Inflation & CPI

Home (Page 5)

Paul Martin & Colin Rooke discuss monthly inflation numbers and Consumer Price Index.

Listen to the full episode here, or read the full transcript below.

Paul Martin:

Welcome to Risky Business, commercial insurance with Butler Buyers. This is Paul Martin, business commentator in CKOM and the host of this program. Joining me today, Colin Rooke, commercial risk reduction specialist with Butler Buyers and the man with all the insights into the workings behind the scene in the insurance industry and more particularly ,the commercial side of the industry and what that means for business owners and those who are in management positions and responsible are ensuring that they have insurance in place to cover their operations. Colin, welcome. Great to chat with you again.

And the topic that’s catching a lot of attention these days is inflation. As always, we wait with bated breath to hear what the monthly inflation numbers are. We just saw those and they’re down slightly. But what we forget to mention is that is something called the CPI, the Consumer Price Index, which is at the end of the chain. Insurance, it fits into more of the supply chain because it’s part of the business supply. And my understanding is that we haven’t seen inflation in that sector in the supply chain yet starting to see the same kind of reductions that we’re seeing at the consumer level. Is that a fair observation?

Colin Rooke:

It is. So the largest insurer in Canada has come out and said this hard market, the idea that this year-over-year increase, it’s going to continue for the next few years. And they’re large enough to say that with confidence because they’re, for the most part, setting the terms that the others will follow. And the reason for that is of course, although inflation is lessening, still the full brunt hasn’t, it’s continuing to hit this industry. You look at the rising cost of claims, and from an insurer perspective, you’ve got the in-house capacity or their own in-house retention. So what level of claims they are able to pay in-house, and then from there they buy insurance. And unfortunately, due to reinsurance, they call it reinsurance, and due to reinsurance being used so often, and that’s due to the rising cost of claims, these reinsurance bills have skyrocketed despite insurers across Canada willing to take on more and more of the risk in-house.

And so really it’s a long way of saying that their costs are still skyrocketing. Their bills are skyrocketing as a result, and then therefore they need to recoup those costs from their customers, and that’s going to end up being auto, personal lines, and commercial. And so they’re saying, although maybe the increases will be lessened, this idea that inflation again has been curved a little bit or we’re on the right track, it’s certainly not going to go away anytime soon and we’re not going to return to a soft market for a while.

Paul Martin:

If I can put it another way, you’re saying that inflation is affecting insurance claims, so they’re getting bigger. Costs you more to fix a broken pipe, or if you have a fire in your house, it costs more to repair it, and so insurance costs are going up. So when the insurance companies buy insurance, that second tier of insurance companies, the reinsurance guys, you call them, their claims go up. And so now we’re starting to see this thing filtered through. A lot of the system that most of us don’t even know exists, we don’t even see it, and so there’s insurance for the insurance companies and their costs are going up and they’re passing it all along. And at the end of the day, the chain ends in the hands of the consumer or the small business owner.

Colin Rooke:

Exactly. The impacts of the market are now actually hitting you the reinsurance side. And so now we’ve got the largest insurer in Canada and really all of those underneath it, they are saying it’s costing us a lot more to buy the insurance we need, and therefore the insurance the listeners are going to be buying, it’s going to be costlier. I do find it interesting too because you read a lot of these articles and they’ll talk about rising prices, hard market, soft market, and I have to be vague, what does that look like? What kind of increases are we talking about?

But in this case, they’ve come out and said it’s going to be in the high single digits. And so it’s interesting that they’re able to come out and say across the board it’s going to be 8%, 9% increases to all of our policies, which that’s going to be a barometer for the most part for the rest of the market. And so you can say with confidence that 7%, 8%, 9% is probably going to be what most people are going to see across all lines. Now, some segments will be higher, some segments will be lower, obviously, but it’s rare that we get a real indication of what they’re going to do. And we do have that now.

Paul Martin:

There’s something called the industrial input price index, which they alluded to earlier. There’s the consumer price index and then there’s one about what’s the inflation inside the supply chain? We hear consumer inflation sitting 5%, 6%, somewhere in that range, and the industrial one is 15%, 16%, and that still has to work its way through the system. So we probably should not expect that inflation’s going to go away or that premiums are going to start to decline in the very near term. Correct?

Colin Rooke:

Yeah, absolutely. I couldn’t have said it better. It’s still working its way through, which is why they’re being cautious to say, we would love to charge you less, however, it’s going to be some time before we really get a handle of the true cost of inflation overall. And at a high level, they cannot get claims costs under control. And it varies by segment and it varies geographically. And so the average purchaser of insurance across Canada should anticipate, unfortunately, more increases.

Paul Martin:

And for not just this week, right? Probably for a relatively extended period of time is what I’m guessing is that it’ll take a while until all of the measures that central banks put in place and whatever. It took us a long time to get inflation up. It’s going to take a long time to get it back down too, I guess.

Colin Rooke:

Absolutely. And as I mentioned too, being the largest insurer in Canada, they set the stage for the rest. And if they’re coming out saying, we’re going to be 8%, 9%, the others will follow suit because the door’s now opened for asking or commanding those higher prices as well.

Paul Martin:

We’ll just say to those who are listening, if you’re in the commercial realm and you’re thinking about budgeting or whatever for the coming year, this is something to keep in mind that insurance rates are not going to be declining for the near term anyway. Certainly, not in this fiscal year based on what you’re telling us and what the indications are from the big players in the market, that they’re still on the wrong side of that equation and their intention is to get that fixed.

Colin Rooke:

Yeah. And I don’t think it’ll come as a shock to most when you look at all things in really any consumer good lately. I wish I had better news, but yeah, it sounds like don’t budget for any decreases anytime soon, but on the sort of happy note, less of an increase.

Paul Martin:

Right. You’re listening to Colin Rooke, the Commercial Risk Reduction specialist with Butler Buyers. We’re talking commercial insurance today. We’ve got to take a little break, but Colin, when we come back, I do want to move down the line a little bit to something that affects us at the personal level, and that’s just the auto industry and some of the interesting nuances that are going in there. So you stand by, we’ll come back and take up that subject right after this break.

Welcome back to Risky Business Commercial Insurance with Butler Buyers. Paul Martin here, and joining me, Colin Rooke, the commercial risk reduction specialist of Butler Buyers. And Colin, before the break had a little teaser that we’re going to talk about auto and not so much auto rates, but one of the interesting aspects that comes out of this is that it’s no secret the auto industry’s just been wrestling with supply chain problems since Covid and drive by any new car lot, and there isn’t very much inventory there. Dealers are struggling to get their hands on inventory, factories are having a hard time getting it out, but that filters through in some places you wouldn’t really expect like the rental business. So why would we even talk about that one today?

 

Colin Rooke:

Yeah. I was just going to say, why are we talking about the rental business? And this is just something to keep in mind. And so a big issue when it comes to auto claims and insurance is length of rental. And so that number has been skyrocketing across Canada. I don’t have the data, but I assume North America and probably worldwide, but in Canada, that number has skyrocketed. So why am I talking the length of rental? If you are in any type of auto accident, whether the car is drivable or not, you’re looking at repairs. The length of rental in Canada, the average is 17.1 days, which is up from 14 days in 2021, which is up from 10 days, or sorry, up from 2022 and then up from 2021. And so what’s occurring now is if you need to rent a vehicle because your vehicle’s been rendered drivable, the time you’re going to rely on a rental is increasing.

Why is that an issue? Well, one, when it comes to coverages like loss of use, you get a lot of people that will say, well, I don’t need it if my vehicle’s in the shop for a little while. I’ll just rent a car. So I’m here to say that if you’re thinking it’s a few days, it’s not. It’s probably going to be up to a month or possibly longer. Another thing to consider too is in the event of a total loss, you say, okay, well I can’t use the vehicle, the damage can’t be repaired, and so I’m going to receive some sort of check and I’m going to go purchase a new vehicle. Well, the issue there is that it’s hard to a new vehicle. And again, now we’re back to length of rental. And so in Canada, the average time it takes from a total loss to being able to purchase and procure your vehicle is about 34 days.

