Since the first PC virus was set loose inthe mid-1980s by two brothers inLahore — reportedly to deter piracy ofsoftware they had written — technologyusers have discovered that the con-nected world delivers risks as well asbenefits.

Less well understood are the growingcyber threats to physical assets, as theonlineworldmergeswiththerealone.

The internet of things — the networkof physical objects embedded with elec-tronics, software, sensors and connec-tivity — allows domestic appliances tobe controlled automatically or produc-tion lines tobemanagedremotely.

But it also creates the possibility ofcyber kinetic attacks — opportunitiesfor hackers to target anything fromfridges and factories, traffic lights orwater treatmentplants.

In industries such as oil and gas, forexample, the ability to monitor andalter well pressure, temperature andflow extraction rates remotely offersopportunities to streamline operationsand maximise production and profita-bility. But these networked systems alsocreateareasofvulnerability.

Attheendof lastyear,Germany’sFed-eral Office for Information Securityrevealed that hackers had managed toaccess the control systems at anunnamed steel mill in the country, pre-venting a blast furnace from shuttingdown properly and causing “massive” —thoughunspecified—damage.

The attackers had gained accessthrough the plant’s business network,using a “spear-phishing” email — a tar-geted email that appears to come from atrusted source but contains a malwareattachment or link to a malicious web-site. Once a foothold had been estab-lished on the corporate system, thehackers were able to explore the com-pany’s networks, before causing dam-agevia theproductionnetwork.

Dr Larry Ponemon of Ponemon Insti-tute, a US security research centre, esti-mates that: “Approximately 15 per cent

of attacks that penetrate corporate net-works or enterprise systems damage ordestroy physical equipment such asservers, storage devices, routers andother ITdevices.”

Atif Kureishy, a principal from BoozAllen Hamilton’s technology and ana-lytics practice in the Middle East, notesthat: “Reporting of a cyber securitybreach can have massive legal, financialand reputational implications on a busi-ness, and many will think twice beforegoingpubliconanincident.”

For hackers, the task of finding inter-faces to domestic, business and indus-trial systems has become easier, thanks

to search engines such as Shodan thatscour the web for internet-connecteddevices, from heating systems and geo-thermal energy plants to building con-trol systemsandmanufacturingplants.

Dr Ponemon says: “The perpetratorsof cyber attacks vary from single indi-viduals and lone wolf attackers toorganised criminal enterprises. Some ofthe more sophisticated attackers

are sponsored by nation states.”According to a Ponemon Institute/

Unisys survey of almost 600 IT securityexecutives in 13 countries from the util-ity, oil and gas, alternative energy andmanufacturing sectors, only 17 per centof respondents thought their companyhadamature levelofcybersecurity.

Mr Kureishy says organisations mustaccept that the traditional perimeterapproach to cyber security is no longerenough. “Organisations must adopt adefence-in-depth model that has secu-rity in layers, protecting their most val-uable assets and deploying intrusion,detection and monitoring systems tomanage incoming information.”

What puts many networked physicalassets most at risk of cyber attack is thatthey are running on old software. Yetaccording to the Ponemon Institute/Unisys study, 54 per cent of companiesare not confident they could upgradelegacy systems cost-effectively “withoutsacrificingmission-critical security”.

Appropriate risk cover is anotherform of defence, although the cyberinsurance market is still in its infancy.Some 98 per cent of large UK companieslack insurance that could help themrecover from a serious cyber attack,claimed a report this year by the UKCabinet Office, even though 81 per centadmitted to suffering a security breachintheprevious12months.

Brit Insurance, a specialty insurer,and Coalfire, a corporate governanceauditor, have launched cyber attackinsurance cover for first-party propertydamage, business interruption, the costof restoring digital assets and reim-bursement for resultant businessincome losses. The product also offerscomprehensive cyber security riskassessmentandlossmitigation.

According to Russell Kennedy, under-writer at Brit, there should be a greatersharing of experience and informationabout physical losses through cyberattacks, particularly as many compa-niesusesimilarcontrol systems.

“There’s a reluctance . . . to discussthe losses being incurred, so little infor-mation is being shared,” he says. “It’ssimilar to the situation three or fouryears ago with regard to data and pri-vacy losses, when companies such aseBay, Target and Amazon were beinghacked,but theywouldn’t talkabout it.

“Now that they have insurance inplace, they’re more willing to discussandshare information.”

Danger in the digital age: theinternet of vulnerable thingsTechnology

Cyber security breachesin an increasingly connectedworld could be catastrophicfor infrastructure, warnsIan Wylie

Hackers gained access to controlsystems at a German steel mill

‘The perpetrators of attacksvary from the lonewolf toorganised criminals . . .sponsored by nation states’

Inside

California prepares forthe next ‘big one’The chance of amega quake is higherthan previously thoughtPage 4

Japan gets tough withbuilding standardsRegulations are beingtightened to improveresistance to shocksPage 4

Race to outwitthe terroristsDevelopers are adaptingsecurity measures toprotect buildingsPage 2

Rising waters continueto exact a heavy tollFloods take more livesthan earthquakes,tsunamis or tornadoesPage 2

InterviewWendy PetersThe pioneeringexecutive is responsibleforterrorismpracticeatWillis,theinsurerPage 2

V ideos produced by theInsurance Institute forBusiness & Home Safety —in which simulated torna-does and hurricanes tear

off rooftops and force structures to col-lapse — make it easy to understand whyclimate change might prompt insurancecompanies to rethink their exposure topropertyrisk.

Yet, in response to the increased fre-quency and severity of storms andfloods, insurers can do more than sim-plyraise theirpremiums.

The storms that appear in the US-based IBHS videos were generated usinggiant fans and massive tanks of water.But recent years have produced plentyof hard evidence of the damage that can

be wreaked on property by actualstorms, from severe flooding in Bang-kok in 2011 to Hurricane Sandy in NewYorkandNewJersey in2012.

