By Naomi Grosman    |    16-minute read

In this new series of Quarterly Reviews from the CIP Society, catch up on the industry's most important issues in an easy-to-read format. In our first edition, read about key indicators in the ongoing debate around the hard market; learn two important cyber terms and how they are causing confusion in the cyber insurance space; and find out about the potential implications of climate change litigation on underwriting.

Hard market hindsight is 20/20

"We may be in the early stages of a hard market but it’s difficult to say with certainty without the benefit of hindsight."

― Philip H. Cook, Omega Insurance

Poor underwriting results and lack of returns on investment and equity have led to a restriction of capacity and ballooning premiums indicating a hard market in Canada, which experts say is long overdue.

Philip H. Cook, Chairman of Omega Insurance Holdings Inc. said since the 1970s, there have been three hard markets in Canada: 1975 – 1978, 1984 – 1987, and 2001 – 2004. “There have only been these three hard markets that everyone acknowledges,” Cook said.

But hard markets tend to be identified in hindsight because it can be difficult to discern the industry’s normal cycles and a true hard market, he said.

“What drives the cycles is the appetite of underwriters to assume risk and periods when they are aggressively taking on risk, increasing market share and reducing rates,” Cook said. “As they realize rates are too low, there comes a blip in the other direction to increase premiums — it’s a normal market cycle that always takes place.”

Premium increases and reduction in capacity

Linda Regner Dykeman, Allianz Global Corporate and Specialty (AGCS) Chief Agent of Canada, said at the beginning of 2019, when commercial insurance rates started to increase, the industry labeled the fluctuation as a market correction, evolving market or transitioning market.

Capacity remained available but insurers started restricting its deployment and rates continued to increase over the course of 2019, thus the industry changed its tune on how it labeled the market swing, she said.

“We definitely have rates going up, typically substantially… and deployment of capital is being restricted given the returns that we are seeing,” Dykeman said. “The capacity being restricted is in many lines and segments and that is what has met the hard market definition typical for the industry — that capacity restriction.”

She said premium increases are beyond what is considered normal renewal, which usually ranges from 5%-10%. Some segments have seen increases of 50% or 100%, even up to 300%. She said property lines suffered the most at the beginning of 2019 but difficulties have started to bleed into other lines.

“You are seeing it in casualty, directors and officers, many other lines where rates are going up significantly and capacity is being restricted because returns aren’t there,” Dykeman said.

Paul Martin, president and chief operating officer at Toronto-based brokerage RRJ Insurance Group, said in his experience with market fluctuations, current market conditions can be described as hard.

“The reason I would consider it a hard market as opposed to a corrective one… is the tightening of underwriting and lack of insurance companies wanting to put up capacity,” Martin said. “I think there is capacity there but an unwillingness for insurance companies to put up full capacity.”

“And finally the amount of rate increase that is being asked is beyond what should be asked in normal course of business.”

He said certain lines of business, manufacturing and wholesale for example, are still fairly stable but in any lines where claims frequency is increasing, such as residential realty, brokers have limited options. Also in new and emerging classes of business, like the cannabis sector, it is very difficult to get limits and capacity.

“But there isn’t a class of business that brokers can’t place,” Martin said. “It’s a question of the terms and conditions, and premiums we can get.”

Top 5 hard market attributes:

1. Combined ratio well in excess of 100%.
2. Plummeting Return on Equity.
3. Reduction in capacity.
4. No new market entrants.
5. Changes in willingness to increase premiums.

While current market conditions have flavours of a hard market, it isn’t quite at the point where it can be called a true hard market, Cook of Omega Holdings said.

Combined ratio and return on equity (ROE)

He said based on the extrapolation of last year’s third quarter, the 2019 combined ratio will likely hover around 100%, which is nowhere close to the combined ratios prior to the last hard market, when they were 105.9%, 108.8% and 111.1% in the three years leading up to the hard market of 2001 – 2004.

