Dealing with disaster: how to make sure your business is prepared for the worst

“Human activities… have unequivocally caused global warming.” This was one of the key findings in the Intergovernmental Panel on Climate Change’s (IPCC) latest report.

It continued: “Human-caused climate change is already affecting many weather and climate extremes in every region across the globe. This has led to widespread adverse impacts and related losses, and damages to nature and people”.

The body points to heatwaves, heavy precipitation, droughts and tropical cyclones as examples of nat cats that have become more frequent and/or severe, most likely as a consequence of human-caused climate change.

John Scott, head of sustainability risk for Zurich, says: “Most climate scientists agree that over time, climate change will exacerbate chaotic severe weather events.

“Tropical storms will likely become more impactful, with higher wind speeds, greater aerial extent and changes to their typical paths, and can become extra tropical storms or rainstorm flooding events when they eventually hit land.

“There is evidence that the changing climate is influencing the behaviour of the jet stream, which has the effect of localising weather systems for weeks at a time, causing prolonged rainfall, drought, frost or heat.”

For the first time, businesses are more concerned about extreme weather affecting operations in 2030 than they are about cyber attacks.

George Tselioudis, a research scientist at Columbia University, adds: “If we are creating an atmosphere more loaded with humidity, any storm that does develop has greater potential to develop into an intense storm.”

The IPCC report stresses that human influence has also increased the chance of compound events, with concurrent and repeated climate hazards creating ever-growing risks to health, ecosystems, infrastructure, livelihoods and food supply.

For businesses, these changes mean that the likelihood of disruption due to a natural catastrophe or extreme weather event is growing significantly. And the impact on operations may be increasingly severe.

Organisations are waking up to this reality. A Healix-sponsored survey of 500 risk managers, senior security managers, and travel risk managers at mid-sized organisations across multiple industries found that for the first time, businesses are more concerned about extreme weather affecting operations in 2030 than they are about cyber attacks.

THE PROBLEM WITH INSURANCE

The scale of the crisis means it can be hard to know where to start. As a result, experts fear that too many businesses are trying to use insurance as a catch-all solution, when mitigation and preparation should be the first port of call.

There are several problems with the insurance-only approach to these risks, including – but not limited to – lack of capacity, high premiums, too much focus on facilities and property losses, and an inability to halt business interruption.

Regional risk manager at Cummins, China, and PARIMA board member Maggie Sun says: “From a coverage perspective, we observe it is quite challenging to negotiate favourable terms or rates given the loss history and pressure from the reinsurance market.

“Insurance is one of the most important parts [of managing cat risk], but a proper self-risk mitigation is necessary given businesses want to find a balance between insurance cost and mitigation investment.”

There are frequent issues around unavailability of cover, significant limitations in cover, and concerns around future availability of insurance.

Jan P. Mumenthaler, regional insurance lead Asia -  insurance services group at the International Finance Corporation and PARIMA Board Member, says that in addition to the increased cost of property insurance, there are frequent issues around unavailability of cover, significant limitations in cover, and concerns around future availability of insurance.

These difficulties have already led to an alarming protection gap. Data from the Swiss Re Institute found that insured losses have grown by 5-7% per annum over the past 30 years.

In 2022, total economic losses were $275bn, with insurance contributing $125bn in claims support. The remaining losses of $150bn were not protected.

According to Swiss Re, this gap will continue growing, driven by factors including the increasing frequency of climate-related natural catastrophe events and wealth accumulation in risk-prone areas, such as near the coast or wild forests.

BUILDING RESILIENCE

However, businesses need not despair, as risk managers emphasise that dealing with disaster effectively means starting with mitigation and business continuity 􀈔 not insurance. By minimising 

the risks you face, the level of insurance required decreases, which may ease the pressures on the market and make appropriate cover easier to find.

Angela Iannetta, chair of Airmic and group head of risk & insurance at British American Tobacco, says that organisations should first seek to understand the exposures facing their facilities and suppliers.

Next, she says they must determine how these risks might change under various climate change scenarios.

Finally, they must calculate the likelihood of these events happening and their expected outcome - after the application of mitigation activities.

“The approach to risk management should be data driven and risk based”

At British American Tobacco, the exposures are captured through the enterprise risk management framework, the outcome of which is on the board agenda.

She says: “The approach to risk management should be data driven and risk based. Prioritisation of the risk management activities should take into account the outcome of the exposure, likelihood and outcome analysis, so that internal activities can be prioritised to manage expected events that will have the largest impact on the organisation.”

Amar Rahman, Zurich Resilience Solutions’ global head of sustainability & climate solutions, says that at Zurich risks are defined across three dimensions: hazard, exposure and controls.

He explains: “People usually focus on the hazard: there’s more rain, more wind, more heat. But we develop models and scenarios to help them understand their exposure to those hazards, to identify their vulnerabilities or pain points.

“Finally, we assess the controls: what can you do to reduce and manage the impact of climate change right now? Climate resilience is about managing those three factors with the tools we have, and not waiting for new data or government regulation before you act. Because if you wait, it will be too late.”

“We pay great attention to business continuity plan (BCP) simulations, and arrange BCP exercises”

Sun says that the changing nat cat landscape has a significant impact on Cummins, and the firm is taking several steps to plan for – and minimise – the threats.

From an operational perspective, this means running weather risk reports on potential new site locations before making any decisions.

“We pay great attention to business continuity plan (BCP) simulations, and arrange BCP exercises by engaging the leadership team and employees on a regular basis.

“In general, we leverage our risk engineering vendors’ expertise to provide risk mitigation solutions to the business. We have also explored automation tools to set up risk alerts.”

The company also has its own captive, which Sun says plays an important role by smoothing out insurance costs and providing support on risk mitigation initiatives.

“Internal thresholds and triggers should be developed to dictate when staff or assets are facing elevated levels of risk”

Healix risk intelligence manager Andrew Devereux points to crisis management plans, communication strategies, and education as key pillars of any successful natural hazard mitigation strategy.

He says: “There are numerous approaches that are important for organisations to implement to tackle the risk of natural catastrophes. The first are actionable, tested and realistic crisis management plans. If plans have not been tested, then their implementation can often be chaotic and unstructured.

“It is also vital that these plans are communicated to all stakeholders, so each member of the team knows their individual roles and responsibilities.

“Education on natural disaster risks can be important; educating employees on locations with elevated risks and individual mitigation measures to take.

“Internal thresholds and triggers should be developed to dictate when staff or assets are facing elevated levels of risk and the mitigation measures that are activated when a certain threshold has been met.”

THE FINAL STEP

Despite the problems with an insurance-first strategy, risk managers are keen the emphasise the importance of transfer solutions for those risks that cannot be minimised, mitigated or accepted on the balance sheet.

Mumenthaler says: “[Insurance is] very significant when it comes to our client-financing operations. All transactions have broad insurance requirements and some of those are impacted by climate change.

“[Organisations must] enhance resilience in their operations and ensure that proper consideration is paid to the effects of climate change in order to ensure continued bankability; without insurance there will in all likelihood be no financing.”

“The organisation’s risk appetite will play a significant role in determining what an organisation should retain versus what they should transfer.”

Iannetta adds: “Overall, risk management should combine elements of internal management via processes such as BCPs and risk engineering, with risk transfer to the insurance and reinsurance markets.

“These markets are able to offer appropriately priced meaningful capacity and utilisation of non-traditional insurance approaches to the extent that they are commercially viable.

“The organisation’s risk appetite will play a significant role in determining what an organisation should retain versus what they should transfer. As a last resort if an organisation believes that the nat cat risks of operating in a particular location are too great, then it should consider cessation of operations in that location.”