And these events are costly. The Thaifloods led to $47bn in economic losses,according to Swiss Re, the global rein-surer, while Hurricane Sandy caused$68bn of damage across the eastern sea-board of the US, destroying more than300,000homes.

Emerging markets are particularly atrisk, since they are urbanising rapidly —often in the absence of the buildingcodes needed to ensure that develop-mentscanwithstandstormsandfloods.

Moreover, in many cases, the insur-ance sector is less well developed inthesecountries thaninmaturemarkets.

Whether in emerging or mature mar-kets, metropolitan areas are oftenlocated near coasts, which means thatthreats are a central concern for insur-ers. And as the value of city real estateincreases, sodothepotential losses.

For insurers, the challenge is not onlyto price into their risk models thegreater frequency and severity ofstorms, but also to take account of thechanging value of assets located inexposedareas.

The relative vulnerability of realestate fabric is another considerationfor insurers. This includes the ageof infrastructure. For example, climate-resilient measures — such aswater-resistant construction materials— are more often present in new

developments than in older structures.However, while new buildings may be

able to withstand windstorms and tor-nadoes more effectively, newer struc-tures can be less resilient when it comesto flooding, since far more infrastruc-ture — from heating and electricity sys-tems to computer servers — is nowplacedunderground.

Tim Bunt is global head of risk man-agement at CBRE, the property servicescompany, and points to HurricaneSandy as an example. “The wind dam-age was one thing,” he says. “But withthe flooding, a number of high-valueassets were impacted not just for weeksbutmonths.”

In addition to climate change, a rangeof other factors must inform pricing

Industrymust adjustto climatechange lossSharing data is vital for countering extremeweather events, reports SarahMurray Sunset over the City of London: many urban areas are vulnerable to extreme weather —Dreamstime

models, says Andreas Schraft, head ofcatastropheperilsatSwissRe.

“It’s not just climate change. Severaldevelopments are leading to increasedexposure and claims,” he says. “We needto know those risks, so we can chargetherightprice.”

Sophisticated weather modellingtechnologies can help. “What the insur-ers now have is big data,” says Mr Bunt.“And their models are giving them bet-ter insight, not only as to how to pricetheirriskbutalsowheretotakerisk.”

This can lead some insurers to alterthe geographic emphasis of their riskportfolio.

CynthiaMcHale,directorof the insur-ance programme at Ceres, a US-based

continuedonpage3

Risk Management PropertyFT SPECIAL REPORT

www.ft.com/reports | @ftreportsMonday April 27 2015

2 ★ FINANCIAL TIMES Monday 27 April 2015

Risk Management Property

W endyPeters isanexecutivevice-presidentatWillis, theinsurer,andisresponsible for its

terrorismpractice.Overthepastdecade, shehasbeenoneof thepioneersintheterrorisminsurance industry,andplayedanimportantrole inthebattle topersuadetheUSCongress torenewitsbackstopfor terrorismdamage, theTerrorismRiskInsuranceAct(TRIA).

How did you enter the insuranceindustry?ImajoredinforeignaffairsandIalwaysknewIwantedtodosomething inthatarea.Theattraction[to insurance]waspolitical risk insurance,whichmeansinsuringcompanies’ investments inpoliticallycontentiousanddangerousplacesagainstriskofconfiscationbygovernment,currency issuesandsoon.Youseetheglobalhotspotsandhowcompaniesoperatearoundtheworld.

Terrorism insurance is rather esoteric.What brought you into it?Itgoesbackto9/11.Terrorismasaninsurancespecialitywasnot identifiedthenasanindividualcover. Itwasincludedwithinpolitical risk insurance.Insurancemarketswerenotpreparedfor9/11andthetypeofcatastrophic lossthatcouldoccur.

What were the first issues you dealtwith in the job?Insurershadnowaytomodel terrorism,oranticipateattacks—unlikenaturalcatastropheswherethereare frequencymodels.Sothe[US]marketdecidedtodropout[of terrorisminsurance].Insurancemarketssaid: ‘Wecan’tpricethis’. It’san interesting fieldtobe in,becausethenetworksof terrorattackchangeall thetime.

But there had been terrorist attacks onbuildings before. The City of London

was bombed in the 1990s by the IRA.ThatwasthegenesisofPoolRe, theUKterrorismpool.UKinsurerswerereluctant to insure,becausetherewasnowayofpredictingtherisk, sothegovernmentofferedabackstopforinsurersandithasbecomeverylucrative, the[insurance]poolshavedoneverywell.

IntheUS,wheninsurersdroppedout,in2002, thegovernmentpassedTRIAwhichprovidedabackstopandwasfree,unlikePoolRe, towhich insurershadtocontribute.GenerallyTRIAhasbeenaneasy-to-access,affordableprogrammeforthe insurancemarket,withthegovernmentultimatelyonthehook.

What has happened since?TRIAwasrenewedin2005and2007andaddedcontributionsthatgaveinsurersabitmorefinancialexposure.Since itwaspassed,wehavehadonlyonebig terroristattack,ontheBostonMarathon,andthegovernmentdidnotcertify thatasaterroristeventunderTRIA,whichwassurprising. [Ifaggregatedpropertyandcasualityinsurance losses, resulting fromtheactdonotexceed$5mtheevent isnotcertifiedasterrorismunderTRIA].

Alotofcompanies thatwereaffectedbyithadn’tbought terrorisminsurance.As itwasn’tclassifiedasaterroristattacktheycouldclaimundertheirpropertyandpersonalaccidentpolicies.