So again, the idea that you’re going to take some money and go get a car, it’s not working that way at all. And then I guess last to consider is if you are in a accident and the vehicle isn’t drivable, you’re looking at the high twenties length of rental. So one, if you haven’t thought about buying lots of use, just keep in mind that you could be footing a bill for quite some time. If you could find a rental, it would be costly. But even if loss of use, make sure that you have enough there to cover off how long you could conceivably be without vehicle or needing a rental while you’re waiting for a repair. Again, wanted to point it out. This is of course caused by supply chain disruptions, parts delays, collision backlogs, people issues, technician shortages. But again, very important to keep in mind that if something goes wrong, you might be without your vehicle for quite some time.

Paul Martin:

I guess if it’s hard for car dealers to get their hands on new vehicles, it’s equally hard for the rental agencies to get their hands on vehicles too. So that makes some sense. But my guess is that as a consumer, not very many of us ask the question about the length of loss of use. That’s just like when you’re buying your auto insurance, it probably is, oh yeah, you’re covered for if you have an accident for a rental, but nobody talks about how long. Is that a question that a consumer should be asking?

Colin Rooke:

Yeah, exactly. So if you have loss of use, how long do I have and do I need to look at extending that? And if you don’t carry loss of use, and again, you say, well, if I was without a vehicle, I’ll just drive something. Really take that into consideration. Now, there’s listeners out there that are probably saying to themselves, “Well, the body shop that I work with, they take care of the rental. They’ve got vehicles.” But again, challenge that because if you can’t get them, they can’t get them. And so again, just keep in mind how long the window to repair is, and we’re talking averages. So if you have luxury vehicles or anything from overseas, you can add to that. And so, depending on the incident itself, it could be quite some time between accident repair and returning you to your car back on the road.

Paul Martin:

Holy man, Colin, it’s getting hard to be a citizen out here and to be a consumer, isn’t it? This just isn’t as smooth as it was in the pre-pandemic era. Now we’ve got inflation, we’ve got supply chain challenges, and we don’t have enough people to do the job. And so stuff sitting outside in the parking lot because as you point out, there simply isn’t enough technicians to do the work. This is a new world, isn’t it?

Colin Rooke:

Yeah. It’s pretty frustrating, especially in a total loss situation. You say, okay, well I don’t really have to wait for it to get fixed. I just get a check. And that usually comes quite quickly. So you think, okay, I take my check, I go find a car, and those people are waiting the longest. So you think, okay, I can understand the repair side of things, but it’s a total loss, I have the money, why am I waiting on average 34 days in Canada? And it’s because it’s hard to get something. And so again, take that into consideration. Maybe you have a old clunker that you were meaning to sell, high mileage that you sometimes drive, maybe keep that, I don’t know. But it’s just worth noting the length of rental time has been skyrocketing.

Paul Martin:

Well, listen, we only have a couple of minutes left, and I do want to touch on one more topic, if you don’t mind. And I don’t think we can do a show without talking cyber, but there’s a new angle on cyber that the cyber criminals are just getting so much more sophisticated. They’re finding more and more ways to… As a consequence, we need to protect ourselves more effectively.

Colin Rooke:

So quickly, before we wrap up, what’s changed now is… So depending on the nature of the crime, and so I’ve talked about social engineering, someone pretends to be someone else, internally sends an email, you send it to the wrong place. Insurers are now getting sticky because sometimes those social engineering emails occur when there has not been a breach. And that that’s usually when information around the individual is easy to find. But technically, again, you could transfer money fraudulently but not have a breach within the system. Now the cyber policy is designed to cover you in the event there is a true breach, but not if there’s just plain human error, or at least not now depending on the carrier you’re with. So now that coverage falls to the crime policy, the old-fashioned crime policy, and it’s something that again, you need to look at. You need to make sure that you have adequate crime coverage limits, which most brokers are probably have been reducing over the years. Anyway, just so something to make sure.

Paul Martin:

Colin, we only have a couple of minutes left before the end of the program. And I want to touch on one more topic, and that’s cyber. We can’t really do this show without talking about it, it seems. But those cyber criminals are getting so much more sophisticated and there’s actually some angles now that business owners need to be just a little bit more insightful about. What kind of coverages you need because of the way the wording of some of these policies works. Can you walk us through that?

Colin Rooke:

Yeah, so just quickly. Depending on the nature of the crime, so we talked about social engineering quite a bit on this show, and that’s when someone pretends to be the general manager, the CEO, the chief financial officer, and requests money to be transferred and it’s fraudulent. It’s intercepted somehow, and it’s off to the wrong bank account and gone forever. And so the cautionary note here is that the insurance policy is changing and they’re pushing a lot of this coverage over to the crime coverage. And so what the argument is is that if the system wasn’t breached, if it just wasn’t email, is it really cyber crime or is it wire transfer fraud? And should the crime policy pay this? So it’s very important that those listening to this show look into, do I have appropriate crime coverage? Because even though you’ll feel like it was sort of a cyber crime type breach, you very well can be transferring money and your cyber insurer says, no, that’s a crime issue and we’re not going to pay it.

 

Paul Martin:

So I guess from the buyer’s perspective, if you’re in business, you need to be asking questions of your broker to make sure that you’re covered cyber, but also this is the word of advice is to ask about the crime element of your policy as well.

Colin Rooke:

Yeah, absolutely. And it really comes down to did the employee willingly transfer the funds or were they stolen. And so that’s the issue there.

Paul Martin:

Well, an interesting nuance on that and just a bit of advice for business owners that you need to be sharper on this one. You’re listening to Collin Rooke, the Commercial Risk Reduction Specialist and expert at Butler Buyers. You’ve been listening to Risky Business. I want to thank you for joining us. This is Paul Martin, we’ll talk to you next time.

Year in Review

Home (Page 5)

Paul Martin and Colin Rooke look at the statistical analysis for 2022 and discuss the trends and issues of the past year.

Listen to the full episode here, or read the full transcript below.

Paul Martin:

Welcome to Risky Business, Commercial Insurance with Butler Byers. This is Paul Martin, the host of the show, and also business commentator on CKOM. You hear me here regularly every day. And joining me today as always, our expert on all matters related to commercial insurance, Colin Rooke, the commercial risk reduction specialist with Butler Byers. And Colin, here we are early into 2023, and it’s this time of year that it’s kind of an interesting time because we’ve had the month or six weeks or whatever it is to, for the industry to kind of get the stats together for last year. And I’m gathering, we’re starting to get a bit of a sense for what 2022 looked like. And oftentimes that’s a pretty good bellwether indicator of what 2023 or the coming year is going to look like. So I’m wondering if we started now to see some of the statistical analysis. What were the big issues last year? What were the trends?

 

 

Colin Rooke:

Yeah, so every year around this time, we used usually talk about this global report that does come out and they survey, it’s 2,500 executives from, again, it’s a global poll and it’s all different size companies. And then they also survey risk management experts as well. And they come to consensus on the global risks for 2023 based on the results or what occurred in 2022. And so yeah, they’ll reports in some big changes, but we’ve talked about it. Everyone’s heard this from me, but cyber incidents, so cyber liability, cyber crime is a very, very strong number one. And then with that is business interruption being a strong number two, in fact, they’re tied.

However, when you look at a cyber incident, they are almost always paired with some sort of business interruption depending on the severity of the attack. And so I would say a lot of that sort of percentage that’s attributed to business interruption would be more, again, around the concerns of a cyber incident. But also we’re still seeing that sort of trailer effect from the pandemic. In the event that I need business interruption, is it going to pay me? Do I have enough? Can I really rely on the insurer, the insurance market to be there? So I’m going to say that again, a lot of that concern as well is, and I guess you add in too sort of global unrest with the war in Ukraine. And again, so business interruption has become top of mind, but the two combined are almost 70% of the whole list. So it’s a big deal.

 

 

Paul Martin:

One of the things that fascinates me when we have this conversation is you’d think we’ve been talking cyber attacks and cybersecurity and all the risks to business that are associated with that for years now, it’s been four or five, six, seven years we’re talking about it. And you’d think, boy, after that period of time we’d figure out how to inoculate or immunize ourselves against it. But in fact, it’s the other way. The perpetrators are actually just getting better and better at this.

