As for us, all the editors at Risk Management magazine were able to make many valuable contacts and devise dozens of new story ideas that we look forward to sharing with all of you in future editions.

What was the highlight of RIMS 2009 for you?

UPDATE: Check the RIMS site for even more post-Conference coverage, including each day’s Show Daily newsletter, attendee Twitter feeds (you can follow our editor Jared Wade @RiskMgmt) and a Conference image gallery.

The Exhibit Hall was the hub of the excitement with some 400 exhibitors.

The chief finding is that 38% of Fortune 500 companies surveyed do not explicitly mention privacy/data breach in the risk factors section of their SEC 10-K filings, which when broken down by sector is even more alarming: 46% of diversified financial companies, 50% of telecommunications firms and an astounding 80% of utilities. 

Worse still is that, according to Whetstone, many of even those that do realize the financial and reputational risks associated with a potential security breach deem the easiest solution, encryption, to be too cost-prohibitive to use even though they realize it would largely mitigate the threat altogether. You see, currently around 45 states now have laws that require any organization that loses confidential consumer/patient/student/etc. data to notify anyone who was affected. And that’s when the lawsuits, complaints and horror stories of identity theft begin. Not only is this a huge financial burden — the costs of hiring computer forensic specialists, mailing notifications, setting up call centers and offering free credit monitoring adds up very, very quickly — but the comparable reputational fallout is nearly impossible to quantify.

All this could be averted in most cases, however, with data encryption since almost all those same state laws also include a “safe harbor” provision that allows companies who safeguarded the data to forego the onerous notification process.

To put this all in proper perspective, all Whetstone had to do was ask me one question: “You know why a car has brakes?” 

Since I learned this fact around first grade, I thought to myself “I got this one…to stop, right?”

But before I said anything he answered his own question: “So it can go fast.”

Most companies are prioritizing innovation — and rightly so. They’re trying to gather as much consumer data as possible to put this to use in sales, development and improved customer relations. But in making these technological advances, it’s also important to ensure you have the right safeguards in place. “It’s a constant battle between technology and the brakes on the car,” said Whetstone. “Companies are trying to be innovative — they’re trying to push the envelope — and that’s always dangerous.”

Whetstone has no delusions that any company should stall innovation for the sake of encryption and data security, however. On the contrary, he thinks gathering all this data is huge advantage for companies. They just have to be careful and understand their vulnerabilities. And all it takes is glancing at a few of the colorful charts in Hiscox’s report to realize that most companies are failing at the latter endeavor. In TJ Maxx’s infamous data breach, for example, the company was attempting to improve its store’s operations by implementing a wireless network yet it failed to realize that sub-par security opened up the location to nefarious data thieves.

Of course, it is indeed true that encryption is still expensive in some cases — back-archiving old legacy systems, for instance. But using encryption doesn’t have to be an all-or-nothing proposition and Whetstone believes that, at a minimum, companies need to at least encrypt the data stored on laptops, USB drives and back-up tapes. He includes this in what he calls a “defense-in-depth approach” to IT security. By securing those physical items that can be left at an airport or in a taxi cab, you allow risk managers and legal counsel to rest easy knowing that their employees at least won’t be giving confidential data away. Hackers can still breach the network and that will remain a concern, but protecting the physical storage devices provides a first level of defense.

And most importantly, risk managers need to be involved in the IT discussion. The ideal balance between the legal team, IT and risk management is unique for each company. But unless everyone is talking and understands the priorities and recommendations of the others, data breaches are only going to happen more often.

Hiscox found that only 7% of US companies have implemented end-to-end encryption on their confidential personal data.

Unfortunately, when I went to the session, I found that it had been cancelled. Exactly why it was canceled is something I don’t know and honestly, I don’t much care to. After all, AIU has a long-standing relationship with RIMS and with this Conference, and there could be any number of reasons why the session did not come together. That’s not the point.

