ExecutiveRiskReport GETTING COVERAGE RIGHT: TIED POLICY LIMITS

Size: px

Start display at page:

Download "ExecutiveRiskReport GETTING COVERAGE RIGHT: TIED POLICY LIMITS"

Clement Carter
5 years ago
Views:

market dynamics affecting executive and professional liability coverages and claims.

A policy may state that if a claim is covered under another policy issued by the same or a related insurer, the policy limit will be reduced

Depending on how the clause is written, the other policy might be one issued to a completely unrelated party.

A good example how this works would be a securities claim covered under a D&O policy that also leads to an ERISA suit that is covered under

Hypothetically, if both the D&O and fiduciary liability policies have $10 million policy limits, and if $7 million is paid under the D&O

1 ExecutiveRiskReport William A. Boeck, Lockton Financial Services Autumn 2012 Executive Risk Report provides Lockton clients with timely, practical news about the legal and market dynamics affecting executive and professional liability coverages and claims. GETTING COVERAGE RIGHT: TIED POLICY LIMITS It can be a snake in the grass with a really nasty bite. A policy may state that if a claim is covered under another policy issued by the same or a related insurer, the policy limit will be reduced by the amount paid under the other policy. Depending on how the clause is written, the other policy might be one issued to a completely unrelated party. Typically though, clauses like these are limited to claims involving companies that have some relationship. A good example how this works would be a securities claim covered under a D&O policy that also leads to an ERISA suit that is covered under the company s fiduciary liability policy issued by the same insurer. Hypothetically, if both the D&O and fiduciary liability policies have $10 million policy limits, and if $7 million is paid under the D&O policy, only $3 million of the fiduciary liability policy limit would remain to resolve all claims, including the ERISA claim. IN THIS ISSUE Getting Coverage Right: Tied Policy Limits Cyber Security For Financial Institutions Bring Your Own Device Policies Raise New Data Loss Concerns Courtroom Case Notes: News You Can Use From Recent Decisions Lockton Claims Advocacy In Action This isn t as crazy as it sounds. Insurers need to manage their exposures to losses, and want to avoid having to pay more than one claim arising from a particular event. (CONTINUED ON NEXT PAGE) L O C K T O N C O M P A N I E S

(TIED POLICY LIMITS CONTINUED FROM PG. 1) Although tying policy limits together may not be crazy, it can be dangerous. (Here comes that snake I warned you about.

2 (TIED POLICY LIMITS CONTINUED FROM PG. 1) Although tying policy limits together may not be crazy, it can be dangerous. (Here comes that snake I warned you about.) In the example above, if payment under the D&O policy reduces the fiduciary liability policy limit then there may not be enough fiduciary liability coverage left to respond to existing and future claims. You might think the best way to avoid snake bite here would be to maintain adequate excess insurance. You re right, though excess policies create their own set of problems under situations like this. Excess policies typically pay only when the full underlying policy limit has been paid by the primary insurer. Many modern policies will also allow the underlying policy limit to be paid by the insured. If the fiduciary liability policy limit in the example above is reduced to $3 million then any excess fiduciary liability insurers may argue that their policies are not triggered until the primary insurer pays the full $10 million primary policy limit. That would require the insured to pay $7 million to fill the gap. You might think the best way to avoid snake bite here would be to maintain adequate excess insurance. What Should Companies Do? Avoid policies with clauses that tie policy limits. Insurers that are inclined to add such clauses may be willing to remove them, though perhaps only in return for an increased premium. If limit tying clauses cannot be removed, assure that they are limited to policies issued to related entities. Assure that excess policies sitting over primary policies with tied limits will respond once the reduced primary policy limit is exhausted. 2 2