Colin Rooke:

Yeah, they’re certainly outsmarting us. Yeah. Not only is it not going away, it’s not necessarily improving. Every year from a insured perspective, the minimum criteria just gets larger and larger and frankly costlier and costlier. And so it’s a big deal. It’s not going away. And the more you learn, the more you realize, the more you need to learn. For example, I’ve talked a lot about ransomware and weirdly ransomware has kind of gone by the wayside. The favorite last year was wire transfer fraud, social engineering leads to wire transfer fraud, very little ransomware all things considered. And then as just as soon as you sort of identify, okay, we really got to watch for wire transfer fraud, it’s changed again. And now the number one, I’ll say new and emerging threat is opportunistic attacks. And it preys on the public’s good nature. So as an example, a humanitarian aid website is created so you can donate money to Ukraine as to help in the war efforts and the whole site is fraudulent.

Or another great example is the idea of looming recession and high inflation. And so one of the most Googled terms in North America was inflation help or variation of what is inflation, what can I do about inflation? And so now you have these fake, completely artificial sites that look like they’re designed to help you. In fact, they will educate you. They’re very educational, they’re very well done. And of course, and there might be a document, download, a worksheet, something and you won’t think twice about it. And again, that’s that opportunistic attack. They’re preying on a weakness, they’re very good at getting the information out. And then you finally say, well, yes, I’d like to take advantages of some free resources. And now either you as an individual or the organization has a problem and all you are trying to do is learn something.

Paul Martin:

It is certainly getting more sophisticated, isn’t it? I mean, they’re just getting better and better at this and we develop our defenses, but they always seem to be one step behind what the perpetrators are doing. And so the point here, and I think you’ve made this comment many times is its human error that leads to this stuff, is that employees will click on something or you will inadvertently or unknowingly basically introduce yourself to having the attack because they’ve sent you something that looks innocuous, but it’s far from it.

Colin Rooke:

Yeah, it’s so good now that we’ve talked about sort of the number one red flag is your server, your system asking for permission to download. Well, right in the body of the fraudulent website, they’ll address the fact that your system may have trouble downloading this free tool and then show a picture of the popup. You’re going to want to allow it in order to get it. And then people just, well, why would there be a government or a website to help me cope with inflation, budget better? You’ve gone all the way down the rabbit hole, you’re now trusting and now that they’ve even identified that you’re going to get this pop up, and of course you’re going to say yes. And now you’ve got an issue.

Paul Martin:

Colin, when you talk to industry players, is there any level of surprise on their part, if I could put it that way, about what we learned as the prevalent factors last year and what they expect coming into this year? I mean, are they surprised with these developments or is it just sort of, yeah, we could see this coming and we sort of anticipated it?

Colin Rooke:

I think with cyber incidents, there’s not, I mean, they’re surprised. There’s some shock. It just seems, okay, well we prepped ourself for this and then now you’re saying it’s something different. We implemented all of these best practice tools and then now you’re saying they’ve essentially, they’re able to effortlessly get through that. So I think it’s more exasperation. When does this end? When do we quit talking about cyber and when do I get a clean report card where I don’t have to take on a whole bunch of onerous task to be compliant? I think that’s the real issue.

Paul Martin:

Yeah. More frustration than anything that you think. We always want a quick fix, don’t we? So you get frustrated when that isn’t readily available. Well listen, we’re going to take a little break, Colin, because we’ve kind of reached the midpoint of the program. But when I come back, I want to talk to you about some other trends that are going on and maybe some of the macro stuff. And you alluded to inflation, and I’m just wondering, we haven’t talked about that, but I’m guessing there are some implications there. So we’ll take a little break, we’ll come back, we’ll talk about inflation after this. You’re listening to Risky Business, Commercial Insurance with Butler Byers. Back after this.

Welcome back to Risky Business, Commercial Insurance with Butler Byers. Paul Martin here, and joining me, Colin Rooke, the commercial risk reduction specialist with Butler Byers. Colin, before the break I indicated I wanted to ask you a question about inflation. I mean, we talked about some of the other macro issues at play, things like the Eastern European war and what implications that has, but I’m sure that rising interest rates as we attempt to fight inflation are also because they’re financial matters, and insurance is largely a financial product base, is there some correlation there? Does a rising interest or inflation rate mean changes in the insurance world?

Colin Rooke:

Yeah, it does. And then back to the list I referenced, the sort of, the biggest jump on the list as far as new and emerging risks was definitely inflation. And then second to that, financial market volatility. And so it’s certainly top of mind and it is something that we do have to consider when looking at the overall insurance program. So how does inflation directly impact our clients? And really, again, with the cost of everything going up as a rule, so do the cost of claims, so do the cost of any rebuild, labor cost, and do the policy itself, you really have to take a step or take a look and say, do I have the appropriate limit? The desk I bought five years ago for $3,000, what would it cost me today? And it’s very important to make those changes, and unfortunately, it’s going to turn into rising premiums as a result, but it’s unavoidable.

So again, building value is very important, and I know we did a show on that, but I can’t stress enough that you need a handle on what would it cost me today to rebuild this thing? Labor’s more expensive. All materials are expensive, but then also you have to take into consideration the delays, getting materials. The next sort of, kind of where that segues into is big concerns of under insurance. So you got to worry about inflation, and you really have to worry about under insurance, and when it comes claim time, we’ve talked about co-insurance, but at a high level, if you don’t have the appropriate amount of insurance, you will not get the claim amount you think you’ll get. There’ll be a penalty applied.

And so you have to say, okay, it’s a double-edged sword, but you say, okay, if I report that my building’s worth a lot more, it’s going to directly correlate to more premium. And absolutely it’s going to. However, failing to address that in a claim could result in you receiving a fraction of the payout you thought you were getting. If your limits aren’t adequate, they’re going to say, well, if you needed 5 million worth of coverage and you only had three, we’ve got an issue here. We’ve got a co-insurance penalty, and so we’re only going to give you a proportion of the claim, not the full amount. And so it needs to be on the insurer’s mind, am I underinsured and am I keeping up with inflation?

Paul Martin:

The question that pops through my mind when you say that is, we renew insurance policies for a year. Is a year too long? I mean, there’s a lot of inflation in a year. Right. I mean, how often should I be checking on this stuff if I run a business or I own a business, and how do I come to grips for that or how do I cope with it? What mechanisms do you recommend that I think about?

Colin Rooke:

Yeah, that’s a really good question. And so at renewal time, you essentially have to predict what you think you’re, again, we’re talking building or building equipment stock. You have to predict what you think it will be worth during that policy period. And so you’d say, okay, I’m going to go with 7% inflation over the year, which five to seven is probably a pretty good idea, assuming that you’re building values today are correct. However, you’re not an expert at predicting the reconstruction costs and inflation. And so it’s very policy dependent. So I don’t want anyone to think, well, this is how it works, but built in the most policies is a buffer. So you might have a 10%, you might even have up to a 20% buffer where you can be over or underinsured and still be okay. And they do that for that reason.

They’ll say, well, you need to be at 90% of the value of the building, or in some, you need to be at 80%, but you have to watch for the policies that say, nope, you have to be at 100% of the value, $1 short, and we start subtracting from what we pay. And so it’s very important you have someone review that and explain and that you understand, which is also part of our risk reduction workshops. We talk about coinsurance strategies and making our clients aware of what they are self insuring and what they aren’t. So again, if there’s a gap there and you’re okay with it, that’s fine, but it’s very important that you understand where you stand and how close you need to be to that number.

Paul Martin:

The question that came to mind as you were talking about this is one of the services you provide free of charge to anybody, whether you’re a customer or not a client of Butler Byers is these step-by-step guides that help people kind of ask and answer the relevant questions when you’re thinking about insurance. Presumably you have to update these on an ongoing basis too, because the marketplace and the landscape is changing.

Colin Rooke:

Changing.

Paul Martin:

I’m assuming that every once in a while, probably even if you’ve gone through the step-by-step plan, say three years ago, probably time to come back and revisit it.