This session would have been a great opportunity for AIU to talk frankly to those who want to know if their insurance partners are really going to be there for them when they are needed. I suspect the event would have attracted a fair bit of trade media attraction, which is always reason for any firm to get a little nervous. But that aside, AIU has a lot of information and insight to share. It’s too bad they could do that with us today. Another time, perhaps.

Drugs such as ecstasy are commonly abused by employees across all industries.

Lost productivity costs employers $197 billion a year, according to the U.S. Government. One of the major reasons for lost productivity is drugs in the workplace. Drug and alcohol abuse in the workplace is also a constant threat to company liability and workers comp costs. Darryl Hammann, director of disability and absence services for Sedgwick Claims Management Services, revealed an alarming fact during his session this morning: 76% of people with drug and alcohol problems are employed.

What this means is that more than likely, one or more of your employees or coworkers is lacking in productivity due to the fact that they are currently under the influence or recovering from being under the influence the night before (just hours before arriving to work). This, as one might assume, can have an enormous impact on workers comp costs as employees with drug abuse problems are four times more likely to have an on-the-job injury.      

Additional costs include, but are not limited to:

• Increased healthcare costs
• The fact that other workers suffer
• Effects on the relatives of the employee
• Increase in absenteeism
• Increase in workplace theft

To combat the effects of drugs in the workplace, the panelists proclaimed that companies should implement drug education programs and/or pre-employment, random or post-accident drug testing policies. 

Jeff Brody, director of safety and loss control for Pepsi-Cola Bottling Company of New York, said it comes down to three things when working to combat drug abuse in the workplace: educate, prevent and promote. 

“Post accident drug testing is not the magic bullet, but it is certainly another weapon ready for use in your workers comp arsenal,” said Gisele Posey, senior director of workers comp and loss prevention for Kindred Healthcare.

With companies striving to stay alive in these economic times, drug abuse in the workplace is one thing managers should not have to worry about, but unfortunately, it is an epidemic. An epidemic that doesn’t take into account whether other employees are struggling to pick up the slack of a drug abuser, or whether the company is operating in the red, or whether workers comp claims will push their struggling company over the edge. 

Drug and alcohol abuse is a societal problem that will never completely go away. How is your company facing this issue?

As with any report of this kind, there is a temptation to dismiss the findings as far-fetched and unlikely — the kind of thing best left to the Chicken Littles of the world who want to live in fear that the sky is falling. But what if the sky does fall? What do you do then? As John Merkovsky, managing director of Marsh Risk Consulting, said during Marsh’s analysis of the report this morning, “It doesn’t matter if you’re out of business for reason A, B, C or D. You’re still out of business.” 

Risk is increasingly interconnected and any risk manger can visualize a scenario where a global concern can quickly become a personal concern. Now is not the time for what the World Economic Forum calls “risk myopia.” The impacts are too great. After all, if the extremes on the bell curve can kill you, it would be crazy not to pay attention.

Below is a video from a World Economic Forum panel discussion on the survey’s results from January. 

John P. Kotter

John P. Kotter, author and leadership consultant, was the guest of honor at Tuesday’s Keynote Luncheon here in Orlando. 

He began his intriguing presentation with the comparison of two CEOs. Those in attendance were forced to focus on how the leadership and management styles of the two men differed drastically. After in-depth studies and interviews were done with each CEO’s employees, it was revealed that CEO number two (GE’s Jack Welch) was praised as a better superior because he focused more on leadership than management, especially in times of change.

This, in a nutshell, is what John P. Kotter is all about: telling the corporate world that leadership, not necessarily management, is how successful companies operate. “The critical ingredient in all of this is leadership — and you can learn it.”

In addition, he offered his eight steps for successful large-scale change:

1. Increase urgency
2. Build the guiding team
3. Get the vision right
4. Communicate for buy-in
5. Empower action
6. Create short-term wins
7. Don’t let up
8. Make it stick

If you want to hear more from Kotter on the topic, you can buy his book Leading Change on Amazon.