Late last year, the outgoing Congressunexpectedly refused to renew TRIAand the insurance cover expired,leaving some of the world’s biggestbuildings uninsured against terrorism.You lobbied for its renewal. What werethe risk management implications forproperty owners?It createdamazingchaosoverChristmas.Mostmajorproperties intheUSwent intosomeformofdefault [ontheirborrowings],with lendersthreateningtodoaforcedplacement—

insuringthebuildingthemselvesandrequiringthepropertyownertopaythepremium.Theinsurancemarketwasgoingcrazy.

What was the impact on propertyowners? Was the problem resolved?ThenewCongresscameinJanuaryandgot theextensiontothefloor,anditwaspassed. Inthemeantime,someinsurancecompanieshadimposedminimumpremiumlengths, soownershadtobuycover forsixmonthsorayear,atat least twoorthreetimesthenormalannualpremium, insomecasesconsiderablymore.

Insurers immediatelysettledbackintothestatusquo.Thenext timethisissuecomesaroundis in2020,althoughthenewlegislationsaidthatCongresswouldreviewitmidtermandsee if itmakesmoresensetorestructure it.

What terrorist threats do we face?There isa lotof focusoncyberattacksandhackers, forexampleonutilitiesandpowergenerationfacilities.TheUSinfiltratedIran’snuclearpowerplant—

that’s thekindofscenariowearelookingatmoreandmore.

How do you deal with threats like that?We’retryingtobea lotmoreanalyticalinourapproach.Wedevelopmodels, forexampleblastmodelsshowingprobablemaximumloss forvarioustypesofblast[inabuilding]. Ithelpsbuildingownersandinvestors tounderstandwhattheirvulnerabilitiesare.

Therearea lotofscenarios inwhich itisalmost impossible totakedownabuilding.ForexamplethenewWorldTradeCenter towershaveamongthehighestconstructionstandardsanywhere intheworld.Weareseeingalotof innovation inbuildingdesign.

Is it hard to hire people with the tech,finance and political skills you need?Cybersecurity is theoneproduct linethat isgrowingrapidly . . . Thereareveryfewspecialists inthefield. Icounselledmyson-in-law:“Ifyou’regoingtoget intoanything,get intocyberbecause it’s suchabig fieldandgrowingsoquickly”.

Vital to keep acool head and asteady nerve ina dicey businessInterviewWendy Peters is a pioneer in theterrorism insurance industry, writesKate Allen

Recent terrorist attacks have left a glo-bal trail of injury, death and destruction— damaging office buildings and shop-ping centres. Such actions underline theneed for property owners and their ten-ants to adapt security precautions andreviewfinancialmeasuressuchas insur-ance.

There were almost 10,000 terroristattacks worldwide in 2013, resulting innearly 18,000 deaths, according to thelatest Global Terrorism Index report.The report, produced by the Institutefor Economics and Peace, a researchgroup, shows an increase of 44 per centfrom the previous year, with the deathtoll rising61percent.

“Europe has had to deal with terror-ism for many years, with the IRA [IrishRepublican Army] in the UK, for exam-ple,” says Mark Whyte, director of crisisandsecurityconsultingatControlRisks,the consultancy. “But in recent years,the threat has reduced slightly, awayfromlargecarbombstosmallerdevices.A decade ago, the overriding issue forsecurity directors was bombs. Today, itis more the Charlie Hebdo-type lonewolfattack.”

In response to an IRA bombing cam-paign on the UK mainland the govern-mentandinsurance industrysetupPoolRe, the state-backed compensationfund, in the early 1990s. The US set up asimilar scheme — the Terrorism RiskInsuranceProgram—after theattackonNew York’s World Trade Center on Sep-tember112001.

“When Pool Re was set up 22 yearsago, the visible threat was from the IRA,and they were focused on damagingproperty by blowing up buildings,” saysJulian Enoizi, chief executive of Pool Re.“Today, it would appear, for the timebeing, that the nature of attacks haschanged from property damage to whatI would call, ‘killing one and frightening10,000’.”

However, Mr Enoizi does not believethis means that terrorism insurance hasbecomeless important.

“I think in the UK, if you are in Lon-donthenyouareabsolutelyawareof theriskandwillhave insurancecover.

“But outside London there may be aperception that the risk has diminishedin the past 10 years. I think that percep-tion iswrong.”

“Terrorism evolves and insuranceproductsneedtokeeppace,”saysSimonLow, divisional underwriter of politicalrisk and crisis management at Cano-pius, the insurancegroup.

“Weareseeing increasingdemandforcontingent high-risk insurance, such asfor event cancellation for concerts andtoursorconferencesandseminars.

“Businesses and property owners areaware of the risk both to people and pre-mises, and want to cover their exposureto property damage and business inter-ruptionaswellaspotential liability.”

Property owners and tenants havebecome more aware and focused ontightening physical security measures.“Owners are practising response times,evacuation procedures and lockingdown buildings to aid with these riskcontrols,”saysMrLow.

Since 9/11 the office building industryhas more than doubled its spending on

providing a safe office environment,according to the Building Owners andManagersAssociationInternational,a US-based industry group. Private sec-tor office building security expenseswere 73 cents per square foot in 2013,comparedwithtotaloperatingexpensesof$8.13psf,accordingtoBOMA.

“Developers, project managers andarchitects have an understanding of thethreat and what are reasonable precau-tions to take to protect buildings,” addsMrWhyte.

“There are well-known principlesinvolving assessing the threat of an inci-dent and what that means in terms ofthedesignof thebuilding,glazingandsoon. Occupiers looking for a property willalso check what precautions and designmeasures are in place as part of theirduediligence.

“With the threat from Isis [theIslamicState inSyriaandtheLevantter-rorist group] in Syria, other terroristgroups in countries such as Libya andthe possible overspill into Europe andNorth America, the outlook is as unsta-bleas ithaseverbeen,”addsMrWhyte.