Colin Rooke:

Yeah, another really good point. So say five years ago, we weren’t spending as much time on inflation, building values, and co-insurance. Now we start with it. And when we go through our risk reduction workshops, it’s important to us to point out first and foremost, frankly, what you aren’t covered for. It’s really easy to say, you have coverage for this, you have coverage for that. But where we find you’ll get into trouble is when you’re unaware of what is not covered. And so if we say, oh, let’s take the reverse. We’re going to talk about what you don’t have coverage for, and let’s assume everything else you do, and that’s what we get into the co-insurance proper building values. But you’re right, Paul, we’re constantly adjusting based on what’s impacting business today. Cyber hasn’t moved, cyber comes up right away for almost everyone. But yeah, we certainly spend a lot more time talking about building values now than we would’ve in the past.

Paul Martin:

Well, I guess I take from this that we probably in this program should encourage business leaders, business owners, business managers to reach out to you and just ask, say, I’d like to take a more current walkthrough, the step-by-step assessment. You’d welcome that, right? If anybody called you up, you’d be more than happy to provide them with a free consultation effectively.

Colin Rooke:

Yeah, absolutely. It’s a deep dive into the program, and it’s a discussion about where were you, where are you now and where you’re going, and how can we help from a new and emerging risk standpoint and from a proactive risk management standpoint.

Paul Martin:

Well, Colin, it’s amazing, but the time has gone by. We’ve run out of time. So thanks again and really appreciate your looking back and assessing what did we learn in 2022 and how does that inform decisions we need to make so we’re really well armed going into 2023? You’ve been listening to Colin Rooke, the commercial risk reduction specialist with Butler Byers. I’m Paul Martin. Thanks for joining us. This is Risky Business. Talk to you next time.

Reflection, Renewal & Checklists

Home (Page 5)

Paul Martin & Colin Rooke wrap up 2022 with a look at what we’ve learned in past year and what to expect in 2023.

Listen to the full episode here, or read the full transcript below.

Paul Martin:

Welcome to Risky Business, Commercial Insurance with Butler Byers. This is Paul Martin, your host and the business commentator on CKOM. And joining me, as always, Colin Rooke, the commercial risk reduction specialist with Butler Byers. Colin, as we put this program together, we’ve reached that time of the year when we conclude a calendar year, the beginning of another. And that is a time for pause, reflection, for renewal, for starting, for ending, all of those things. So I thought, well, kind of timely for us to take a look at what we’ve learned in the past year and what we’re expecting for the coming year.

And one of the things we talk about very frequently on this program, aside from the events of the day, is your checklists, the step-by-step guides that Butler Byers has prepared that any business can ask for. Whether they’re a client or not, you’ll let them have it. And I’m just wondering, when you come to the end of December, the beginning of January, what checklists go through your mind? What do you recommend to people and what do you say, “Hey, this is a really good time to take a look at ABC.” So what’s ABC in your mind right now?

Colin Rooke:

It’s a great time of year for this type of conversation, and just looking back at the previous year, what you thought you wanted to accomplish, what you did accomplish, maybe what you want to work on for the next year. I think December, this time of year, it’s a good time to start thinking that way if you haven’t already. And depending on your organization, you may find yourself with some downtime to do that. And we do have a lot of different types of programs we can implement, checklists we can go through, whole manuals that we can work with our clients, work with them through it. And so it comes up this time of year, and depending on who we’re working with and what the need is, we’ll recommend different things. I have a couple today that I just wanted to highlight.

These would be, I guess, more mass appeal in nature, just to give an idea of these are the types of conversations we’re having. This is something that we can help you with. It’s something that should be top of mind. And it’s good timing to look at that. The first one is a checklist on how to develop an employee development program. The second that I want to talk about today is a checklist. And it’s similar to the employee development program, but it’s a skills gap analysis. So it’s a checklist that walks you through, what’s missing in my organization? What do I need to fill? So ways to identify that and then how to put that plan in place. No different than the employee development program I’ve referenced as well.

Paul Martin:

I’m just wondering, what is it that would prompt you as someone in the insurance business to even talk about that stuff? I mean, I guess one of the questions comes to this, why do insurers care about this, and why would you be bringing it forward? I get that employee development and skills analysis and these things are important for any business, but why is Colin focusing on that or bringing it up?

Colin Rooke:

Yeah, really good question. I’m an insurance broker and risk manager, I’m not in operations, so why would I do this? Why should anyone listen to this? And then, what does this have to do with insurance? So if you think about our role as risk advisors, I mean, first and foremost, we want to improve overall performance. So that’s why we do the risk assessment. We want to figure out where you’ve been, where you are now, and where you’re going, and then ways we can help you along the way by way of proactive risk management and also discussing new and emerging risk.

So why would we do this? Well, one, if we’re talking about employee engagement, we’re talking about retention, we’re talking about productivity, we can then say something that you may want to consider is an employee development program. And not only can we talk about the risk, we can quantify that risk, talk about the potential cost of doing nothing. We can help you structure that program and implement it. So if we’ve identified together this is a true risk to the business we’re working with, and then we’re doing our part where we’re identifying that risk, we’re quantifying that risk and we’re prioritizing that risk, and as a result, the organization performance improves. Then what do we do with that? Well, the largest part of our role as broker really is storyteller.

It’s our job to sell our clients to the insurance market, because the underwriter has no way of differentiating your company from any other business in that same category. And so it’s our job to present our clients in the best light possible as top of stack or the best risk we can present, which ultimately opens more doors to more markets, coverages are more widely available, and we are able to take advantage of either discounts available through the current insurance markets or just take advantage of other insurers that want to competitively obtain your business because they have an actual reason to want it. They say to themselves, okay, I want to work with a business that’s working on itself. Colin Rooke the broker has explained they’ve identified a gap in employee development and they’re working on turnover, they’re working on engagement, they’re working on their culture.

Overall, this sounds like a great place to work, and great places to work as an example, are going to have less employment practices, liability lawsuits or claims. We’re going to have less issues with D&O coverage, excuse me, less errors that are going to take place. And right down to, and I use this all the time, engaged employees that care about the place they work are the ones that turn off the coffee pot late at night when they realize someone has left it on. The organizations that honestly couldn’t care if the business is still there in the morning don’t. And so it’s a really, really important part of our explanation of as to why the insurance market wants to work with you.

 

Paul Martin:

It’s been a while since we’ve had that conversation because we’ve had so many major events going on, from disasters to cyber activity and all those things. But maybe a year ago we were talking about how insurance companies, like anybody else, just want to work with best in class. I want the best customers I can get. So if you’re looking to buy insurance, how do I get to be the best customer of the insurance company? If I can achieve that, I’m probably going to get better coverage, better rates, better terms. And I guess that sort of answers the question of why would an insurance broker care about this topic.

Colin Rooke:

Yeah, absolutely. Whatever industry you’re in, you’ll have the ideal customer. You’re a home builder and you say, “Well, if someone walks in and buys a spec home with absolutely no changes, that’s great for me.” Or, “If I’m going to do custom work, I want the customer that lays it all out once. We build it using their vision. They show up, they’re happy, they pay the bill.” And so when you think about that, your ideal customer, you have to think about our role. Our role is to present you or the business community as ideal of a customer as we can possibly get them.

And so the underwriting staff, they’re worried about risk, they’re worried about their exposure, they’re worried about claims. And our job is to have that conversation, to walk them through the work we’re doing, to explain or have the underwriter understand the way the business thinks. And so when we’ve done our job correctly, again, you stand out. You’re someone that they want to work with, you’re someone that they want to offer coverage to. And that’s how you allow yourself or allow us to place our clients with the best markets.

Paul Martin:

Welcome back to Risky Business, Commercial Insurance with Butler Byers. Paul Martin here, and joining me as always, Colin Rooke, the commercial risk reduction specialist with Butler Byers. And just before the break, Colin, we were talking about what kind of checklists, maybe, what would be contained in these checklists you were talking about? The one more specifically about looking at employee development. I mean, as an employer, how much do I have to budget for these kinds of things? I mean, how big an undertaking is this kind of an initiative?

Colin Rooke:

Yeah, so the nice thing about these checklists that we have, it walks you through all that. I mentioned the skills gap analysis. So if you’re working on an employee development program, you’re going to want to take a step back and say, okay, ultimately what would I like to solve? Or what areas do I need to tighten up on? So part of this checklist is there’s an exercise going through that, what am I trying to achieve, and what areas in the company? So you could say, okay, technology. But is it technology overall? Is it technology with leadership, support staff, just management?