Conversely, however, is the other reality of the economic crisis: Few companies have the resources to devote to non-revenue generating endeavors. So while many risk managers may be getting heard by the board for the first time and receiving the encouragement they have always desired, they are not always getting that support in the form of resources. 

For insurers, the predicament is different — yet similar.

Given the economic climate, there must be a return to underwriting discipline. Earlier today I spoke with Bob Petrelli, who is a managing director in Swiss Re’s insurance division, and he emphasized this need. “Last year’s crisis has shown us that you can’t put all your faith in your investments,” he said. “You need to have that underwriting discipline.”

But, obviously, this is easier said than done, and even though we’re seeing signs of a return to the hard market, many insurers have been unable to actually stick to their guns and practice what they preach. “If everyone would do what they say they are going to do, we would see a hardening market,” said Petrelli’s colleague at Swiss Re, Nikolaj Beck, who is also a managing director on the company’s insurance side.

But more so than simply tightening prices and limiting exposures, both Swiss Re’s executives as well as those I spoke with at Zurich stressed the need for innovation. Given their market footprints and name brands, neither company likely needs to worry about coming out of the economic crisis in good shape. But each seemed hopeful that when the turnaround does occur, they will not only emerge comfortably, but with a distinct competitive advantage in their markets. 

Zurich, for instance, has recently released a new D&O policy it is promoting at RIMS 2009 that it hopes can set a new standard for coverage. By enhancing some aspects of its Side A coverage for individual directors (including retired directors) as well as including an extension for “environmental mismanagement claims” resulting from climate change retaliation claims, the company is hoping that this type of innovation will differentiate it from a marketplace where many of the players are content to just tread water. The goal, according to  Zurich chief innovation officer Ty Sagalow is “raising the bar in D&O.”

And, thus far, the feedback he’s received is encouraging. “One broker’s response was ‘It kicks ass,’” said Sagalow. Sagalow was particularly committed to such forward thinking in the realms of climate change and globalization-related risks still on the horizon — like those supply chain risks that the recent spike in piracy off the Somali coast are illustrating far too often — and is trying to find a good balance between those things that policyholders are asking for and those things that his team has identified as the emerging risks affecting all organizations.

“Whether it’s a soft market or a hard market, it’s always a market for customer-centric innovation,” said Sagalow. “When we go to [our clients] and tell them we’re responding to their needs, they are very receptive.” 

Swiss Re, too, sees a balance between innovation and underwriting discipline as a cornerstone of its strategic future. And as one of the most technically advanced companies in the market, it believes it has the ability to do both. The company executives are hoping risk managers looking for better coverage at better prices in this tough economic climate will come to them with better information about their specific risks to help the underwriters placing the coverage. “We have the technology and expertise to take that information and use it to better understand and price the risks an individual company faces,” said Nikolaj Beck.

Of course, it may seem easier for giant, multi-billion-dollar insurance companies to find opportunities to increase their profile and market value in this current environment than it is for a solitary risk manager to raise organizational awareness about his discipline and get more authority. But those opportunities do exist. Risk managers need to find them and, more importantly, take advantage of them.

For those still struggling to be heard, Bob Petrelli of Swiss Re at least has a few words that may give some inspiration. “The boards of directors know who their risk managers are now.”

That may not sound overwhelmingly encouraging on the surface, but it’s a start.

Environmental awareness is something a number of the insurance industry’s major carriers and brokers have spent a lot of energy promoting, and with good cause, too. According to one broker I spoke with this afternoon, companies are finally seeing the immediate results of going green, in terms of lower operating costs and much-improved records on health and safety.

One area where this all really comes together is that of reconstruction. On any given year, insurers and their clients must work together to rebuild plenty of buildings that have suffered serious damage of some kind. With a strong environmental focus, the insurance partner can play a key role in making sure the rebuilding is also a re-greening, removing old asbestos, ensuring the new construction is more energy efficient, and so on.

