June 1, 2004
While awareness of a rising threat of terrorism has put risk and security firmly on the board agenda, spending on security remains low. A report last year from the Conference Board, the international not-for-profit applied research organisation, found an average increase in security spending of just 4 per cent since September 2001. However, insurers and security consultants point out that blanket spending is not necessarily the only way for companies to address the risk.
If you are a biscuit manufacturer in the English rural county of Dorset, for example, heavy expenditure on counter-terrorism and security measures makes little sense. But a large US business headquartered on New York's Avenue of the Americas should view the risk differently and act accordingly.
Yossi Sheffi, professor and head of MIT's Centre for Transportation Studies, says risk assessment can be viewed on a two-by-two matrix, with the probability of an attack on the vertical axis and the company's resilience and how quickly it can recover on the horizontal.
US airlines would be on the high end of both axes of the chart. "They are at a high probability of being attacked and if the airplane goes down due to, say, a missile, my guess is that the company goes out of business," says Prof Sheffi, who is part of MIT's Supply Chain Response to Terrorism team, which studies the impact of terrorism on global supply chains.
McDonald's has a high probability of attack, he says, because of the visibility of its brand. But because it has thousands of outlets worldwide, attacks on individual restaurants would not put the company out of business. An unbranded manufacturer of fashion goods, on the other hand, might have a low probability of attack but if it has a single distribution centre, an attack on that facility might disrupt business for a considerable period of time.
At the low end of both axes, explains Prof Sheffi, would be a company such as Ace, the US hardware supplier. "No one would want to attack them, they have tens of thousands of outlets and they are all locally operated," he says. "So it's the probability of something happening to you, set against your resilience and the ability to recover."
A company can use the same framework to identify and prioritise a range of threats. It might, for instance, assess the chance of a port closing because of a terrorist incident as high but if it can re-route its shipments the consequences will not be severe. On the other hand, the closure of an entire set of ports is less likely but - as demonstrated by the 2002 US West Coast strike - its consequences are far more serious.
When it comes to assessing impact loss of assets is not the only consideration. Paul Bassett, executive director in Aon's counter-terrorism political risk division, sees an important part of risk assessment as the ability to recover - and to be seen to as a "recoverer", rather than a "non-recoverer".
"A company with a robust balance sheet might survive a $100m loss," he says. "But if you talk in terms of losing 25 per cent of share value because they didn't, and weren't perceived to, act well post-crisis, that would be of far more concern than the £100m loss."
When it comes to mitigating such threats, insurance is clearly part of the equation. And the difficulties of accessing and affording terrorism insurance have eased considerably since 2001. "Immediately after 9/11, there was limited capacity and only Lloyds could give one client $50m of cover," says Stephen Ashwell, terrorism underwriter for Hiscox, the London-based specialist insurer.
Since then capacity has grown significantly and cover is more affordable. "The market has responded reasonably well - there are a few more entrants coming into the market, capacity will grow and clients will get the benefits of that," Mr Ashwell says. "You can now probably buy $1bn of cover for any one client."
However, he points out that companies should be addressing a range of issues as well as buying insurance. "Insurance is really the last bit of the food chain," he says. Measures include simple precautions such as installing closed-circuit television cameras and anti-vehicle protection devices. Large bollards outside a building, for example, can stop a vehicle being driven into it. Another sensible idea is to move the postroom - which may be located in a company's main building, making it highly vulnerable to parcel bombs or packages of anthrax - to an off-site location.
Mr Basset talks of the "!displacement effect". Terrorist groups, he points out, look at the potential success of any attack. "If there are two similar buildings, they'll go for the target that affords the greatest chance of success - so if you start as a harder target you're less likely to suffer an attack."
But he believes that such risk mitigation procedures are part of an overall strategy that balances risk management with insurance. By understanding their risk companies can save considerable sums of money by retaining some of the risk and insuring the rest.
"We look at how best to transfer risk to the insurance market and manage the risk," he says. "There has to be a combination of the two because no insurance policy is going to save an employee's life - only risk management techniques would do that - and some of these risks aren't insurable. So only risk management can reduce them."