Immediate Vault Immediate Access

Implications of Flood Risk

Across the vast geography of the United States, flood is no stranger to any of the states. From the March 2018 Nor’Easters that slammed the East Coast to the numerous storms and hurricanes that have swept across the country, both coastal and non-coastal regions are all at risk of flood.

FEMA reports that 98% of the U.S. counties have been impacted by a flooding event in the past, and 2016 and 2017 are examples of both the frequency and severity that the peril poses. According to Munich Re’s Geo Risks Research, there were more floods in the U.S. in 2016 than any year on record. Hurricane Harvey, the eighth named storm in the 2017 Atlantic hurricane season, caused large flood losses and is reported as the second costliest hurricane in U.S. history after Hurricane Katrina. Major losses from Katrina were caused by flooding due to levee failure.

The National Flood Insurance Program (NFIP) was enacted by Congress with three main pillars: affordable insurance, floodplain management and flood mapping.  Since its inception, the program has helped thousands of home owners with total claims exceeding $65 billion. The NFIP’s role in aiding homeowners was evident during the weeks and months following Hurricane Harvey. According to FEMA, as of January 2018, more than 91,000 NFIP policyholders had filed claims for Hurricane Harvey, and FEMA has paid more than $7.6 billion in losses to those policyholders. the economic losses of Hurricane Harvey, however, are likely to reach $85 billion. Even after considering the commercial insured losses, the gap between the insured and economic losses, known as the “protection gap,” is huge.

Based on events like Hurricane Harvey and Superstorm Sandy it is likely that as many as 80% of the homes in Houston were not insured for flood. In fact, according to the Insurance Information Institute, only about 12% of the home owners in the United States purchase flood insurance; this statistic is even lower in inland states. The number of NFIP policies in the Mississippi River states (which excludes Louisiana) is about 5% of the total NFIP program. Using current building stock data from Homes.com, this would make the purchase rate for flood insurance in the Mississippi states at less than 2%.

Why is there such a large protection gap and why is it important to narrow this gap?

A Floodzonedata.us study by the New York University (NYU) Furman Center found that there are about 6.9 million housing units within the 100-year flood plain as defined by FEMA. According to a February 2018 scientific study in IOPscience, however, “Estimates of present and future flood risk in the conterminous United States,” the actual number of exposed houses could be as high as 15.4 million. In addition, a September 2017 audit by the Department of Homeland Security Office of Inspector General noted that, as of December 2016, only 42% of FEMA’s flood maps are up to date and valid. Both Superstorm Sandy and Hurricane Harvey demonstrated several instances of FEMA maps being inadequate to evaluate the extent of flooding.

Extreme events like Harvey should be viewed as an opportunity for resilience initiatives.  Jeffrey Heberg, Chief Resilience Officer for New Orleans, notes that the key to resilience is insurability. In fact, studies highlight the importance of high insurance penetration and the correlation to strong resilient countries.

The stark contrast in the insurance penetration between Chile, Haiti and New Zealand provides an example of the impact the insurance industry can have towards financing the losses from major catastrophes. Following earthquakes in 2010, New Zealand and Chile showed faster recovery due to high insurance penetration and thus the ability to absorb losses, whereas Haiti went through a very slow recovery process due to the lack of catastrophe (re)insurance.

While insurance is an important factor, financial resilience through insurance is not enough. There is a further need for a comprehensive approach to mitigate severe natural catastrophes. This is when public private partnerships (P3s) play a crucial role. In New Zealand, the government-owned earthquake commission, with reinsurance in the global market, resulted in insurance penetration of up to 80%. A similar example of P3 in the United States is the reinsurance protection sought by FEMA to reinsure the NFIP against extreme events.

Public private partnerships rely on the government’s ability to ensure adequate loss prevention, build physically resilient structures and implement forward-looking municipal planning (such as futuristic view of flood maps and flood plain management). If people reside in and build more resilient structures, not only can it help save lives, but the cost of insurance could be less, and the probability of loss and recovery time will be less for communities.

It is not only important to focus on building resilient communities to help protect them from natural catastrophes, it is now becoming a crucial requirement for cities and states.  Standard & Poor’s emphasizes the importance of disaster insurance arrangements on sovereign financial resilience. The September 2015 Standard & Poor’s Rating Report notes that a lack of insurance coverage for significant catastrophic events could negatively impact sovereign ratings resulting in a downgrade. As recent as November 2017, Moody’s reported the incorporation of climate change into its credit ratings for state and local bonds. This would mean that communities, cities and states may get downgraded unless they show sufficient adaptation and loss mitigation strategies.

The time for resilience is now. As geographic regions that were once sparsely populated are now filled with burgeoning cities there is so much more at risk from today’s extreme weather events. Insurance can play a role in helping communities recover. Insurance alone, however, is only a partial solution. We also need to build resilient communities to help mitigate the damage caused by flood.

Building Resilience, City by City

Highline park

With escalating risks and uncertainty around the globe, cities are challenged with understanding and circumventing those risks to stay vital. Much as in the business world, municipalities are moving towards resilience—the capability to survive, adapt and grow no matter what types of stresses are experienced.

Recognizing that they have much to offer each other, communities and businesses are often working together to pool their experience and knowledge. Helping to foster this is a project called the 100 Resilient Cities Challenge, funded by the Rockefeller Foundation. The project has selected 100 cities around the world and provided funding for them to hire a chief resilience officer.