This is a win-win for the insured and the insurer. The insured gets a much more cost-effective building, and the insurer wins because even if the rebuilding costs are a little higher than they would otherwise be, the re-greened building can provide a lower-risk environment on a number of environmental, safety and health fronts.

There are other areas, too, where the industry has staked its environmental claim, such as raising awareness on climate change and the subsequent risk that poses to coastal development. However, the industry still has a long way to go when it comes to presenting all of its ideas on using environmentalism as a competitive benefit with a single voice. The truth is, many insurers are still figuring out how much of the science they buy into, how much they want to sell to their clients, and how many of those clients really are in the market for it. It’s one thing to see a million people buy tickets to watch An Inconvenient Truth. It’s another to get a million insurance professionals to all agree with it.

Still, it’s not all bad.

As scattered as the industry’s views on environmentalism may be, the breadth of buy-in is really encouraging to anybody who wants to see the business world embrace environmentalism more meaningfully. And as environmental awareness becomes more mainstream everyday, perhaps the baseline awareness of lowering energy consumption, reducing waste and pollution, and shrinking carbon footprints may make a grand, united voice from insurers unnecessary after all. Perhaps, how each insurer views green business will be nothing more than one more characteristic to sell as one their own competitive strengths.

I think we could live with that.

Andy pointed to the fact that blogs, though most times useful to companies, pose a great risk because of user-generated content (UGC), privacy protection issues and data breach worries. Other issues to worry about when operating a company blog are:

• Defamation
• Unfavorable remarks
• Infringing material
• Potential disclosure of confidential information 

Chris pointed to the fact that every company using a blog should, at a minimum, monitor UGC (such as comments on the blog) and use tools like IceRocket and Google Alerts to keep up with what people are saying about your company on the internet. In fact, one of these devices helped alert a company to a bomb threat, the information for which was posted on the internet by the person in question. A man in the audience at this session shared with us the story of how Google Alerts helped notify his company of the impeding bomb threat. 

“Because of Google Alerts, we were able to apprehend this person within 24 hours of this serious threat being posted on the internet.”

Chris Sloan then pointed to the following legal considerations each company should consider if they choose to operate a blog associated with their business.

• Privacy and confidentiality
• Copyright and trademark infringement
• Data security and data breach laws
• Record retention and electronically stored information
• Submission guidelines and moderation 

“Whatever you do online, remember to protect your brand,” said Chris Sloan.

And protecting your brand can prove priceless, as Mark Flannery stated:

“Defaming comments on blogs can affect stock price and sales,” he said. “Financial risk is far more damaging and more far reaching than effects of defamation suits or data breaches.”

Dave Cocchiarella provided this forecast for the upcoming hurricane season as of April 7:

12 named storms
6 hurricanes
2 major hurricanes
54% probability of major landfall along U.S. coastline
32% east coast storms
31% gulf coast storms

Hercules Offshore pointed to the various business impacts such storms could have, such as:

Offshore — platforms, rigs vessels
Property — coastline, inland
Business income — direct, contingent, other
Production — coastal, inland, other losses

It was noted that as water temperature continues to increase, the next 10 to 20 years will see more hurricane activity, which brings the attention of risk managers to the topic of preparedness. Key questions every risk manager should consider are:

• Are you a 501(c)(3)?
• Are you aware of new federal insurance requirement regulations that could also impact your FEMA recovery?
• If a major business interruption occurs, are you going to pay your employees? For how long?
• Have you given additional thought to how you might prepare/respond to a loss during these times of economic downturn?
• Has the downturn impacted your suppliers? Your supply chain?

“When dealing with hurricane preparedness, business continuity management is absolutely crucial,” said Graeme Harper. “Make sure you get the right leadership and have backup for that leadership.”