Organisations take stepsto outpace terrorismSecurity

Developers and architectsare adopting a range ofprecautions to protectbuildings, says Paul Solman

Wendy Peters speaking on terrorism insurance —The Real Estate Roundtable

‘Outside London, theremaybe a perception that therisk has diminished. I thinkthat perception is wrong’

Last September, late monsoon rainsburst the banks of rivers in northernIndia and Pakistan, killing hundreds ofpeople and displacing and terrifyingmillionsmore.

The tragedy — which left thousands ofrefugees hunting for food and cleanwater after their homes were destroyed— was the worst natural disaster in theworld last year, according to analysis bythe World Resources Institute, a think-tank.

It took India to the top of a 164-strongranking of the countries most affectedby river flooding worldwide in 2014,followed by Bangladesh, China andVietnam.

The risk of flooding extends to devel-oped nations such as the US and the UKand is expected to get worse, says theWRI. It expects numbers affected byfloods to more than double from about21mpeoplenowto54min2030.

There are two main reasons behindthe increase in flooding. The first is thegrowing trend towards urbanisation,with more people building and living onflood plains as cities expand. This exac-erbated the flooding on both sides of theIndian and Pakistani borders last year.The second is climate change, which iscausing rising sea levels, greater inten-sity of rainfall and more extremes inweather.

Both factors suggest that most flood-related disasters involve a natural eventcombined with economic and politicalfailures.

Charles Iceland, director at the WRI,estimates that almost $100bn of GDPglobally is exposed to river flood dam-age each year and that this will growfivefoldby2030.

The effect on business can be disas-trous. For example the 2011 floods inThailand disrupted supply chains for

Toyota, the carmaker, and Western Dig-ital, the computer hard disk manufac-turer.

Floods are the worst natural catastro-phe, taking more lives each year thantornadoes, tsunamisorearthquakes,MrIceland says. “People have their headsstuck in the sand. They either don’twant to put the resources in or don’thavethemoneytoputtheresources in.”

The WRI found that the top 15 coun-tries in the ranking account for nearly80 per cent of the population affectedevery year. The US is the worst hit high-income country, with some 167,000peopleaffectedbyfloodingannually.

Bryan Harvey, water business groupdirector, at CH2M Hill, the engineeringconsultancy, says one problem is thatgovernments are not planning for thelongterm.

“Around the world — wherever youare — most measures are focused on theelection cycle,” he says. “We’re notreally thinking long-termenough.”

This was emphasised in Britain wherethe devastating floods in the winter of2013-14 led to ministers partiallyreversing cuts to flood defence spendingwith emergency grants. Despite this, areport by the UK’s National Audit Officelast November found funding to flood

defences has fallen by 10 per cent since2010.

Jim Hall, professor of climate andenvironmental risks and director of theEnvironmental Change Institute at theUniversity of Oxford, agrees that coun-tries are still reacting to extreme eventsrather than planning for them. “Whenstorms strike, that tends to trigger pol-icyreaction,”hesays.

After Hurricane Sandy hit New Yorkin2012—theworststormin100years—the federal government awardedaround $20bn in aid to the city. Thisincluded approximately $335m to build

the first stage of “the Big U” — a largestorm protection barrier around lowerManhattan that will extend for 10 milesand aims to shield the city from floodsand storm water. However, it is unclearwhopays for therestof theproject.

Approximately 400,000 people liveon New York’s floodplain and while thisisonly5percentof thecity’spopulation,it represents a greater proportion anddensitythananyothercity intheUS.

“No one was really surprised whenHurricane Sandy did so much damage,”says Prof Hall. “For a city of this level ofeconomic activity, the level of flood pro-tectionwasabsurdly low.”

Hepoints toVancouverasanexampleof a city preparing in advance for risingwater, even though it has yet to sufferfrom extreme weather. The city is vul-nerable to rising sea levels and denselypopulated parts of Vancouver are eithercoastal or situated at the mouth of theFraser river — which is susceptible toheavy rainfall and melting snowfall,whichcouldcauseflooding.

Vancouver has raised the minimumconstruction elevation for new build-ings by 1.1m, updated flood maps,planted trees and restored old creeks toprovideadditionalstormwaterstorage.

But it is still some way behind theNetherlands. Flood protection in thecountry has always been a nationalsecurity issue, because much of thenation is below sea level, which isexpectedtoriseoverthenextdecade.

In Rotterdam, measures includebuilding larger dykes and installingwaterplazas toholdstormwater.

Overall, Prof Hall says that Asiaremains the continent most vulnerableto severe flood damage and is set tobecomemuchworse.

Rising waters continueto exact a heavy tollFlooding

Many governments arefailing to think long-termand invest in defences,writes Gill Plimmer

Underwater: a garage in LowerManhattan after Hurricane Sandy In the winter floods of 2013-14, follow-

ing the wettest January on record, largetracts of the southern UK were inun-dated. Several low-lying rural areasremained under water for weeks, whilesome highly populated parts of thecountry were affected by swollen riversandrisinggroundwater.

The threat of flooding in the UK isgrowing as weather patterns change andsea levels rise. Defra, the UK govern-ment’s environment department, esti-mates that 5.8m properties — about 20percentofallhomes—areatsomerisk.

Although the insurance industry hascollectively agreed to provide universalcover for homes, under the existing sys-tem, known as the “statement of princi-ples”, premiums are not capped andthereforereflect theriskof flooding.

For owners of high-risk properties,defined by the Environment Agency asthose facing at least a one-in-30 chanceof flooding in any given year, policiescanbeprohibitivelyexpensive.

To address this, in 2013 the govern-ment and the Association of BritishInsurers struck a deal to set up a floodreinsurance fund, Flood Re, aimed atextending affordable cover to the high-est-risk homes. It follows the principleof Pool Re, a terrorism insurance fundwhich underpins UK commercialproperty insurance.

Insurers maintain their rela-tionship with policyholders, butwhere insurers calculate thatthe floodriskelementofapol-icy will exceed the cappedpremium,theycancedethistoFloodRe.