“Resilience is a study of complex systems,” said Charles Rath, president and CEO of Resilient Solutons 21. He spoke about resilience and his experiences with the 100 Resilient Cities Challenge at the recent forum, “Pathways to Resilience,” hosted by the American Security Project and Lloyd’s in Washington, D.C. “To me, resilience is a mechanism that allows us to look at our cities, communities, governments and businesses almost as living organisms—economic systems that are connected to social systems, that are connected to environmental systems and fiscal systems. One area we need to work on is understanding those connections and how these systems work.”Green space

Rath said that cities that have successfully implemented innovative resilient solutions have been able to “identify and communicate co-benefits. If you do some research around those jurisdictions that received funding, you’ll see interesting strategies that address their risks, but also have added economic, social and other co-benefits.”

Examples were evident after Hurricane Katrina and Superstorm Sandy. “Those communities that were able to bounce back quickest were those that had strong, socially cohesive societies. We also know that social cohesion drives economic activities in urban areas as well,” he said.

One of the first projects he worked on for the Resilient Cities Challenge was with the city of El Paso. “It is in the southwest and excessive heat is an issue they are dealing with,” he explained. “They have many parts of the city that see significant spikes in temperature, which leads to asthma, increased cooling costs and the list goes on. It’s projected over the next 70 or so years to increase 7 to 10 degrees, so it’s a big problem.”

To address the issue, he researched the issue and met with El Paso’s city manager. “We were able to pinpoint all of the different areas in El Paso where there is heat island effect,” he said. “We could tell what degree it was and roughly what was causing it.”

Causes for the escalating heat proved to be a lack of reflectivity, impermeable surfaces and lack of green space. “But it was at the point where we told him that he was costing the city about $150 million a year in increased cooling costs—because we were able to isolate the building outlines in the downtown area—that he began to pay attention,” he said. “Then we also showed him areas of the city where there was increased heat island effect where there was a significant amount of concrete. There were also a large percentage of children in the area who didn’t have access to parks.”

A solution for both dilemmas could be achieved by “transforming those vacant lots to pocket parks so that kids could have access to playgrounds.” he said, adding, “Those types of solutions with multiple co-benefits are an important element of what we are doing and this encouraged us to explore that.”

Overcoming ‘Balkanization’ of Business Continuity Planning

Fragmentation

To be sustainable, organizations must prepare for crises that occur or risks that crystalize. General responses to those threats include alternative office sites, IT back-ups and communication protocols. As reality demonstrates over and over, it is critically important to have a strong leader in a crisis situation, be it the captain of a ship in a storm, the commanding officer of a platoon under fire or the CEO of a company in turmoil. A cacophony of contradicting orders or disintegration in the line of command is the surest way to increase a disaster’s impact and the time needed to recover.

Instead of creating a strong BCP landscape with clear lines of command and control, however, we more often see “balkanization,” or fragmentation of responsibilities. Business continuity planning, environmental health and safety, operational risk and IT disaster recovery are different teams with overlapping roles and responsibilities for crisis management.

The newest buzzword is resilience, which is discussed in a growing number of articles and lectures and defined as the “ability to bounce back to a normal operating status after a state of crisis.” There are also a number of overlapping areas with the aforementioned functions—and that is just on an intra-company level. The OECD has issued Guidelines for Resilience System Analysis, urging member states to set up resilience management on a country level basis.

Recent private initiatives like the 100 Resilient Cities (100RC) by the Rockefeller Foundation brings resilience management to an urban level. So if a natural disaster hits a major city, thousands of firms, and the city itself, will invoke a patchwork of crisis plans. For a larger disaster, there might also be a national crisis plan. Are there clear lines of command, however? Is everybody aware of what to do? We doubt it.

Modern BCP management does not need more specialization and buzzwords, but coordination of the different functions and initiatives to provide a clear, consistent and timely response. One of the most pressing tasks is establishing a common risk language to ensure that all stakeholders involved in the process have the same understanding. For example: While the 100RC initiative is coining the term CRO for chief resilience officer, the acronym is also widely used as an abbreviation for chief risk officer. So while talking about roles and responsibilities of a CRO, everyone involved should have a clear understanding about which CRO is meant.

100RC also looks at urban resilience in terms of surviving and thriving, regardless of the challenges—be they acute shocks (such as severe weather or earthquakes) or chronic stress (long term unemployment and violent crime)—and it seeks a much wider remit than the traditional concept of resilience as “the ability to bounce back from an event.”

The response is to call for a more coordinated approach working across multiple stakeholders through the chief resilience officer who, according to Michael Berkowitz (President of 100RC) “needs to build connections across not just various departments of municipal government, but across an entire ecosystem of people and places.” This is welcomed, since it is both forward looking and holistic in its approach to solving some of the world’s major issues in the next 20 years. Given that most entities are no longer stand-alone enterprises, but part of an increasing global network of customers, suppliers, regulators and other stakeholders, disaster recovery cannot be handled effectively by an individual member of that network. Instead, the entire group needs to collaborate to create an effective disaster recovery program. A central CRO who coordinates the needs of the various parts of the network seems to be the best way.

While we see this forward looking risk management approach to resilience as a welcome development, it does further complicate interaction between resilience and BCP by muddying command and control and introducing the potential for more stakeholders into an already complex chain. What is required for this to work is very clear planning and, one could argue, the ability for external (such as municipal) CROs to assume command of enterprises under his or her jurisdiction.

As of now, in most jurisdictions it is the responsibility of the CEO and the board to determine and define risk capacity and risk appetite. This leaves little room for outsourcing BCP or resilience planning. The key question, then, is whether a change in mindset and approach is required to enable the development of network-wide recovery solutions, thus overcoming the balkanization of BCP.