors that there are implications for them as well. That’s not just something that is operational. This goes right up to the very level of those who hold titles such as corporate secretary or president and director.

So maybe we just pick up there, if you don’t mind. We had that conversation last time, you’ve put together a directors and officers step-by-step guide, but just maybe let’s refresh that conversation from last time and there were some sort of new areas that we really didn’t get a chance to get to because of time last time. So let’s do that this go around. Maybe just a quick recap of what’s the lay of the land and this side of the sort of legalese and the fiduciary side of the corporate elements related to cybersecurity and cyber protection, cyber attacks.

Colin Rooke:

Yeah, so we were talking about our assessment for any board. It could be used for the organization itself at the management or leadership level, but really it’s designed to pinpoint or outline as a board thinking of cybersecurity, what you need to make sure the organization or the business has in place to protect the board itself and their liability. So rather than say, again it really is a checklist of what the board should ask for, what the board needs to see, what the board needs to make sure is occurring at the organizational level. And it’s different than a guide we would use for any business. It’s not a, this is what an incident response plan is, this is the step-by-step of how to do it. This is educating the board to say why you need to recommend they have an incident response plan, who to assign to get it done, why it’s important and the impacts.

So I guess I created a lot of fear at the board level from a pre-claim perspective, not doing your due diligence and then also being called to task from a post claim perspective. And so very important one, you got to do the work beforehand. What have you done beforehand? If there’s a breach, how did you handle it? What policies and procedures are in place? And so this assessment covers all that. But I didn’t get to sort of finish off, okay, well where is the insurance industry on this? Are you left just… I outline what you need to do. I uncover all these exposures, I create this fear, but is there coverage available? And so I did want to just circle back and say, yes. So cyber liability, underwriters and directors and officers, underwriters have recognized there may be gaps on both sides of the policies. That in a cyber event, fingers are being pointed at the board of directors and officers or any board that’s formed and they are being questioned on pre-incident policies and pre-incident work.

For example, if the board was aware that the controls were quite low but did not step in to remedy the problem, maybe they just didn’t get to it or the expertise isn’t there, they are adding in coverages. They are working on that to say, okay, we need to extend coverage on both the cyber liability policy and the directors and officers policy to cover these boards. So there is an exposure there. And the main concern being is you’re not going to get qualified board members if there is a concern that their individual assets are at stake in the event they make a mistake like failing to be cyber secure.

So yeah, I did want to just touch on and say this is being worked on. It’s certainly not across the board, but the cyber market and the directors and officers market is aware of this and are working on it.

Paul Martin:

And I guess we should probably just mention too in the run-up to this here, and as I set this thing up, I really talked about corporate boards probably we need to talk about not-for-profits and charities. And this is the kind of thing that many people who are listening to us, they’re involved in the corporate and commercial community, but they’re also very involved in the broader community, whether that’s through their church group or the local service club or just a not-for-profit or charitable entity that they end up on the board of, those liabilities hang in there for them even though they’re doing so-called dogooder work. You’re not immune, are you? Because you do have donors’ information and there’s stuff that the cyber pirates would actually be interested in.

Colin Rooke:

Exactly. Yeah. It’s not just meant for large corporate boards, it’s really anyone sitting in a board position on any type of organization. You really are held accountable for the operations you’re overseeing. And that’s why understanding what to ask for, what to look for from a cybersecurity perspective, and also really understanding the potential liabilities of the board, like an exposure, like being called to task or blamed in the event that controls aren’t there. Or again, post breach boards are coming into question of how they handled the aftermath. And so if you work through this document, it helps you identify and ask what you need to ask be completed to frankly cover your bases.

Paul Martin:

I guess the thought that comes to mind on this is will this kind of potential liability cause people to say no thank you when they’re asked to contribute by sitting on a community board or something? And I guess I’m just asking, there are ways to protect yourself and it’ll give me some comfort that if I do actually agree to sit on the governance board of a local charity or not-for-profit, that I’m not signing my death warrant here, that this is actually manageable.

:

It is tricky. And if you’re thinking of joining any board, it’s important to ask a lot of questions about the board, about policies and procedures. Directors and officers insurance has been very volatile and really it started with covid. Commonly, you see a lot of wrongful dismissal type instances hit the board level. And when you look at the environment we’re in today where we’re coming out of covid, but now you’ve got boards for example, maybe managing investments or managing debt at an increased rate, which again could lead to additional layoff.