So it allows you to walk through that. And then there’s measurement methods built in that will allow you to say, okay, well, where are we now? And where do I need to get? And then what would the impact be, should we close that gap? So before you even work on the whole development program, it’s a great tool just to say, okay, what are the future needs of the company? What skill gaps exist? What do I need to put in the effort into today to get to where we want? And then thinking of the future, what do we value as a company? What do we want to promote? What skills do our employees need today, but then we want them to harvest for the future?

And so like I said, the skills gap checklist is great for that because it allows you to build out that program and then jump back into an overall development plan that allows you to map out, okay, how are we going to do this? What it’ll cost us? How long will it take? How are we going to divide it up, split it up amongst different departments? And it really is a step-by-step way of getting you to the finish line, asking very good questions that are designed around deep thought around the subject.

Paul Martin:

In your experience, have you seen it where this is done for an individual who you consider to be high potential? Is it for a department or is it for all the employees of an organization? I mean, what are your thoughts on that? What have you seen? What’s the experience that you’ve seen and how it works?

Colin Rooke:

The nice thing about this is I would say all of the above. You could say, you know what? I just have one star or one person where I want to develop and implement a program just for that person. Maybe this person could be senior management. You’re just not sure how to organize your thoughts or how to develop that person. So this would walk you through that. You could do this for a department. The questions are arranged in a way where you could say, well, this would be applicable to a group of people. Or you could just say, you know what? At Butler Byers Insurance, we really don’t have an overall employee development policy.

And so we’re going to use this method to help develop just an overall policy that would be applicable to most people or all people and build that out. And then from there, you could separate people in different groups. But it walks you through everything that you would have to think about: timelines, deadlines, how you would offer opportunities to people within the organization, how to measure competency, how often, right down to how to build out a policy, like an actual policy itself, what would need to be in there, to how to measure it later on.

How to ask for feedback, how to improve it. And so it’s an all-encompassing tool that just gets you to an organization that’s really thinking about, okay, if I want to keep people happy, engaged and working for me, I got to invest in them, but I don’t really know how to do it. And it sounds like a mouthful, but we’ve done all the work for you. Really, at this point you just have to think through it and answer yes or no, give it some thought and really roll with it. And so we’ve made it easy to put in the work for today to improve the business for tomorrow.

Paul Martin:

I’m guessing that at this time, where some of the headlines around hiring relate to unfilled jobs, job vacancies, competition for staff, there simply aren’t enough workers to go around, and what you’re talking about, this tool that’s available, yes, we’re talking insurance, but it really is an HR tool. And it may help an employer figure out how to become better at hiring, better at retention, which I think is probably the critical element these days. And I’m guessing that if I can pull those off, it makes it easier for you to sell my story to an insurance company.

Colin Rooke:

Yeah, absolutely. It’s designed to help internal performance. And as you know, Paul, I’m armed with stats. And so we talk about engagement, we talk about those that will leave an organization. Almost 90% of the time, management will assume it’s about money, and it’s actually less than 30% of the time where that’s actually the case. It’s usually about feeling that the career is stalled, I’m not getting noticed, I’m not being developed. And so this is an HR tool, this is an operations tool. But then we take all of that information and we use it. We use it to say, “This is a great company and we expect the insurance market to do more to obtain their business.”

They’re working on it. They’re not going to have the claims that you think as evidenced by the effort they put in versus the unknown, versus no effort, versus very little effort.” Or maybe you’re putting in a ton of effort, but your broker isn’t asking the right questions to tell your story effectively. They’re just sticking to the insurance application. We dive deeper, and we actually learn. So then we can tell the story as good as you might if you were marketing your own company.

Paul Martin:

I’m guessing, and we’ve only got about a minute left before we’re finished here, but I’m guessing that while we talk about programs designed to develop the talent sets of your employees, probably the same rules apply for the leadership of the organization too. Insurance companies like to see where leaders are actually trying to get better at what they do as well.

Colin Rooke:

Yeah, absolutely. Again, even from a coverage perspective, you’re talking about if there’s directors and officers policy, so you’ve got a board or any board involvement at all, you want to learn they’re working on or they’re aware of what’s being worked on. Errors and omissions, again, a lot of the claims are avoidable and a lot of the claims have to do with culture and the way work flows and really what’s being said and how business is being conducted. So if we have a client that’s aware of that, that’s working on it, that says, okay, I understand the widespread impact of having an errors and omissions claim, then I’m going to avoid it and I’m going to work on this company because I want it to grow, I want it to improve, I want it to last, those are the better risks and it’s an easy sell for us.

Paul Martin:

Colin, as always, the time goes by so quickly, I’m always amazed that it’s all of a sudden the end of the show. Thank you again for these insights. And very timely, given that we’re in that transition of calendar years again and time to step back sometimes and reflect. So thank you for that. You’ve been listening to Colin Rooke, the commercial risk reduction specialist with Butler Byers. I’m Paul Martin, thanks for listening. This is Risky Business, Commercial Insurance with Butler Byers.

Colin, we’ve got to take a little break, so thanks for that. But keep in mind, when we come back, I want to talk about just a little bit more detail about this tool that you’re talking about and how it can be applied, not just for insurance purposes, but for general making your business better.

MFAs, Data Encryption & Endpoint Detection Response

Home (Page 5)

Mitch Bernier joins Paul Martin and Colin Rooke again to continue the conversation on cybersecurity.

Listen to the full episode here, or read the full transcript below.

Paul Martin:

Welcome to Risky Business, commercial insurance with Butler Byers. This is Paul Martin, the business commentator on CKLM, and the host of this program. Joining us, as always, Colin Rooke, the commercial risk reduction specialist with Butler Byers.

We also have joining us, Mitch Bernier, who is a partner in Professional Computer Services. Mitch, we had you on here on the last episode and you and Colin were exchanging some absolutely critical information that business owners and those responsible for business operations are going to have to become conversant with. Actually, we ran out of time, so we decided we better just keep this topic going, because there’s too much here to brush over it too quickly. This is rapidly becoming, Colin, maybe you can jump in here from the insurance industry’s perspective. This topic is really being elevated rapidly in the minds of importance. The rank of importance in the minds of the insurance companies, isn’t it?

Colin Rooke:

Yeah, it is. We brought up three topics in the last show, multi-factor authentication or MFA, we brought up endpoint detection and response, and we brought up data encryption, so everything’s at rest and in transit, including email. We talked quite a bit about multi-factor authentication. We ran out of time, but it’s critical that we, I’m going to even say warn business owners out there, that if you don’t have or you don’t know what endpoint detection response is, and if you’re unaware of data encryption, especially depending on what industry you’re in, one, you need to know about it, you need to know why you would do it, the risks of not doing it. And then I guess a warning from myself that it’s going to be a requirement soon. For a lot of industries, it is each year more and more.

So rather than wait until your broker or your cyber insurer requires you to do this, understand what it is today, and formulate a plan and get your business up to speed, or up to best practices now, because one thing I can say about the cyber insurers and specifically cyber insurance, they’re not going to give you nine month lead time when they require something at renewal. You’re going to learn one month, maybe two out, and often it’s a race to get it done and most can’t complete that in time. And now you’ve got a big issue.

 

Paul Martin:

All right. That’s why we brought Mitch back in because he is the keeper of all the knowledge on this topic. Mitch, you deal with business owners, with general managers, people responsible for IT in businesses around the province on a daily basis. How are they reacting to this? What are you hearing back? Is it just one where, “Man, I don’t know if I can keep up to this, my eyes are glazing over?” Just how are they coping with it? What are you seeing? What are you hearing?

Mitch Bernier:

Hey Paul, Colin. Thanks for bringing me back here. Yeah, after our last episode aired, I have a few people that were emailing or texting out back to me saying, some of it was simple like, “Hey Mitch, we heard you on the radio. Thanks for bringing that up,” and, “Am I protected? Because I don’t really know, but can you tell me?” For the most part, most of them are, they’re in decent shape, but there’s always something that you can make better.