In the event of flooding,Flood Re money will beused to reimburse insurers.While the not-for-profit schemeis ultimately backed by the UK

government, it will be funded by premi-ums and a levy on every home insur-ancepolicy.

“What is unique about Flood Re isthat if [flood] claims exceed reserves, itcan make a secondary capital call toinsurers,” says Tony Sault, an executivedirectoratEY.

Brendan McCafferty, chief executiveof Flood Re, says Flood Re “fundamen-tally differs” from other pooled reinsur-anceschemes inthat it coversattritionalloss, in the form of annual floods, ratherthanjustbigevents.

However, Flood Re is not intended tobe a permanent feature of the UK insur-ancemarket,but atransitionalarrange-mentset to last25years.

“It is designed to allow insurers tobuild flood risk pricing into their mod-els, using more sophisticated mapping,”saysMrSault.

Mr McCafferty hopes the require-ments for the subsidy will have dimin-ished by 2040. “We need to eliminatethe need for Flood Re at a causallevel . . . [which] will only be successfulif there isstrategic flooddefence.”

Insurers and homeowners have com-plained that government spending onflood defences was cut by about a fifthbetween 2010-11 and 2013-14, withmoney allocated to repairing damagedinfrastructure rather than invested innewdefences.

AlthoughFloodReshouldreducepre-miums for the vast majority of high-riskdomestic properties, the scheme willnot cover properties built since January2009.

“This line was drawn with govern-ment, as we needed to make sure thatthere are no incentives for develop-

ments on flood plains,” explains MrMcCafferty.

However, commercial insurance poli-cies will be excluded from Flood Re,meaning that both leasehold and rentalproperties cannot be covered. Accord-ing to the British Property Federation,which is concerned by these exclusions,6.9m homes will be left outside thescope of Flood Re for buildings insur-ance as a result. Of the 800,000 lease-hold properties — residential and com-mercial — at risk of flooding in the UK,70,000 are classified as at high risk, saystheLeaseholdKnowledgePartnership.

Ian Fletcher, director of real estatepolicy at the BPF says that protestsabout these exclusions have fallen ondeaf ears. “The government has said itwill commission research into excludedgroups, but this will only be reportedafter the legislationhascometopass. It’sunsatisfactory.”

Despite the exclusions, there havebeen calls for the scheme to be nar-rowedto lower itscosts further.

In February, the chairman of theCommittee on Climate Change, an inde-pendent adviser to the government,described Flood Re as “needlesslyexpensive” and recommended it bescaled back to offer taxpayers bettervalue for money. Last year, the govern-ment estimated that the costs of imple-menting Flood Re would outweigh thebenefitsbythree-to-one.

There are also concerns that thetimescale for implementation is slip-ping. It was due to come into effect thissummer, but Mr McCafferty says thattesting of insurers’ systems is now thepriority. “It would be premature to saywhenwewill launch,”headds.

Innovative reinsurance scheme isdrawing criticism as well as praiseProfile Flood Re

The UK fund will extendaffordable cover to thoseproperties at highest risk,writes Adam Palin

Flooding at the UK’sSomerset LevelsDan Kitwood

Floods are theworst naturalcatastrophe, takingmorelives than tornadoes,tsunamis or earthquakes

Monday 27 April 2015 ★ FINANCIAL TIMES 3

Risk Management Property

W ith gusts of almost 170miles an hour, Hurri-cane Andrew generateda total insurance payoutof $15.5bn when it hit

Florida in1992.The storm was a giant wake-up call

for the industry and prompted thedevelopment of sophisticated model-ling techniques that help insurers andorganisations assess the risks of wind-stormsandotherweatherpatterns.

Of course, Hurricane Andrew —which led to the insolvency of severalinsurance firms — was not the only cata-lyst for advances in the modelling of cat-astrophic storms. Over the years, pro-grammers have developed better skillsand gained a clearer understanding oftheatmosphere.

Global co-operation has helped, aswas the case with Hurricane Sandy in

2012, when scientists were able to pre-dict its path, including its highly unu-sual90-degreeturnnorthwards.

“With Sandy, we had amazing inter-national collaboration between scien-tists in Europe and the US,” says ErwannMichel-Kerjan, executive director of theRisk Management Center at Whartonbusiness school, University of Pennsyl-vania.

Many of the advances have beenmade possible by increased computingpower. This reduces the time it takes torunnumericalmodels—whichusegridsto calculate changes in variables such aswind, humidity, temperature and sur-facepressure—topredict theweather.

“When you’re dealing with massivedata on extremely complex systems,you need to aggregate and correlatethose data very quickly,” says ProfMichel-Kerjan. Once, predicting thepath of a hurricane such as Sandy mighthave taken six months. “Now, we can doit in 24 hours. That’s pretty remarka-ble,”hesays.

Increased computing processingpower has also expanded the range ofstorms that can be modelled, explainsRichard Hewston, principal environ-mental analyst at Verisk Maplecroft, therisk analyst group. This allows model-

ling of big windstorms that might havefootprints of 300km and also smallerstorms, such as tornadoes, of just 1-2kminwidth.

Processing power also helps a type offorecasting that, unlike traditionalmodels, can use observations of the cur-rent state of the climate to project for-ward and produce possible weatherevents.

James Done of the Colorado-basedNational Center for Atmospheric

Research (NCAR), says: “Our latestweather and climate models are at apoint where you can generate hundredsof hurricanes that haven’t happened,but could.” He is working on a project todetermine how hurricanes may changeastheclimateheatsup.

Shifts are also taking place in the wayinsurers and others use this informa-tion, with the advent of open-sourceapproaches and the entry of technologycompanies intothefield.

Start-ups are offering companies cus-tomised, real-time risk reports. Forexample, an app from Maptycs allowsinsurers and others to make instantassessments of their property and busi-ness interruption exposure, identifyand monitor local events and producecustomisedreports.