So I guess what I’m saying is before joining any board you really want to figure out, okay, you want to ask as many questions as you can about the structure, the policies and procedures. Is the company itself healthy? Are there proposed layoffs? What are the financials? Don’t just say I’ll join because it seems like a good idea or someone has asked you to do it. It’s more important than that. Even if there is coverage in place, really no one wants to be part of a lawsuit directed at a board. And so with so much uncertainty with the product, I guess, and volatility with interest rates, it’s important to do your due diligence.

Paul Martin:

All right. This has been very, very insightful, Colin. I want to thank you for that. And we’re going to take a little break and maybe change topics when we come back, but we’ve got to just step away for a minute. So if you hang with us, you’re listening to Risky Business Commercial Insurance with Butler Byers. This is Paul Martin back after this.

Welcome back to Risky Business Commercial Insurance with Butler Byers, Paul Martin here, and joining me, Colin Rooke, the commercial risk reduction specialist with Butler Byers. Colin, before the break, we’re talking cyber. I want to just maybe change topics right now and maybe something well a little bit more fact and figure based, a little bit more data. Now here we are just entering Q2 of 2023, and this is the time we start to see all the financial reports from 2022. I assume they’re starting to come out and I know you’ve got some data and well, how did the insurance industry perform last year? And that really has significant implications for the cost of insurance going forward. So what did we learn from last year? What have they started to tell us?

Colin Rooke:

So we’ve been spending a lot of time over the last few years talking about the hard market. I’ve spent a lot of time explaining why your premium may be increasing at a rapid rate, why it’s so important that you’re aware of how that occurs, the role that you the customer play in it, and why it’s so important to tell your story effectively from a proactive risk management to be on the winning end of these increases and to get all the available discounts back to the organization by putting in the work. And so yeah, we spend a lot of time talking about, okay, well what’s going on in the world? These insurance companies are not profitable. Loss ratios are 141%. And so with the update, with 2022 in review, it’s interesting and it just shows that there’s some stability in the market and I think we’re headed towards stability.

So if you look at the top five insurers in Canada that would make up 42% of all collected premiums in Canada, they grew at 7% last year, which is just slightly above, they’re barely keeping pace with inflation. And so taking that information, you could say, okay, well would’ve grown by of course new client acquisition, but also in a large part rate increases. And so it just shows that the overall increases that they’ve seen were very on par with inflation and it is reflected in insurance premiums.

We are consistently seeing five, six, 7% increases. And although it seems high, of course we’d like to see no increase or maybe a decrease, but that is the inflationary environment we are in. And so what you can take away from this is that this data shows a trend, a strong trend towards a more normalized rate environment. And so the industry itself was profitable last year, the combined ratio was 85%, meaning that 15% was available for profits for the insurance companies. And so when you look at their growth estimates, again, it really is reflected in renewal premiums that six-ish has turned into the new norm, meaning even there, you put the work in, you could see the decrease while someone else is seeing 15% as well. But I like the trend, it just shows that, you can expect prices to stabilize, at least for now.

Paul Martin:

I guess that’s kind of musical to the ear to hear you say that we’re seeing the end of the hard market at least is in sight. That light at the end of the tunnel is not the train, but actually is daylight that we’re coming out to the other side. Is that a fair assessment of that or am I simplifying it too much?

Colin Rooke:

No, it is. And again, six, seven percent seems high, but when you look at inflation, it’s not. So I think we’re back to profitability. Claims have been in check, there’s good growth and I think that across the board, you can expect that sort of six, seven percent to be the norm. There are certain industries like directors and officers and cyber that may be a little higher, but even some of that, we’re seeing more players enter this cyber market, which is going to drive prices down. And 18 months ago with directors and officers, we were seeing large heavy increases. And even those have relaxed quite a bit. So I think it’s safe to say that, I’m not going to say that the market’s softening just yet, but it’s certainly we’re not having these year over year 30, 40, 50, 300% increases that we have been seeing over the last few years.

Paul Martin:

Well, I just want to harken back to a comment that you made earlier in this part of the conversation where you said if you do the work, and I just want to harken back to that because it’s really been kind of I guess the theme of what we’ve always been talking about in this program is that if you want better insurance rates, coverage, premiums, all that stuff, be a better customer of the insurance company. And that’s really been the argument that you’ve made all the way along where here’s the guides, the step by step plans, here’s the way that you talk the language that the insurance company wants to hear. So as we start to see the market more tilting in favor of the buyer, probably no better time than ever than to dig in with this stuff and say, Colin, give me some of those step-bystep guides and I’ll see if I can’t even beat this inflationary increase and maybe do a little better than average.