On the odd, there is the odd one that it’s like, “Nope, we talked about this a few months ago with you and you didn’t do anything,” but it might have been summer holidays. And now they’re looking at, “Okay, now we hear this, we think it’s serious, we should do that. Help us out.” It’s been a good positive change that way. Now after, as Colin talked about there, the different insurance providers that are asking different questions, especially in cyber, those questionnaires are getting way more precise with terminology and exactly what they want. So if we want to talk about the data encryption piece, is that where we’re going to start?

Colin Rooke:

Yeah, either, or. If you want to talk about endpoint detection or encryption, the mic is yours.

Mitch Bernier:

Okay. Okay, well let’s start a little bit about data encryption. I think it’s important to understand what is it? What does it really mean when people talk about data encryption? It’s a form, a way to transform data from readable to non-readable. Easy as that. And then if you want to read it again, you need a decryption key. If you have the key, it’s presented as readable.

Now that can apply to your emails, to your Word documents, your home recipes, put it on anything you want, but break it down as simple as that. Most people, most business owners or most employees in the company wouldn’t be able to tell you if I asked them, “Is your database encrypted?” They would have no idea about that. That’s more looking at the IT department, the IT guy, something like that to reach on.

In the cyber insurance forms that we’ve filled out over the last couple years, what started off was it might be a question of, do you encrypt your data? But now those questions are way more precise is, if you are running a database, is your database encrypted? They are really targeting any personal information. So if I look at Colin and Butler Byers, I can only assume an insurance company gathers names, dates, addresses, stuff like that, that’s personal information, and now he’s obligated to protect it. The way to do this is through encryption, through using technical methods on keeping that data safe and doing all he can to do that. Colin, you had used a couple other words about data in transit or data at rest?

Colin Rooke:

Yeah, so I’m not an expert in the how, but what I find where businesses get hung up on, they seem to be okay or call it, it seems to be easier to do the stored data, but when we say email as well, so in transit, that seems to be the big project or the, “Ugh, this is going to take some time.” Again, I understand what encryption is, I understand why these cyber insurance market wants you to have it, but what is the challenge there specific to email? Why does it seem like a project to implement?

Mitch Bernier:

Right. Okay, well, when people think email, you’re communication. It’s a communication tool that you and I are sending data back and forth, and not if it’s like, “Hey honey, bring home milk tonight,” not really super sensitive, but there is probably information that you might send to another business, to an insurance provider, that is sensitive and you want to ensure that it’s not readable by anyone else. In Outlook, there’s a button in my Outlook that says encrypt and I have a few encryption options there, but it’s as simple as that. That is, if email was going from me to you, Colin, that’s data in transit and that’s where I want to encrypt that message.

Another example of that would be if I’m doing my online banking, and now the bank and I are having an interaction here and I am looking at my bank account, I necessarily don’t want people seeing that. That’s where you see when I go to the bank website, there’s that little lock icon right by the www dot address and it’s telling me that this is encrypted.

Paul Martin:

I’m going to jump in just for a second, just because I’m trying to manage our time here gentlemen, and we do have to take a little bit of a break. But I want to just touch on one further aspect of this. We generally look at this in this context in this program around the issues related to insurance, but there are also some legal issues here too in terms of data breaches and this kind of stuff. There’s protocols and laws that we have to be looking at as well that go, I guess that’s why you buy insurance against it, but there also is the legal implications and legal liability that goes with it. So maybe we can pick that up after we take a short break. You’re listening to Risky Business, commercial insurance with Butler Byers. I’m Paul Martin, we’ll be back after this.

Welcome back to Risky Business, commercial insurance with Butler Byers. Paul Martin here, and joining us today, Colin Rooke, the commercial risk reduction specialist with Butler Byers, and Mitch Bernier, partner in Professional Computer Services in Saskatoon, and our expert on all things related to cybersecurity.

Just before the break I was talking about, yes, there’s insurance stuff here, but there’s also legal stuff too. So it’s a double-layered thing. Colin, do you have a perspective on that? Do you end up talking to lawyers on these kinds of things?

Colin Rooke:

Yeah, we do. You referenced the Privacy Act quite often. Really, if we have a client that has a claim, it’s not just as simple as, “We’ll get working with your adjuster and we’ll look for any first party damages that may have occurred and work on reimbursement.” There’s often third party damages that you need to consider.

There’s also regulatory issues and requirement from our clients by way of 24 hour help desk, credit monitoring, that sort of thing, to ultimately protect the public. So it really is a good topic, and I always warn our clients that the first party damages are the least of your concerns. It’s always the, what are the risks to everyone else? And if you talk about reputation risk, reputation, and then working on reputation repair, it’s going to come, again, from third party damages and any regulatory penalties, rulings, that kind of thing. So, yeah, it really is an important topic to cover that it’s not just about insurance, it’s about everything else.

Paul Martin:

Well, I raised that only to reinforce the message that’s underlying this program is, business people, this is important. This has many implications for your enterprise. Mitch, I’m wondering if you get people to say, “Well, I guess it’d be a nice to have, but is it a must to have now?”

Mitch Bernier:

Yeah, very much. In the last few years most companies that we deal with, that business owner would come to us and ask, at least ask about it. So that’s probably an insurance provider that’s approaching them saying, “Hey, protect your business. This is what to look at. This is important.” And then they might not understand the questions on the form, but they would come to somebody like me to say, “Hey Mitch, how are we? Are we in good shape? Do I comply? Is this going to cost a bunch of money? Is this going to take a bunch of time?” Like some of those considerations for the owner.

Colin Rooke:

So, speaking of compliance, let’s talk about endpoint detection and response. That seems to be the new kid on the block, at least for us. We’re hearing about it all the time. Data encryption has been talked about for a while and it just seems to be showing up everywhere, back to the forms you’re seeing, it usually is the supplementary questions that are asked. So, again, what is it? Why do I need it? How do I get it? Why is the insurance market concerned with it?

Mitch Bernier:

Right. Okay. So endpoint detection and response, EDR, is, think of it like, back in the day everyone needed antivirus and that was the thing, and that was probably a question on an insurance form back in the day, do you run antivirus? Well, now there’s just so much more to it than that. Really it comes down to how technology has evolved, where they can be looking at your endpoint, and endpoint meaning desktop computer, laptop computer, your iPad, your smartphone, wherever you put this agent on, in real time they’re watching… not watching what you’re doing, that’s the wrong term. They are analyzing what your computer is doing.

If it’s something like the old school virus, they might throw an alert on your screen saying, “Hey, there’s something going on. Maybe don’t click on this or follow it.” But there also might be some analytics in the background looking at that transaction that your computer’s trying to do saying, “Hey, this looks pretty fishy. We’re going to stop this now and not let you proceed, because we think something bad is going to happen if you do that next step.” The evolution now in the EDR market is a managed threat response, where if you’re doing something bad on your laptop and the user might not know something bad is happening, but there’s a team, an alert generated outside to a third party, and that team will look in real time at what’s going on and take action.

In some of our clients nowadays, you can subscribe to some different models, because Butler Byers might be getting attacked at four in the morning and I’m in bed, or your IT person’s in bed, and not necessarily looking at something happening, but that team that’s running 24/7, they will take action or you can grant them permission to deny any, turn off the internet, do whatever it takes to prevent something negative from happening to a business.

Now of course it comes down to budget because these security companies do charge for this, but there is lots of value there depending on what line of business you are in.

 

Paul Martin:

Mitch, is there any differentiation between big business and small business in this? Or as long as you’re in business you could be facing a threat?

Mitch Bernier:

I would say anyone’s at risk. When you hear of some of the ransomware attacks or some of these attacks nowadays that happen, it’s some small business, some large business, and the bad guys, those threat actors, they are good at what they do. When they come up with a scheme on how to attack a site or get into it, they’re efficient at it. They’re not just doing necessarily only one. They might do a thousand of them today. They only need to get into one.

Colin Rooke:

I can concur too. There really doesn’t seem to be a rhyme or reason or any pattern you can follow as to who has the breach. One, it’s random, and seemingly rampant.

Mitch Bernier:

Yeah. They find a weakness and they exploit it. If the weakness is technology, we need to correct that. Or the weakness might be your employee, your human sitting there, so we need to educate them and bring them up to speed.

Paul Martin:

Yeah, I guess I’m asking, there’s no protection then for being small and thinking, well, I’m too small a fish for them to bother? There’s nothing here to bother pursuing?