“It’s all mobile-friendly,” explainsProf Michel-Kerjan, who is on the Map-tycs board. “So if you see that there’s amassive flood in Thailand, you go on tothe programme, download the map,increase the map with your finger and ittells you exactly what your exposure inThailandis.”

And while traditionally, companiessuch as AIR Worldwide, Eqecat (nowpart of CoreLogic) and RMS have soldtheir proprietary catastrophe risk mod-

els to insurers, which use them to pricetheirpolicies,alternativesareemerging.

For example, NCAR has launched theEngineering for Climate Extremes Part-nership, which brings together compa-nies, governments, academics and oth-ers inanopen-sourceapproachtodevel-opingweatherandclimateriskmodels.

“It will provide a benchmark view ofrisk against which companies can com-pare their results with the vendor mod-elling companies,” explains Mr Done.“For too long, these companies havedictated the insurance view of risk —now it’s being opened up to a broadercommunityview.”

However, simply watching stormsshould not be underestimated. In theUS, field teams at the National SevereStorms Laboratory use everything fromvehicles that launch weather balloons toradars mounted on trucks to monitortheatmosphere inandaroundstorms.

Combined with computer modelling,observation data, weather apps andeven social media, the ability to predictthe frequency, severity and potentialimpactofstormsis likelyto increase.

“The more data you put into thesemodels, the more you test and validatethem, the better they become,” says MrHewston.

Scientists begin to get ahead of the weatherModel approachNew techniques areallowingmore accuratestorm forecasting,writes SarahMurray

coalition of investors and environmen-tal organisations, says: “Some compa-nies are making decisions about notbeing involved in a market or limitingtheircoverage inacertainmarket.”

However, sheaddsthat inhighlyregu-lated markets such as some US states,cherry-picking their coverage is not anoption for insurers. “In the past, insur-ance companies can and have pulled outof markets wholesale,” she says. “Butwhere the regulator might step in is if aninsurance company wants to operate inonlypartsofastate.”

To remain in certain markets, it is inthe insurers’ interests to play a role inreducing the risks to property fromextremeweather.

“There are a few things we can do andalready do,” says Mr Schraft. “We canshareourviewof therisks.”

Swiss Re does this through reportssuch as last year’s “Mind the Risk”, inwhich it highlighted the perils facingmore than 600 of the world’s largestmetropolitanareas.

In addition, Swiss Re publishes both aglobal map of flood-prone areas and aregular assessment of global insuredlosses fromnaturalcatastrophes.

Insurers can also integrate risk engi-neering and consulting services intotheir coverage, to help cities and busi-nesses increase the resilience of theirbuildings to minimise future losses.These services range from helping com-panies understand the risks their prop-erty assets face and producing naturalhazard loss models and simulations, todevelopingmitigationstrategies.

Industry associations are also playinga role. In the UK, the Association of Brit-ish Insurers hosts events and producesreportsandguidancedocuments tohelpdevelopers, planners and buyers iden-tify and address a range of climatechangethreats toproperty.

Through industry associations, insur-ers can help to shape zoning laws andbuilding codes. In 2014, for example,the IBHS joined New York-based groups

continued frompage1

in advocating the adoption of updatedconstruction and renovation codes toincrease the resilience and energy effi-ciencyof thecity’sbuildings.

Meanwhile, the IBHS “Rating theStates” report ranks 18 hurricane-pronecoastal states along the Gulf of Mexicoand the Atlantic coast on how theyhave strengthened their residentialbuilding code systems since its previousstudywaspublishedin2012.

Even so, Ms McHale sees a markeddifference between the willingness oftheUSinsurance industrytoaddresscli-mate change and that of European com-panies, partly because the issue is still socontentious intheUS.

“The industry [in the US] has beentoo reluctant to jump into the wholearea of climate change and not onlysound the alarm, but roll up its sleevesandworkwithcities,plannersandprop-erty owners to look at where the risksaregoingto increase,”shesays.

A study of 330 US insurance compa-nies, that Ceres published last year,highlighted this. The report found that82 per cent of the 330 companies sur-veyed gained only a “beginning” or“minimal” rating in their response toclimaterisks.

Meanwhile, Mr Schraft argues thatthe industry could do more to shareclaims information globally. “The insur-ance industry has a wealth of data aboutwhat can help and that is also relevantforarchitectsandcityplanners.”

The issue of privacy is one barrier tothis, however. Additionally, much valu-able information remains siloed ininsurance companies, stored in every-thing from their claims departments totheirunderwritingoffices.

Finding ways to tap this rich vein ofdata could help the industry work moreeffectively with planners, engineers andarchitects on developing more resilientinfrastructure. And, of course, doing socould allow the industry to remain prof-itable while meeting the insuranceneeds of the real estate sector in anincreasinglyriskyworld.

Industry mustadjust to dealwith climatechange losses

‘Themore data you put intothesemodels and themoreyou test and validate them,the better they become’

ContributorsKate AllenFT property correspondent

Gill PlimmerFT reporter

Adam PalinReporter, FT Money

Amy BellContent editor, FT Live

Sarah Murray, Paul Solman,James Simms, Ian WylieFreelance reporters

Linda AndersonCommissioning editor

Chris CampbellGraphic artist

Steven BirdDesigner

Andy MearsPicture editor

For advertising details, contact:Pete Cammidge, 020 7775 6321,peter.cammidge@ft.com

FT Reports are available at ft.com/reports

All editorial content in this report isproduced by the FT. Our advertisers haveno influence over or prior sight of thearticles.