Colin Rooke:

Yeah, absolutely. It wasn’t long ago where we did a show saying sometimes 20% increase is winning because the other guy is getting 60, so put in the work today and let’s hope you’re only at 20 where someone else might be at 200. And so it just shows now that if things are normalizing, that the best customers of the insurance industry can put in the work, can actually receive discounts.

Because like I said, if average is now seven well, if you are that hidden gem that the insurance market needs to know about, you can actually benefit from decreases from savings. And the tides are turning, where we’re seeing insurance companies say, I want that account now. We want to grow our book. Versus a few years ago, it’s, please explain in detail why I should take this account because statistically we’re going to lose money on it anyway and we’re happy with what we have. So things have changed and it’s just a great time to say, well, if I want to beat inflation and actually look for some discounts, which I haven’t seen in quite some time, work on it.

 

Paul Martin:

Well, I guess that’s the point that the market has changed and so finally after a few years, the insurance companies are now more willing to actually listen to your story. And if you’ve got a good, cogent, well constructed, well organized story, you actually have a much better chance of winning the day, if I can put it that way. But you, as their broker, you need to be armed with that information so you can make the sale, you can make the pitch on their behalf.

Colin Rooke:

Exactly. Earlier in the show we talked about the guide, the cyber insurance guide for any board really. And again, if we’re putting in an application and we say, oh, by the way, we have this guide that we filled out and we’ve got all the answers, we can support that with the submission, versus you know what? Treat this board like everyone else because on paper they look like everyone else. It’s those putting in the effort, putting in the work, the true top performers that are going to be on the winning end of the pricing.

Paul Martin:

Well, Colin is always great insight on how to improve my business and how to improve the coverage and the prices that I pay for insurance. So thanks again for that. You’ve been listening to Colin Ruck, the commercial risk reduction specialist with Butler Byers. This is Risky Business. I’m Paul Martin. Thanks for joining us. Talk to you next time.

Cyber Liability for Directors and Officers

Home (Page 4)

Paul Martin & Colin Rooke discuss the implications of cyber liability for corporate directors.

Listen to the full episode here, or read the full transcript below.

Paul Martin:

Welcome to Risky Business Commercial Insurance with Butler Byers. This is Paul Martin, the business commentator on CKOM. Joining me today, Colin Rooke, the commercial risk reduction specialist with Butler Byers.

Colin, a lot of times we’re talking about the operational imperatives, if I can use it that way. We’re guiding senior management in businesses that you need to do this, you need to do that. Today we’re going to maybe step it up even one level higher and talk to those who … and this is often owners of businesses or senior executives, but people who carry the title of corporate director. Tend to think of that in the context of bank directors and stuff, but really just about every company has directors. So there are certain duties, obligations, and responsibilities that come with that. This takes us back to that good old world that we always seem to be talking about, and that’s cyber. Can you talk to me about what are the cyber liability implications for carrying the title corporate director in terms of your duties and fiduciary responsibilities as a director of a corporation? Is there some linkage there? Is there something we need to be talking about?

Colin Rooke:

Yeah, absolutely. For anyone that’s active on a board of directors, as director or an officer, if they’re working for or with an entity that has a cyber liability claim, what is commonly unknown is the responsibility that the board has to ensure that, again, that the entity is cyber secure. So what we’ve done is we’ve put together a guide for directors and officers, to ensure, one, that they know what they need to know as a board when it comes to cyber liability, cybercrime, and then really, two, how to get what they need done from the organization. What are the implications to the board? Then what can they do about it? Then what documents do they need? Which is different than other guides we’ve talked about. A lot of the tools I’ll say that we discuss, they’re for the organization, they’re for the business. Incident response plan, and we have those, but in this case, it’s from a board level. What policies? What procedures? Incident response plan is in there, but what are we even asking for? How do we get it done? Who’s involved? Who do we bring to the table? Who do we bring to the board? Do we need a cyber expert on the board? Do we look for that internal champion? What are our requirements? That’s what this guide covers.

Paul Martin:

If I got this right, it’s basically the checklist for corporate directors to, say, make sure that you’ve asked management about all of these things and that there are mitigation plans in place so that if there is a breach of some kind and your organization comes under the scrutiny of evaluators, you as a director can say, “Hey, we looked at this. We discussed it. We did our job. We did our duty. We still suffered the breach, but we were responsible and we were ahead of the curve on thinking about this.” Is that a fair description?