Mitch Bernier:

No.

Paul Martin:

No, that doesn’t matter at all?

Mitch Bernier:

No. Usually that comes down to money, budget, where some of the large organizations can afford to do those third party security firms to monitor things 24/7, and the small ma and pa shop, they can’t afford that fancy stuff. So you invest in a good EDR solution or something like that and it’s doing its best job for you.

Paul Martin:

I guess the argument could be the reverse, is that the small business is likely more of a target because they’re less equipped to prevent it.

Colin Rooke:

Yeah.

Mitch Bernier:

Yeah. That’s right.

Paul Martin:

Just one other question on this, Mitch. Just in listening to the conversation here as you lay it out, back then we only needed to have antivirus. Now it’s become more sophisticated. I take from that that this is an ever evolving situation, that the bad guys are always learning new stuff and we always have to put new stuff in to protect ourselves. Is that a fair or accurate assessment?

Mitch Bernier:

Yeah. Oh, that’s exactly right. It’s you, we need to be perfect every time. They only need to get something right once and they’re doing their thing. But on the defensive side, you need to be right every time.

Paul Martin:

Yeah, and this isn’t just one fix solves it for the rest of eternity. This is something business owners need to be on top of. Just another thing that you have to deal with on an ongoing basis, and it needs to be put into your systems so that it’s constantly being brought up to the top of your to-do list.

Mitch Bernier:

Yep, exactly.

Paul Martin:

All right, Colin, we’ve got maybe a half a minute left. Do you want to offer what Butler Byers brings to this table too? If I’m a business owner, I call you up, how are you going to help me with this?

Colin Rooke:

Yeah, I just think it’s important to have experts like Mitch Bernier from Professional Computer Services on the show to point out that this is part of our system, this is what we do. So when we’re going through the risk reduction workshops and talking about level of protection, if we’re talking about cyber, for example, and formulating that plan, well then we say, “Okay, we’re not going to implement endpoint detection in response, but here’s someone that can.” But they also, they understand the cyber market, they understand what’s going on and they’re thinking proactive. So it’s part of what we do in the identification, and then we will also play a part in connecting with the experts.

Paul Martin:

Colin, as always, very insightful, thank you very much. Mitch, I want to thank you for joining us a second time. Your insights are invaluable. Thank you for that.

You’ve been listening to Risky Business, commercial insurance with Butler Byers. I’m Paul Martin. Thanks for joining us. Talk to you next time.

Rapidly evolving cyber crime & cyber security

Home (Page 5)

Mitch Bernier joins Paul Martin and Colin Rooke to discuss the rapidly changing nature of cyber crime and cyber security.

Listen to the full episode here, or read the full transcript below.

Paul Martin:

Welcome to Risky Business Commercial Insurance with Butler Buyers. This is Paul Martin, the business commentator on CKOM. Joining me today, as always, our resident expert, Colin Rooke, the commercial risk reduction specialist at Butler Buyers. And Colin, I like to call you an expert on insurance, but today we brought in a real expert because we’re going to talk about some technical stuff. And I want to welcome Mitch Bernier, partner with Professional Computer Services.

And we’re back to one of those topics that we have touched on fairly frequently over the last few years, and that is cyber, cybersecurity, cyber attacks, all of that sort of genre of activity that business people are faced with. And I’m wondering, we haven’t talked about it for about probably 3, 4, 5 months and I’m guessing everything else in the world, this one is evolving and that even three months ago, the story we would’ve been talking about is different than the story we’re going to be talking about today. Is that a fair assessment?

Colin Rooke:

Yeah, it is. We certainly keep coming back to the topic of cyber crime, and it’s just because it evolves so rapidly, something that we would have discussed as a new issue or sort of a must-have from a cybersecurity perspective, certainly three to six months ago, you look at today, and those best practices are no longer sort of the best but considered to be sort normal and required. And so I think it’s important just to keep touching on the topic and to make sure the audience is staying relevant.

I think I do a pretty good job of explaining the nature of the risk, the frequency and severity of claims in the industry, where it’s going, why pricing is so high, what you can do about it, and talking about overall, the nature. But I wanted to bring Mitch in to talk about… Okay, we’ve talked about topics like data encryption, we’ve talked about multi-factor authentication, we’ve talked about endpoint detection and response. I just throw those words out there saying, these are some of the things that we’re seeing that we used to say it would be nice to have. And then I think you’re going to need it soon, and now you must have it.

And so I thought rather than talk more about the claims we’re seeing or the list that we get from the underwriters to bring someone on that can actually say, okay, well what is it? Why would a cyber insurer be concerned if you didn’t have it? What does it do and how can you get this? And so I thought, why not bring Mitch on, again, partner with professional computer services, he can explain these topics and then our audience now knows, well, here’s what we can do. And bringing experts like this would be all part of the risk reduction work we do. So we go through the assessment, we identify gaps, and then we would connect our clients with a third party that can help if we aren’t able to do it in-house.

Paul Martin:

All right. Well, Mitch, welcome to the program and look forward to your insights on this. And Colin used a lot of buzz words, end-to-end data encryption. I mean, I wake up in the morning and think, “Oh, if only I could deal with that today.” But I’m sure business people feel a little overwhelmed with this saying, the volume of things that they have to deal with now from a regulatory to this sort of protective side of thing, when business people come to you, Mitch, I mean, are they a little bit perplexed, a little bit baffled, how do you guide them through this and how do you bring the temperature down a little bit on this conversation?

Mitch Bernier:

Right. Yeah, Paul, good morning guys, and good to see you here this morning or talk to you this morning. I think this is very much on business people’s minds, like the owner’s minds now. Like you said, when you wake up in the morning and what’s bugging you. And lately, one of the big topics, and it kind of I’ll say started through COVID. There was a very big uptick on cyber attacks, cyber crime. And we keep hearing these stories in the media about some large enterprises that get compromised or even down to your neighbor’s small business that gets attacked and compromised. They fall for something, they get tricked for something, they get ransomwared, cryptowared, all these names.

And now even in Saskatoon, since in my geography, I tend to deal with more small business than large enterprise and I have a lot of owners coming back to me now with a two or three-paged PDF from an insurance company saying, “Hey Mich, can you help me fill this out?” And I guess I’ve always done those steps with these people because it’s a lot of the geeky type questions that they’re just not going to be able to answer. But over the last year, I probably start filling out two or three of these a month now to try and help people through their things and identify the gaps. And a lot of times they say, well, what’s this about? Why do I need this?

And at first it started with, “Hey, Mich, my insurance guy, he’s trying to sell me this cyber insurance stuff. Do I need it, or do you have me protected?” And now it’s more a conversation of, “Hey Mich, I want cyber insurance now. Not do I need it, but now I want it. What do I got to do to comply?” And in the last year in filling out these forms, the forms are getting a lot more specific on what they require for a business to comply. And there’s a few key things as the buzzwords that Colin mentioned there. MFA is such a huge thing now. Encryption, a big word and it means a lot in a lot of different spaces. The endpoint detection, EDR or MRT or MTR, managed threat response.

Some of these things now are becoming so prevalent in our cybersecurity world. It’s almost mandatory to have these pieces in place now. Just like when the internet came out of 20 years ago and everyone needed a firewall, that was the one piece to keep you secure. And now it’s so much more than that. Now our world is so connected, the introduction of everything cloud-based. And now your resources aren’t necessarily in your four brick walls downtown. They’re scattered throughout the cyber universe. How do you protect it all?

Paul Martin:

I guess we know we’ve reached a level of maturity when we have our own set of acronyms and initials for something like this. And I noticed you were first struggling with the number of initials that are out there, and you got to feel a little bit sorry for the business owner or the CFO responsible for placing insurance to be able to keep up to all of this stuff. And Colin, I’m wondering, do you get pushback from prospective clients or your client base, or how are they reacting to this just with some kind of resignation, or are they indignant about it?

Colin Rooke:

Yeah, so Mitch made a very good point when it comes to the application itself. So, the application is full of terms. I mean, absolutely full of terms. And unless you’re dealing with someone like Mitch on the other end, we’re asking a CFO as an example to confirm is this in place, is that not in place. And it’s tough to keep up. And we certainly get applications back where some of these boxes are ticked, and it takes a couple of questions from our end to realize, no, they’re not.