‘In the past, insurancecompanies can and havepulled out ofmarkets’

Stormclouds: a tornado just misses afarm in the US — Dreamstime

4 ★ FINANCIAL TIMES Monday 27 April 2015

T he 800-mile San AndreasFault, which runs fromnorthern California to Mex-ico, has been the source ofthe state’s biggest earth-

quakes. Known as the ‘sleeping giant’, itis one of more than 350 faults that arefoundacross thestate.

Scientists now predict that the risk ofa mega quake in the next 30 years ishigherthanwaspreviouslythought.

The Third Uniform California Earth-quake Rupture Forecast (UCERF3),published in March, includes newly dis-covered fault zones and accounts for thepossibility of an earthquake jumpingbetween them. This could result in mul-tiple faults shaking in a simultaneousmega quake (magnitude-8), releasingenough energy to cause massivedestruction.

The report says that, while there is alower likelihood of moderate-sizedearthquakes, the odds of a mega quakeoccurring in the next 30 years haveincreasedfrom4.7percent to7percent.

Earthquakes are nothing new for Cali-fornians. The state experiences 1,000quakes a year, but most are too small tobe felt. While the San Andreas Fault hasexperiencedmassiveearthquakes in thecentral and northern segments — FortTejon in 1857 and San Francisco in 1906— the southern section has not had alargequakeformorethan300years.

Preparing for the next ‘big one’ is theformidable challenge facing state policy

makers. In his 2015 inaugural address,California’s insurance commissionerDave Jones said that earthquake protec-tionwashis toppriority.

“If you ask me what keeps me awakeat night, it’s the strong likelihood of a largeearthquake,”hesaid.

Robert Hartwig, president of theInsurance Information Institute, saysthat California is now better preparedfor a big earthquake from a structuralstandpoint than it was in 1994 when thelastsignificantquakehit thestate.

The Northridge quake caused 57deaths and an estimated $20bn in dam-age. Improvements have resulted fromstronger building codes for new con-structions and infrastructure and retro-fitsofolderbuildings,hesays.

Public schools and hospitals havestringent, enforced building codes, withdesign and construction managed bythe state. All codes are updated regu-larly, based on scientific studies of pastearthquakes, ensuring that the mosteffective design and construction proce-dures apply. These include usingimproved materials and employingstructural measures such as base isola-ters where buildings rest on flexiblebearings and only move a little duringanearthquake.

However, many buildings in Califor-nia, particularly concrete or soft storeywooden structures (where one floor isopen space, causing a weak point), werebuilt before the development of modern

seismic maps and are not consideredearthquake-safe. Current buildingcodes apply exclusively to new con-structions; existing buildings need onlyadhere to the codes in place at the timeofconstruction.

Seismic retrofitting can improve theresilience of older structures bystrengthening structural elements, butinmostcases it remainsvoluntary.

Eric Garcetti, mayor of Los Angeles,recently implemented a seismic safetycampaign to improve the city’s resil-ience, following a report led by Lucy

Jones, a US Geological Survey seismolo-gist. The report proposes fortifyingbuildings, the water system and tele-communications networks at an esti-mated cost of more than $1bn andappears tobeprogressing.Previouscallsfor mandatory seismic upgrades metwith protests from building owners andthere is still concern about how the costofretrofitswillbecovered.

Better public understanding ofthe earthquake threat has been a crucialpart of the process. Dr Jones liaisedwith community groups and city

departments over a year-long period,warningof theriskofdoingnothing.

The estimated cost of damage to LosAngeles in its current state, if a bigearthquake were to hit, would be morethan$210bn.

The risk to Los Angeles, with a popu-lation of approximately 18.5m, is partic-ularly high because of the many faults,but other densely populated zones arealso at risk, including the San FranciscoBay area, which is working on a plan tostrengthenthearea’sresilience.

The findings of the UCERF3 report

have been included in the 2014 updateof the earthquake hazard maps. Suchmaps are essential in earthquake prepa-ration, as they are used by engineers,plannersandbuildingcodeofficials.

The risks are reflected in the insur-ance rates for earthquake coverage.Chris Schultz, deputy insurance com-missioner, estimates that in high-riskareas insurance may cost $3,000 a yearor more. In some cases he says, retrofit-ting at a one-off cost of $3,000-$10,000couldbeabetterchoice.

Many insurers were caught off-guardby the 1994 quake and began to restrictcoverage and increase rates as a result.Unlike flood insurance, earthquakecover is not provided by the state andmustbepurchasedfromprivatecompa-nies. Separate earthquake insurancemust be offered under Californian lawto policyholders, but it is not mandatoryand many choose not to purchase itbecauseof thecost.

Mr Schultz says a mere 11 per cent ofhomeowners and tenants in Californiacurrently have earthquake insurance,and commercial uptake is similarly low.The California Department of Insuranceis trying to secure funding for grants toencourage people to retrofit their prop-ertiesheadds.

Mr Hartwig believes the reason so fewCalifornians have earthquake insuranceis complacency. “It has been 21 yearssince the last major earthquake in thestate and many rationalise that they candowithout.

Unfortunately, too many seem willingto play Russian roulette with what islikely to be their most valuable asset,theirhome.”

Christina Curry, assistant director atthe governor’s Office of EmergencyServices, believes that better publicawareness and support are crucial. Shecites the importance of current work onearthquakeearlywarningdetectionandcontinued focus on the state’s ShakeoutScenario to ensure citizens know whattodoinanearthquake.

However, for now, the onus is onindividuals to insure their propertiesagainstearthquakes.The latestUCERF3report may well serve as a reminder topropertyownersof therisks theyface.

Californiansstep up plansto counterthe ‘big one’Earthquakes The odds of the state experiencingamassive tremor have increased, writesAmyBell

Risk Management Property

San Jose

Sacramento

Los Angeles

Santa Barbara

Fresno

San Francisco

San Bernardino

San Diego

Fort Tejon

CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

LLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOORRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR

NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

CA

LI F

OR

NI A ARIZONA

NEVADA

OREGON

M E X I C O

The San Andreas Fault is ‘the master fault’. More than 1,280 km long, it e xtends to depths of at least 16km. Lar gest earthquakes in California occurred along this fault – 1857 F ort Tejon earthquake with an estimated magnitude of 7.9 and 1906 San F rancisco earthquake with an estimated magnitude of 7.8.