Colin Rooke:

Yeah, absolutely. That’s what we’re after. Really, the point is to avoid lawsuits aimed at the board. Whether there’s directors and officers insurance in place or not, again, the board is held to a higher standard. The reverse of what you just said there is imagine if there is a breach and the general manager says, “We’ve talked to the board about cyber in insurance and cybercrime, and they were neither here nor there, and we didn’t really pursue it.” Then you speak to the board and the board admits, “We really didn’t know much about it. We’re not really aware of the types of threats that we need to be looking at, the types of sensitive information we may have. So we didn’t place anything or recommended or do anything, but frankly it’s because we know very little about the subject.”

Paul Martin:

Now, one of the themes that you and I talk about in this program is making your business a better, more attractive and appealing to the insurance industry. I want to be a good customer so they give me better rates, better coverage, better treatment. This really falls into that category, doesn’t it? If you are on a board, one of your duties is to make sure you run a solid ship, and this is one way to do that.

Colin Rooke:

It is. If you’ve been on the buying end of a director’s and officer’s policy in the last three years, and certainly in the last 18 months, you’ll know that the premium for this type of coverage has gone up exponentially. Then coupled with that, you’re looking at restrictions, removal of coverages. You’re looking at higher deductibles. You’re looking at endorsements that, again, are removing coverages that were previously there. It’s all around the if the board can’t show that they’re a board worth ensuring, you’re going to be on the losing end of market adjustments. They’re going to treat you as average, at best. So it’s really important for our customers, for us to be able to say, “They’ve done a high level assessment of the board effectiveness,” which we talked about probably a year ago on this show.

We review the board. We walk through, “Is the board effective,” across all levels, and we’ve got a great tool there that, again, we’ll ask for every policy procedure of tracking of minutes. It’s a great package, but when it comes to cyber reliability and due to the frequency and severity of the losses … Which interesting statistic, 2.9 million US dollars are stolen every minute now due to cybercrime. The breach occurs. Fingers get pointed. For example, first question, has the board adopted any written cybersecurity policies, procedures, or internal controls? What tools have they implemented to deter cybersecurity events? If you don’t have an answer for that, you’ve got a problem.

 

Paul Martin:

I’m assuming that there’s some sort of personal exposure here to corporate board members if they can’t answer these questions effectively. That seems to be one of the areas that you see the law moving towards is to hold the individuals who sit on boards of directors personally liable for some things. You get it for payroll and for unpaid obligations to the federal government, for tax withholdings and that kind of stuff. Is there a risk that board members personally could be carrying some liability here?

Colin Rooke:

Yeah, absolutely. Certainly, if you’re on any board, you want to make sure there’s a director’s and officer’s policy in place because that is the nature of a claim against the board, is that each individual is being held personally liable for the decisions they’ve made. If you could imagine, on a typical board, you ask or hire people to join the board based on unique traits they may have, to create a well-rounded group. Not every board and, in fact, most boards will not have a cybersecurity expert or even someone from the IT field that would say they’re a cybersecurity expert. It’s just not feasible for most boards to do that. So you’ve got this onus to know a lot more about cybersecurity than the group’s expertise would allow. So who helps the board?

For example, who notifies the board that it’s their requirement to either hire or appoint a chief information officer? If you don’t have someone that’s well versed, where do they find that info? This guide says, “Do you have this? This is why you have to have this. It can be paid or volunteer, but it must be done. In the event there is a breach, you’re going to be asked, ‘Who is it? Who’s been monitoring cyber protocols?’” This guide will walk you through everything. One, it defines the role and then walks you through everything you would need to work on to be effective as a board.

Paul Martin:

All right, we’ve got to take a little break here, Colin. We’re into something that’s really quite fascinating and far more far-ranging and more far-reaching than people would expect. I’m looking forward to carrying on this conversation right after this. You’re listening to Risky Business Commercial Insurance with Butler Byers. I’m Paul Martin, back after this break.

Welcome back to Risky Business Commercial Insurance with Butler Byers. Paul Martin here, and joining me, Colin Rooke, the Commercial Risk Reduction Specialist at Butler Byers. Colin, just before the break, we were talking about potential liability that may fall personally on a director of an organization in the event of a cyber attack. It’s this kind of a new nuance or twist that’s coming out of these cyber insurance realm. But I’m curious. We’ve been talking about this in the context of corporate boards. Many people who will be listening to this will be participating on volunteer boards or charitable boards or foundations and trusts and that kind of thing. Do the same set of rules apply there if you’re on the board of your church committee or whatever? You’ve got financial data of the congregants. Most organizations are out raising money. You’ll have financial banking records and that kind of stuff of your donors. Are these the kinds of things that are going to get captured in this if you’re just running the local 4-H club?