He said similar to the combined ratio, declines in Return on Equity have not been quite as dramatic as during the last hard market, when it dropped from 6.3% in 2000 to just under 3% in 2001 and just under 2% in 2002. In 2018 the industry ROE was 4.6% and in September 2019 it was 4%, which he expects for year-end as well.

However, while ROE is a useful hard market indicator it is an unreliable predictor due to fluctuations in industry capitalization.

“We have surpluses much higher in the industry compared to the 2000s, so inevitably the ROE is lower,” Cook said. “Four per cent is not a very attractive rate of return when it is applied to a much larger base of equity.”

And while capacity is being restricted now, the situation is not as dire as during the last hard market and new market entrants are abundant, he said. “You don’t see new entrants come in during a hard market, the complete opposite is happening now — new capital and new entrants are coming into the business.”

The role of reinsurance

Cook said it will be interesting how reinsurance renewals will impact primary insurers’ combined ratio because reinsurers have had large losses in personal lines, mainly due to wildfires on the West Coast of the U.S.

“Reinsurers in the past tended to have only been exposed to commercial and industrial losses, this time the reinsurers have huge losses in personal lines,” Cook said.

He said there is a degree to which increasing rates entails a reputational risk so the question remains whether primary insurers will pass on the anticipated reinsurance rate increases to their policyholders on the heels of having increased rates significantly already.

“Insurers can either put it through to the policyholder in which case the combined ratio will stay relatively low or they will have to eat it — which means the combined ratio will go up by 5 points,” Cook said.

“We may be in the early stages of a hard market but it’s difficult to say with certainty without the benefit of hindsight.”

Silent & light causing confusion in cyber

"[Cyber light] is creating an illusion that businesses are protected."

― Greg Markell, Ridge Canada

In a world where the ubiquity and complexity of cybercrimes is increasing, businesses may be underinsured for cyber risks as insurers move to exclude certain cyber exposures from property policies to avoid silent cyber.

As cyber criminals hack their way to causing property damage, insurers may be carrying silent cyber exposures on all risk property policies, said Greg Markell, president and CEO of Ridge Canada, a Toronto-based managing general agent that specializes in cyber insurance.

“Silent cyber is an exposure on property polices because they are all risk polices and because (cyber) isn’t an excluded peril, there is a debate whether or not there is potentially silent cyber coverage,” Markell said.

He said insurers are moving away from unintentionally picking up cyber risk by explicitly excluding it from property policies as well as carving it out of other policies, such as directors and officers liability.

He said most property policies have cyber exclusions to avoid covering that silent cyber exposure and some insurers have started selling what has become colloquially known as ‘cyber light’ endorsements.

But cyber light might be hurting more than it is helping because “it is creating an illusion that businesses are protected,” Markell said.

For example, it doesn’t typically cover ransomware attacks, which is currently the most common cyber crime. Cyber light also usually excludes liability coverage, data restoration and only some include crisis management and business interruption, he said.

“The biggest threat to businesses are ransomware attacks but cyber light doesn’t address it at all,” Markell said. “This is a dangerous game to play.”

Patrick Bourk, principal and national cyber practice leader at insurance brokerage Hub Canada, said cyber light is not a substitute for standalone cyber policies.

He said cyber light (which is not the term carriers use when selling the endorsement) addresses cyber exposures by adding an additional sublimit to an office package policy, for example, for an inexpensive premium.

“It’s called cyber light because it’s not standalone and those policies don’t typically have all the bells and whistles that a standalone cyber policy does — they are cheaper and I get worried about those,” Bourk said.

He said standalone cyber insurance covers much more than just financial loss of a cyber incident. Perhaps most importantly, it secures access to professionals who manage a cyber incident from start to finish, unlike what insureds get through cyber light.

“I have seen cases where the insured gets a standard loss adjuster…that may not have the experience of dealing with a cyber incident,” Bourk said. “I get very nervous about those cyber light polices being actually able to handle a true incident let alone provide the limits that the insured might need.”

Silent cyber exposure/risk: A cyber exposure that has not been explicitly excluded from traditional all-risk policies, such as property, which was not designed to cover such risks.