And so there was some confusion. You’re not quite sure what multi-factor is like. We’ll get organizations that’ll say, well, we have login passwords. Well, that’s not what we’re talking about. And so I think step one, especially due to the complexity and the nature of the risk and the insurance application itself, I think it’s very important to reach out to someone like Mitch from Professional Computer services and say, “I might know what I’m doing, but I don’t want to be wrong on this. Can you walk me through how to fill this out because I certainly don’t want to say yes to something that we don’t have in place?”

Because from our chair, if you say yes, but you have it and don’t, there’s a breach, there’s not going to be coverage. And that’s a big deal. And so I think step one is talking to someone to walk you through it. But Mitch, we talked about a few of the acronyms. Why don’t we start with MFA, multi-factor authentication, and just kind of quickly explain what it is, what it does, how do you get it, and why the insurance companies would care?

Paul Martin:

Yeah, and I’m going to jump in. We have to take a little break, and I was thinking right after the break, Mitch, if you’re good with that, we’re going to come back and kind of walk through some of these more technical terms and just get your insights so that business people, business owners and managers can actually get their head around this. And this becomes less of a fear factor, more of a “Oh, I understand that and I know why we’re doing it.”

You’re listening to Risky Business Commercial Insurance with Butler Buyers. I’m Paul Martin. We’ll be back after this.

Welcome back to Risky Business Commercial Insurance with Butler Buyers. Paul Martin, your host here, and joining me, Colin Rooke, the commercial risk reduction specialist at Butler Buyers, and Mitch Bernier, partner with Professional Computer Services. And we’re just getting into some of the terminology that is… I’m guessing going to become part of the average everyday business person’s lexicon as we go forward. And Mitch, maybe just walk us through that. And let’s start first with that multi-factor authentication thing that we’re talking about prior to the break.

Mitch Bernier:

I think multi-factor authentication is probably the single most important piece to ensure everyone is running nowadays. On top of strong passwords and a firewall and stuff, it’s the latest thing on a way to protect yourself. I think in most small business in their Office 365 tenant, there’s some easy check boxes or easy clicks to enforce your staff to help them to enable this thing. Back in the day, we relied on one password as that single password. And I think that’s where the multi-factor, it started with two-factor authentication where people realized, if that password gets compromised, is there another step that we can take to protect ourselves? While now, people or businesses are looking to multiple ways to protect those layers to get into your organization to get to data. So, it kind of evolved into the term multi-factor authentication. So usually, the first step in MFA is something you know is your password; is the most common thing.

For years and years now, we’ve been stressing to people have a good strong password, uppercase, numbers, symbols, stuff like that, come up with a phrase, something that’s not guessable, not in the dictionary. The next evolution in there now is in the MFA world, something you have. So for most people now, it’s a smartphone. So the next layer to authenticate is… And a lot of people will see this from their bank accounts nowadays, where it’ll text you a code and you got enter in the code and then I can gain access to my bank account or the banking website.

In the Microsoft world, it’s to gain access into that Office web app or into my Outlook, into SharePoint data. Another option is the fobs that you see. Every now and then, somebody will see it on their key chain or something, and it’s a code that’s changing every one minute. You can install that same type fob as an authenticator app on your smartphone. And in our world here, we tend to push that authenticator app a little more than a text message. Nowadays it seems a little more common, where when you’re setting up the two-factor authentication steps, they’re asking you to scan this QR code and it’ll install into the authenticator app and start generating a new code every one minute for you to key.

Another type of authentication then, of course, is something that you are, meaning your fingerprint, your face, your palm, when they scan something bio on you that they can look at that’s unique to you as a human. My laptop, now when I sit down in front of it, there’s facial recognition, so my cameras tends to always be on, or I don’t cover the little slider switch. So it’s looking at me, and when it sees my face, it turns itself on and logs me in. Something like that.

I think in filling out all these insurance forms here lately, MFA is the one piece where you can really see it coming from any insurance provider now where it’s almost a black and white question of “Do you have this enabled? Yes or no?” And if you check the no box, then they always come back and say like “You’re declined. We’re not going to cover that one.” And then usually, the business owner comes back to say, “What do we got to do? How do we do this? Where do we go from here?” So you can walk them through the steps of getting that coverage or getting some type of MFA going, and then they can check the yes box. That make sense?

Colin Rooke:

Yes. Yeah, absolutely.

Mitch Bernier:

I think in the recent waves of attacks that we see now in the world, most, like 99% of them will be stopped if people have MFA enabled. If they receive a bad email and they click on that bad link and type in their password for their office account, the next check if the bad guy had your password now, it prompts them for that MFA authentication. So if you’re sitting there with your smartphone and you’re getting a prompt for, “Hey, do you want to allow this to happen?” And you’re thinking, “I didn’t ask for anything. I didn’t do anything.” The immediate button to hit there is “Deny the action.” Proceed if you don’t know.

And of course, as we’re talking about this, well, maybe a year or so ago, we went through an exercise where that was the case where somebody was annoyed with the button popping up on their phone saying “Do you want to approve?” And they said no. And eventually, they were annoyed by it, so they approved it. So even that level of protection, they just bypassed it by not thinking about it because they were getting attacked. They just didn’t realize it until it’s too late. And it comes down the human aspect there. They’re waiting for the human to make an error, make a mistake.

Colin Rooke:

I’m glad you said that because I often talk about that cyber crime is almost 100% human error. And it’s these types of situations where you’re explained what multi-factor is, that you’re going to get an alert on your phone if someone’s trying to log in, but then people being people, you see the prompt, you think something’s wrong with the program and you approve it, and now suddenly we have a breach. So I’m glad that you touched on that because it’s something that I often talk about; that’s why education’s so important and it’s so important to have regular talks about cyber crime and cyber liability because of instances like this that if your phone is telling you someone’s trying to log in and you aren’t, it is a problem. Don’t ignore it. Don’t just hit “Allow it to go away.” Tell someone like yourselves in IT to say, “I’m a little concerned.”

And I always say too, and I just ran into a situation yesterday that if your gut instinct is telling you not to do something, what has to do with your computer or your device, don’t do it. I mean, you’re not going to be reprimanded to say, “Hey, I was thinking about the company here. This seems a little suspicious. I don’t want to do anything that’s disruptive. What should I do here? Should I do something or leave it?”

Mitch Bernier:

Yeah, that’s right. It should raise an immediate red flag to the user. And most of it comes down to that user education, user training. A lot of people will say “I don’t understand IT. I don’t understand all this stuff. It’s too much.” But that’s where we do need to start training our staff, training the people on what this means, how it works, and what it means, what to do. And you’re never going to go wrong by asking questions or going to ask somebody, “Is this good or bad? Should I do this?” to keep the organization safe.

Colin Rooke:

Yeah, absolutely.

Paul Martin:

Colin, we’ve got maybe a half a minute left here. As you guys are discussing this, it just strikes me as training and plugging the staff into this stuff on a regular basis becomes one of the tools that business owners can use- regular training or updating sessions. And Colin, I wonder how the insurance industry views that. If a company seem to be proactive on this by spending time discussing it with staff, maybe having a Mitch come in and talk to the team, that I’m guessing is considered favourably.

Colin Rooke:

Yeah, absolutely. Again, part of the reservation with the insurance markets is, are we discussing cyber crime? Does the organization understand cyber liability? We get questions around it, and we don’t have time to touch on it today, but having an incident response plan, and part of that plan requires at minimum quarterly education or rereading the plan. And so these are all things that as we go, it’s going to… Of course, from a pricing standpoint, but frankly at this point, just the availability of coverage itself, that if you’re not putting in the effort, you’re going to find yourself without. And that’s the real concern. And so education is very important, and it’s important that we relay that back.

Paul Martin:

Gentlemen, we’ve run out of time. Thank you for this. The insights are really impressive on this. Mitch Bernier, partner with Professional Computer Services. Thanks for taking time to join us. You’ve been listening to Colin Rooke, commercial risk reduction specialist at Butler Buyers. This is Risky business. Thanks for joining us.

Mitch Bernier:

Thanks Guys.