Colin Rooke:

Yeah, absolutely. That’s why the threat is so real is that, again, you take a small nonprofit or the church board. You may not have the luxury of hand-picking the experts that your congregation needs to effectively run the church. Often, it’s just a select group of very dedicated people, individuals that want to volunteer their time for the betterment of the congregation. Yet suddenly you’re called to task and you need to understand what operational risks, what legal risks, and what financial risks are there when it comes to cybersecurity. Again, where do you get this information? Who helps you if you don’t have the luxury of being able to either appoint or hire someone to navigate you through this? Even on the hiring end, if you’re not well-versed in cybersecurity, who do you hire? Who do you ask? Where do you find this person? How do you know if the person you’ve reached out to even knows what actually is required of you at the board level? That’s why this topic is so important. And another.

Paul Martin:

That’s why this guide that you’ve made available, basically free of charge, it’s available to anybody. It could be really an important source of information for people who have not given this any thought.

Colin Rooke:

It really is. For example, we’ve talked about educating the workplace when it comes to cybercrime and that almost all forms of cybercrime are human error. Yet recent survey shows four in 10 Canadians in the workplace have never received any cybersecurity training at all, meaning not even a, “Do you know what a virus is? Do you even know what cybercrime is?” I mean nothing. If you look at those stats, 40%, is every board in Canada now effective if so many people are saying, “I have absolutely no idea what it is or how it affects me in any way.” Then you think about just the public at large being asked to volunteer their time with, for example, the subject of the smaller nonprofits or the church congregation. Now these 40% who’ve had no training whatsoever, if they’re serving on a board, how are they held responsible for educating the organization that they’re working on behalf of?

Paul Martin:

There’s going to be some chill with this, Colin, in that why would I go sit on a board of a charity or my local minor hockey association if this is the kind of risk that I am going to run as an individual, personal risk? It’s not enough that as a hockey board member, I get yelled at by the parents because, “My kid doesn’t get enough ice time,” but now I’ve got this potential legal liability that’s hanging over my head. I guess I’m asking, is this guide that you’ve provided, is it one tool that can be used to turn down the temperature on that chill or raise the temperature on the chill, if I can use that metaphor to just say make people more comfortable and willing to accept, say, an appointment to a board of directors?

Colin Rooke:

I think this guide, coupled with our board effectiveness guide should appease any concern that most, I’ll say, potential or even current board members would have. Depending on the nature of the organization, you’re held to different standards as the board, but if you’re using this guide, this cybersecurity guide with our board assessment, it is going to cover things like, do you have a basic director’s and officer’s policy that protects the members? There is a shocking amount of boards that do not carry this basic coverage. Then once you start educating those individuals on the board that even though they’re volunteering for the local hockey association, are you aware that your personal assets are at risk? They don’t. If there’s some guide you can access that says, “These are my responsibilities, but these are also the items that must be in place on any board,” I think you can join up with a little less angst.

Paul Martin:

Yeah. I guess at the end of the day, I’m curious about where this all comes from. I guess if I’m the mind of hockey board and you think, “Why would we be subject to this,” if you’ve got the records and finances, the organization accessed by computer, you’re pretty much vulnerable. You imagine a hockey association that gets held up for ransomware. You can’t pay for your arenas. You can’t pay for your officials, nothing, travel. You can start to see the implications of that. But I can’t help but think that a lot of times we think this is out there and it’s something I guess it’s floating around, but it doesn’t affect me. In fact, it does. In a way, if you look at the conflict going on in Eastern Europe, Canada’s intimately involved in that battle as a supplier to the Ukrainian side, and many of these attacks are coming from the Russian side. Canada is being attacked by Russian cyber criminals. This is almost like a war footing we need to be on here.

Colin Rooke:

Agreed. There’s a lot of cybercrime dollars being funnelled to Russia at the moment. It’s not going away. The stats show that it’s not going away. It’s not lessening at all. Frankly, Canadians aren’t even getting all that better at deterring, meaning the level of deterrent is not exceeding the rate at which the sophistication of the cybercrime grows. So it’s so important that everyone do their part to at least minimize, make their life difficult, know what you should do, and prepare the organization for that.

Paul Martin:

Colin, fascinating subject and far more wide-ranging and reaching than the average citizen really understands. I think that if there’s a storyline here today that we pass along, it’s that, yes, you too can be victimized by this. You need to be aware, and you need to arm yourself about the threats of cybersecurity and the challenges that are there, particularly if you’re just trying to be a good citizen and help some organization in your community. There’s liable to be some obligation attached to that.

You’ve been listening to Colin Rooke, the Commercial Risk Reduction Specialist with Butler Byers. This is Risky Business. I’m Paul Martin. Thanks for joining us. Talk to you next time.