Cyber light: Typically, an endorsement to a package policy that offers small sub-limits of some form of cyber-related coverage, however it is rarely individually underwritten and the coverage is typically narrow.

Incident response

Ridge Canada’s Markell said confusion about cyber insurance stems not only from the cyber product’s complexity — cyber incident responses are often a quagmire.

He said to adjust a cyber claim, insureds often need a breach coach, typically a lawyer, public relations and crisis communications, and policy interpretation.

And if a breach leads to business interruption, which is common in ransomware attacks, forensic accountants and auditors are needed, he added.

“You have multiple parties involved in adjusting these losses to help the client get through it and be resilient,” Markell said. “Not only is the product itself complex but the actual response and claims management component is very complex.”

He said businesses and operations of all sizes are vulnerable to cyber crimes and people are taking note as examples of such crimes emerge in the media more often, he added.

“There is very little in terms of repercussions for these people that are hacking, extorting and stealing from businesses — they are a world away in some cases…and they are very sophisticated,” Markell said. “But the risk is there and Canadian businesses need to take it seriously or face the consequences.”

The cyber criminals

Hub Canada’s Bourk said criminals’ boldness is increasing, they are demanding higher pay outs and the forms of ransom have become more sophisticated.

“(The sophistication) is far greater than most people understand,” Bourk said. “We are talking about organized crime, not teenagers trying to have fun but well-oiled machines in nation states (that) invest in thousands of different types of malware, different strains and we are playing catch-up.”

Just last month, Canadian laboratory testing company LifeLabs said cyber criminals had accessed customer information such as names, addresses, email, login passwords, dates of birth, health card numbers and lab test results. Information of approximately 15 million customers, mostly in B.C. and Ontario, was potentially accessed and the company had to pay a ransom to retrieve that data.

One of the ironies of ransomware attacks is that criminals ask for relatively low sums of money compared to what the incident ends up costing victims when indirect expenses are taken into account.

In a 2018 ransomware attack on the Ontario town of Wasaga Beach, hackers were paid $35,000 in bitcoins for the town to regain access to its servers. But the incident cost the municipality a total of $250,000 because of the time computer systems were down, cost of consultants and loss of productivity, a report from the town’s treasurer and director of finance found.

South of the border, a ransomware attack in Atlanta that same year, the total price tag of hackers’ demand of $51,000 in bitcoins was $2.6 million.

Importance of cyber risk management

“The reality is everyone has (cyber) exposures,” Markell said. “We are more reliant on computers and machinery every day so this exposure isn’t going away — in fact it’s increasing.”

He said given the growing awareness of cyber incidents, cyber insurance penetration will increase but many businesses might be uninsurable because cyber risk management is in some cases woefully inadequate.

“It would be great if 100% of business bought standalone cyber insurance but I don’t think 100% of businesses are currently insurable,” Markell said. “There is still work that needs to be done on the client level to ensure businesses are more robust and diligent in terms of securing their digital assets.”

Climate change and legal liability

"There are significant issues with proof of causation."

― Colin Feasby, Osler, Hoskin & Harcourt LLP

There are few that doubt the correlation between using fossil fuels and climate change but proving that oil and gas companies’ products are the direct causation of climate change is a different story.

Colin Feasby, Calgary Managing Partner at law firm Osler, Hoskin & Harcourt LLP, said most oil and gas producers acknowledge that their product releases carbon dioxide and accept that carbon dioxide affects the climate and changes are happening as a result.

But the leap to oil and gas producers being held legally liable for climate change is a giant one, he said.

“There are all sorts of other activities that contribute to (the changing climate),” Feasby said. “There are significant issues with proof of causation. People frequently say it’s hard to attribute any specific weather event to warming and hard to contribute warming to any specific action of any specific company.”

And climate change litigation against oil and gas companies has so far been unsuccessful, he said.

Three types of climate change litigation:

1) Constitutional lawsuits. Plaintiffs asserting the constitution protects a right to a clean environment and the government is not doing what is required to guarantee that right.