The Hayward Fault is 72km long. Last major earthquake was in 1868 with an estimat ed magnitude of 6.8. Mor e than 2.5m people now live along the fault line.

The Calaveras Fault is 70km long. Recent research suggests the Hayward and Calaveras faults are part of the same system; a rupture on one could trigger a rupture on the other, producing considerably larger quakes than previously predicted.

The major fault lines

The 1906 San Francisco earthquake

100 kmFT graphic Sources: USGS; FT research Photo: Getty

At fault: seismic map of California

‘What keepsme awakeat night is the stronglikelihood of alarge earthquake’

Four years after the devastating Tohokuearthquake and tsunami, governments,insurers, real estate owners and devel-opers are taking steps to improve theability of structures to withstand andsurvivesuchdisasters in Japan.

Even before the recent legal changesto prod more property owners to followstricter seismic building standards,structures stood up well to the strongestquake on record to hit Japan. But stepsto deal with the impact of tsunamis —which were the most deadly anddestructive force in the catastrophe — and long-period ground shaking thataffects skyscrapers in cities, such asTokyo,arestill aworkinprogress.

Nearly 16,000 people died and almost130,000 homes and buildings weredestroyed, mainly in three northernprefectures on the Pacific coast in theMarch 2011 disaster. The financial tallyfor insurance companies was almost$37bn in earthquake and tsunami dam-age and business interruption claimspaid — making it the second costliestpayout worldwide in the past four dec-ades, after Hurricane Katrina’s almost$79bn,saysreinsurerSwissRe.

Japan’s current regulations, to protectresidential and commercial structuresagainst earthquakes, date to the 1981BuildingStandardsLawandsubsequentminor revisions. The Tohoku quake andthe most destructive one before that,Kobe in1995, indicatedthat the1981 lawwas sufficiently strict, because almostall of the damage occurred to structuresbuilt under the prior 1950 law, saysHiroshi Fukuyama, director of theNational Building Research Institute’sStructuralEngineeringDepartment.

Nonetheless, in 2013, Japan made fur-ther revisions to a 1995 law promotingseismic retrofits passed after the Kobequake, to push more structures to meetthe1981code. Itcompelsownersof largebuildings used by the public, such ashotels and shopping centres, to havethird parties assess whether they meetthe 1981 law and for public disclosure oftheresultsbytheendof2015.

The goal, by the end of the year, is to

increase the percentage meeting thecode to 90 per cent from about 80 percent in 2007. The national governmentand most local governments will pro-vide financial assistance, up to 80 percent in some instances, to pay for seis-mic retrofits to meet tougher standards.For assessments, the assistance cancovertheentirecost.

Miyagi, the prefecture hit hardest inTohoku, has some of the most generousresidential subsidies in Japan and hadpromoted quake insurance before the2011 earthquake. Half the householdsnow have coverage, up from one-thirdbefore the quake, compared with thenationalaverageof28percent.

Insurers offer discounted premiumsfor residential property that follow the1981 code, with larger reductions formeeting greater quake-resistancestandards. The maximum discountjumpedtoone-half lastyear from30percent in 2010, according to the GeneralInsurance Rating Organization of Japan,afterregulatorsassessedtheefficacyof quake-resistance features and alsodrewupnewhazardmaps.

For corporations insuring propertyfrom quakes and tsunamis, there are noacross the board rates or discounts andcoverage is not guaranteed, in contrasttoresidentialquake insurance.

In general, says insurer Sompo JapanNipponkoa Holdings, the conditions forsetting rates include location, seismicresistance and the risk of tsunamis andliquefaction — the rate the strength andstiffnessofsoil is reducedbyearthquakeshaking.

Atsuhiro Dodo, head of propertytreaty underwriting at Swiss Re inJapan, says: “The key determinantis which building code/seismic resist-ance is installed.” Corporate quakeinsurance, which is a rider on fire cover-age, is harder to attain, because thenational government does not act asthe reinsurer, as it does for dwellinginsurance.

Norio Morioka, general manager ofthe planning department at TokioMarine & Nichido Risk Consulting, asubsidiary of insurer Tokio MarineHoldings, says reducing risk is the prior-ity for companies: first protecting per-sonnel; then structures used for produc-tion and providing services; and thirdly,ensuring business continuity. The laststep is insurance or other coverage suchascatastrophicbonds.

Propertyownersanddevelopershavean incentive to meet or exceed the 1981standards to attract customers and ten-ants. Hiroshi Okubo, head of research atthe real estate group CBRE in Tokyo,says: “Relocation demand on the backof facility upgrades [to quake-resistantbuildings] and for [business continuityplanning] compliance has been thetrend, particularly after the Tohokuearthquake.”

High-grade buildings that exceedseismic standards are often also largerand better located and therefore receivehigherrents,headds.

Thegovernment isworkingonregula-tions to help deal with the stresses thattsunamis can put on structures, in addi-tion to the current tsunami evacuationand shelter requirements and improvedhazardmaps. It isalso lookingatrules todeal with long-period ground motion ofone to two seconds, which affected sky-scrapers in Osaka, nearly 800km fromtheTohokuquakeepicentre.

Japan has taken significant steps toprotect itself from future earthquakes,but only time will tell if these prepara-tionsaresufficient.

Authorities move to imposetougher building standardsJapan

Regulations are beingtightened to improveresistance to shocks,writes James Simms

Floating shelter being installed on thetop of a tsunami evacuation tower

High-grade buildings thatexceed seismic standardsare often better locatedand receive higher rents