Perspective on financial terrorism and insurance

The HSBC Group has thousands of premises spread across the globe from branches and back-offices to high profile headquarters buildings in London and Hong Kong, in particular.

Its insurance requirements are, therefore, significant. For an organisation such as the HSBC Group, terrorism in some countries is primarily a threat to property and its ability to recover normal operations, quickly. The purchasing of terrorism cover is, of course, only part of HSBC’s response to the terrorist threat; very significant effort also is put into disaster recovery planning, including the provision of back-up offices and IT systems.

HSBC buys global group cover for its financial institutions exposures, that is, crime, directors’ and officers’ liability, and professional indemnity. The task of insuring property and the increased cost of working, including against loss caused by terrorism, is delegated to the relevant local HSBC Group operation. The executive discretion of local offices is not unfettered however; head office in London sets down general guidelines to its subsidiaries specifying the broad requirements of the cover they should purchase and also specifying which security is approved.

Furthermore, local offices are not allowed to buy cover that is already provided by any group cover, but may on occasion be allowed to buy cover within the deductible subject to approval from London. Naturally, the local offices are encouraged to use the group captive insurer wherever it makes sense to do so. Should local offices wish to purchase cover outside the general guidelines, then they need approval from London.

In this fashion, the group insurance risk department has a broad perspective on all of theinsurance requirements of the HSBC Group’s worldwide operations but is not involved in micro-management of local insurance needs, including the property portfolio. Being at the apex of the organisation enables head office to monitor the quality of security, rates and types of cover available around the world.

It is essentially up to HSBC’s local operations to undertake local risk assessment on whether or not to purchase terrorism cover and if so, on what terms and at what price. The availability and format of cover varies from jurisdiction to jurisdiction. The choice of cover is largely left to local offices that are empowered to exercise their own discretion to obtain adequate cover at a reasonable price. There is no overarching stipulation from head office requiring that particular formats of cover should be purchased. This would in any case be impracticable given the patchwork of wordings, pools and state-sponsored regimes in existence around the world. Local offices will, however, liaise with head office to seek approval or to discuss matters such as rating and any other concerns they may have.

Local offices will liaise with the expertise of head office in undertaking a risk assessment of the threat posed by terrorists. Such risk assessments are based fundamentally upon the application of informed common sense, addressing straightforward issues such as:

• The local and regional political situation.

• The profile of the building (naturally, large headquarters buildings are more attractive to terrorists than smaller or anonymous ones).

• Where appropriate, a full technical analysis considering fire precautions, structural safety and likely responses in case of explosions. Head office has its own specialist engineers and security consultants who will advise where necessary.

HSBC’s decision as to whether or not to buy terrorism insurance is a matter of judgement, balancing the factors of price on the one hand and threat, judged from a common-sense point of view, on the other hand. That is to say that HSBC is not generally reliant upon complicated computer models when making decisions with regard to terrorism cover.

The extent of cover available varies considerably from jurisdiction to jurisdiction. While, naturally, HSBC would give consideration to the scope of cover available and the price demanded, it does not believe that demanding a form of global uniform cover is either economically necessary or even possible. Wherever in the world HSBC may be exposed to terrorism risk, if the price is not right, we would not buy this type of cover.

As one of the world’s largest businesses, HSBC is content to maintain substantial deductibles, including in relation to exposure to terrorism risk. Local operations are, therefore, discouraged from purchasing terrorism cover, or indeed other types of cover, at low levels unless they can justify to head office a pressing need to do so. The global insurance risk management team based in London also has direct responsibility for handling HSBC’s approach to terrorism insurance for the group’s UK operations.

Accumulation control

Accumulation of risk is, of course, a problem for any large insured. Our move, from multiple premises around the City of London, belonging to us and the former Midland Bank, to a £1 billion tower block in Canary Wharf with 8,500 staff, did, of course, present a major accumulation issue from the point of view of risk management. Notwithstanding, HSBC made a pre September 11 judgement that the benefits of relocating to new premises far outweighed the insurance burdens posed by increased accumulation.

From a pure insurance risk management point of view, HSBC’s previous use of main offices throughout the City of London posed significantly less accumulation risk. For example, HSBC suffered very considerable damage to its major property at 99 Bishopsgate in the 1993 IRA bomb attack in the City of London, but its 12 other major premises remained unscathed. Moreover, staff could be relocated from 99 Bishopsgate to spare space in the other premises with relative ease.

Loss minimisation

In planning its new worldwide head office premises in London, HSBC consulted with insurers and its own insurance risk department. This department influenced the design and construction of the building from a very early stage; consequently, the building contains many features designed to resist most types of terrorist attack.

Business recovery is very much at the heart of the HSBC Group’s terrorism response strategy, and contingency planning constitutes a very significant investment. Indeed, at least in so far as UK operations are concerned, HSBC has adjudged that loss of profits, and/or business interruption cover for terrorism losses is, in general terms, not cost effective, and the potential premium expenditure is better applied to disaster recovery planning. However, increased cost of working insurance is important to the group.

As one would expect the details of recovery planning remain confidential, however, HSBC invests significantly in planning the recovery of core operations, up to and including the maintenance of hot-site offices and IT systems. The group adopts a graduated approach to disaster recovery, recognising that it would be impossible to relocate the entire staff from a core building within 24 hours of a major terrorist attack. Instead, contingency plans are designed to ensure that the most critical, for example 5%, of the workforce can be at work the next day, 50% within a few days thereafter and the remaining staff within two to three weeks of a major attack.

Lessons from the Bishopsgate attack

HSBC together with other major commercial insureds felt badly let down by the withdrawal of commercially available UK terrorism cover in the early 1990s, which precipitated the creation of Pool Re. They felt it was an unnecessary and shortsighted knee-jerk reaction, which could have jeopardised the future of many businesses had there been losses before the creation of Pool Re. The proof that terrorism is an insurable risk can be seen in the success of Pool Re itself.

Despite certain misgivings as to the appropriateness of routine state involvement in the provision of insurance, the creation of Pool Re has been a success; it provides standardised, simple, and acceptable cover at reasonable prices from the point of view of most UK businesses.

The following are suggestions for risk managers who are considering their organisation’s approach to terrorism.

• Do not put all of your eggs in one basket if possible. Concentrating essential resources and staff in very large premises poses obvious problems from both the accumulation of property loss point of view and business recovery. ‘Do as I say, not as I do!’

• Have a thorough business recovery plan. HSBC invests significantly in backup office premises and IT systems, as should any comparably sized organisation.

• Have a good relationship with your insurers and loss adjusters. Pre-event contact with loss adjusters is essential and this relationship in fact paid dividends after the 99 Bishopsgate bomb attack. Whenever possible, have named expert adjusters in policies to deal with terrorism losses.

• Responding to a major loss needs a senior, but small, core executive team with full authority to make quick decisions in the short term and thereafter to continue dealing with matters related to the loss until they are eventually finalised, which could be several years. Immediately following a loss, decisions need to be made and money spent. The priority is to get matters moving rather than wasting time debating particular items of expenditure.

An ideal core team would involve:

• A finance officer or a director empowered to authorise significant spending without further referral.

• A risk manager to primarily liaise with insurers.

• An IT/business recovery specialist.

• A building facilities manager. In any event, a very senior director should chair or be involved in the team to lend it sufficient authority to take decisions and overcome institutional inertia. From time to time, it will be necessary to co-opt others into the team.

Following the 99 Bishopsgate attack, legal advice was often needed in connection with, for example, the reinstatement requirements under leases and relationships with landlords and other property owners. Similar advice may be needed if coverage issues arise.