2) Securities misrepresentation lawsuits. Like the civil case brought against Exxon Mobil by New York’s Attorney General that claimed the oil giant lied to investors about what climate change regulation would cost the company. The judge found in favour of Exxon.

3) Nuisance tort suits. In essence, a tort that allows people to sue others for pollution.

Mr. Feasby said that while it is not out of the realm of possibility, courts in B.C. and Ontario have thus far not agreed with the claim that the constitution protects citizens’ rights to a clean environment.

And while climate-related securities suits have not been brought forward in Canada, such cases aren’t strictly climate change lawsuits because “companies can be sued for lying to their investors for any number of things.”

He said in the U.S., large municipalities have unsuccessfully brought nuisance tort suits against oil and gas companies and those cases have a flavour of fraud to them because they are claiming oil and gas companies are behaving like tobacco companies in that they are not being forthright about the effects of using their products.

He said there have not been any nuisance tort cases in Canada and while the potential of such lawsuits here should not be taken lightly, and there have been threats of such cases, every case in the U.S. has failed.

In the case of tobacco company liability, legislation had to be changed to allow governments to sue for health care costs. In October 2018, Ontario’s New Democratic Party tabled a bill to hold oil and gas companies liable for climate change. The bill didn’t pass.

Feasby said there is an important distinction between oil and gas, and tobacco cases.

“Tobacco, as much as some people enjoy the partaking of it, is not something that is actually valuable from a societal perspective. Oil and gas…are the basis for the industrial revolution and largely responsible for the standard of living that we enjoy.”

Reinsurers making a move

Despite the complexities of holding oil and gas companies responsible for climate change, there are indications that their products’ link to changing weather patterns could be influencing underwriting practices in the insurance industry.

While many reinsurers are moving away from coal-related underwriting and investments, explicit changes to oil and gas-related underwriting have not been made public.

In mid-2018, Swiss Re said it would no longer provide reinsurance to businesses with more than 30% exposure to thermal coal across all lines of business. Its Sustainability Risk Framework addresses specific guidelines that apply environmental protection policies to eight sectors, including oil and gas, in which it perceives sustainability risks. The reinsurer was also one of the initiators of the “Net-Zero Asset Owner Alliance” which commits to net-zero greenhouse gas emissions in its investment portfolio by 2050.

Also in 2018, Munich Re said it would no longer invest in shares or bonds from companies that generate more than 30% of their revenue from coal extraction and coal-fired generation, and coal and oil sands would be excluded from its infrastructure investments.

In October 2019, Axis Capital holdings announced it would not provide new insurance or facultative reinsurance for the construction of new thermal coal plants or mines and their dedicated infrastructure or oil sand extraction and pipeline projects and their dedicated infrastructure.

Implications for underwriting of oil and gas

An underwriter at a large Canadian primary insurer, who has over a decade’s experience in underwriting property risk in the energy space, said conversations around how climate change could impact underwriting surfaced around five years ago. Prior to that, climate change didn’t come up in the context of underwriting.

He said the reduction in coal-related underwriting started about four years ago and only in the past year have conversations around changing underwriting practices in the oil and gas sector emerged. He said for the most part reinsurers are still supportive of underwriting oil and gas projects but on the property side there is some concern regarding reinsurers’ willingness to support new pipeline projects.

“A big part of what we do is rely on reinsurers to support us and if they do not we have to be aware of that. (For insurers) oil and gas is a huge portfolio as an industry.” He said underwriters are more cognizant of how oil and gas sector risks relate to the environment and have changed some questions to reflect that but his company has not scaled back on underwriting.

“We need to see clear plan from the insured that they are doing all the right things to keep emissions down for us to want to insure those risks,” he said. “We need to make sure they have a plan in place and most (oil and gas companies) are doing that anyways now. A lot of oil and gas companies are doing good things and are on the right track in terms of emissions.”

He said while underwriters are taking a cautious approach it’s difficult to say at this point how these developments will play out.

“It’s in early stages and may come to point where bigger oil and gas companies will have to do more self insurance because there won’t be capacity or they will have to go to the London market and look for other ways.”