Terrorism risk strategies: mitigate, manage, transfer

Mitigate, manage
Each action taken in the treatment of an organisation’s identified risks will fall under one of the remaining four components of a terrorism risk programme. The four must be assessed and carefully balanced within the context of the organisation’s risk profile and appetite, its resources, and its goals.

Risk mitigation comprises essentially the avoidance of risks. Ocean-going vessels have long practised risk mitigation when piracy makes certain sea routes less safe than usual: they simply sail around high risk sea channels (in extreme cases this decade, passing the Cape of Good Hope rather than risk dangerous waters beyond the Suez Canal), or employ on-board armed security guards. Similarly, recent, possibly state-backed bombings of vessels in the Gulf of Hormuz have prompted some masters and owners to take alternate routes where possible. The potential to suffer terrorism at the hands of activists has led some companies to withdraw from certain activities, including vivisection. However, risk mitigation is often not an option.

Risk management is essential in the many cases where terrorism risk cannot be avoided through mitigating actions. It includes actions taken to reduce the likelihood that risk transform into loss events. Measures range from the installation of barriers that prevent vehicles from entering pedestrianised areas, to the development of emergency response plans intended to reduce the impact of an attack which has not been avoided or thwarted. Many activities lie in between, such as instructing staff on threat identification, and bag searches for anyone entering a building.

Risk transfer through insurance
Security agencies around the world have become highly proficient at averting terrorist atrocities, which has made them excellent anti-terrorism centre-forwards and goal keepers. However, they can never guarantee to interdict all terrorist plots, every time. Risk transfer – essentially, the purchase of insurance – is the next component. When risk mitigation and management measures fall short and terrorists are successful in their attacks, terrorism insurance is the underpinning backstop which ensures resilience. It allows organisations to get back to business within the shortest possible time, and with the minimum possible impact on their balance sheet.

Terrorism risk transfer is Pool Re’s business. We provide, indirectly through conventional insurance companies, the insurance backstop which provides cash indemnity and supporting services designed to ensure that organisations will have the resources necessary to recover as quickly as possible from a terrorist attack. We rely largely on our own capital and that of retrocessionaires – companies that provide reinsurance for reinsurers – but above that capital sits a loan facility from Her Majesty’s Treasury, which will cover reinsured terrorism losses that exceed the member retentions and our own capital pool (claims exceeding £9 billion).

In the past only the largest companies were able to acquire insurance against terrorism risks, but today, in the UK and many other countries, cover is easily obtained through the usual insuring channels due to the involvement of state-backed terrorism reinsurance risk pools such as Pool Re. Insurance is now an essential part of any company’s terrorism risk strategy and business continuity planning and is an acceptance that we live in a changing terrorism threat landscape.

In Britain terrorism insurance is now available and affordable for all organisations. Claims can be made for losses due to an act of terrorism even when a terrorist attack has done no physical damage. For example, customers were denied access to businesses trapped behind the police cordon at Borough Market for over a week following the London Bridge attack. Many small traders suffered considerable losses from a drop off in footfall and spoilage of consumables. Since the event, Pool Re has created affordable ‘non-damage business interruption’ coverage for terrorism related losses.

The threat of terrorism is persistent, and it isn’t just about London. Small and medium sized organisations across the country are equally likely to be affected, either directly or indirectly. Taking a risk by not buying terrorism insurance, and instead adopting the belief ‘it will never happen here’ is a high-risk strategy in a world where terrorism is now, sadly, part of everyday life. Companies, large and small, can reduce the impact of terrorism by having a comprehensive risk strategy which covers all aspects of this diverse and unpredictable peril. An intelligence-led approach and plan will ensure effective and enduring resilience. Transferring risk through appropriate insurance is a must.

www.poolre.co.uk