3 ONE-SIZE-FITS-ALL CYBER SECURITY FOR FINANCIAL INSTITUTIONS IS UNREASONABLE: IS YOURS CUSTOM FIT? By Mark Weintraub, Lockton Financial Services, Atlanta Shoppers have long been dubious of assurances that one-size-fits-all. The First Circuit Court of Appeals recently expressed similar skepticism about cyber security in Patco Construction Company, Inc. (Patco) v. People s United Bank (Ocean Bank), 684 F.3d 197 (1st Cir. 2012). Patco Construction Company had an account with Ocean Bank. During the course of seven days in May 2009, the bank authorized six fraudulent electronic withdrawals totaling nearly $590,000. It did so because the perpetrators used Patco s correct user ID, password and answers to challenge questions (e.g., What is your mother s maiden name? ). Ocean Bank refused to cover the loss and Patco sued, alleging that the bank s security procedures were not commercially reasonable. The district court entered judgment for Ocean Bank, finding its security procedures were reasonable. A critical selfexamination is an important first step to achieve a custom fit security system and protect valuable company resources and data. Ocean Bank lost on appeal. The court found that it was not commercially reasonable for the bank to unilaterally lower the transaction threshold to trigger challenge questions for all its customers from $100,000 to $1. Ironically, Ocean Bank made this change to increase security, but the First Circuit found it had the opposite effect. By requiring challenge questions for all transactions, Ocean Bank increased the frequency of users responding to challenge questions and, therefore, increased the likelihood of responses being stolen by key-logging malware. Instead of reserving challenge questions for high risk, high dollar transactions, Ocean Bank practically made them part of its log-in requirements, exposed them to all the related risks, and reduced their efficacy. The court also found that Ocean Bank had ignored the requirement that security procedures take into account the circumstances of the customer and to consider size, type and frequency of payment orders normally issued by the customer to the bank. Patco s past withdrawals were very consistent originating from the same IP address and computers, on the same weekday and to the same accounts. The fraudulent transfers, however, were different in all these respects and were three times the size of Patco s largest prior withdrawal. While Ocean Bank s security system flagged these transfers as high risk and out of step with Patco s past practices, the bank did not employ additional authentication measures. As such, Ocean Bank failed to take Patco s circumstances into account, and its one-size-fits-all approach was determined to be commercially unreasonable. (CONTINUED ON NEXT PAGE) 3

4 (ONE SIZE FITS ALL CYBER SECURITY CONTINUED FROM PG. 3) After Patco, the adequacy of a bank s security system will be judged against an actual customer s circumstances and must be tailored accordingly. Fortunately, the necessary technology exists. Commercial customers should individualize security procedures as much as possible, demanding multi-tiered challenge questions, password generating tokens, and out-of-band authentication. Financial institutions should make certain that their systems and procedures are kept up-to-date. They should also ensure that they have adequate insurance coverage in place to respond to any losses that do arise despite their risk management efforts. Are you covered for Patco-like security breach losses and business disruption? A critical self-examination is an important first step to achieve a custom fit security system and protect valuable company resources and data. BRING YOUR OWN DEVICE POLICIES RAISE NEW DATA LOSS CONCERNS By Adam Balentine, Lockton Financial Services, Kansas City According to a recent Nielsen survey, 50 percent of all new mobile phone sales are smart phones. It is estimated that by 2014, more than one out of three internet users in the U.S. will own a tablet. As the popularity of smart phones and tablets grows with consumers, many businesses are reevaluating their company-issued mobile device programs. With so many powerful and advanced personal mobile devices already in the hands and pockets of their employees, businesses are embracing this trend as an opportunity to encourage the use of personal devices for work purposes. Some businesses are discontinuing company-issued Blackberries and smart phones to institute BYOD (bring your own device) policies. Such policies would allow employees to access company systems, applications and data on their personal mobile device while they are on-the-go. In some cases, employees are given a monthly stipend to offset the additional cellular and data usage. BYOD programs have proven to be a way to significantly cut expenses while also complying with the preferences of a technologically savvy workforce. From a risk control perspective, there are several questions associated with the potential for data loss that should be considered prior to instituting a BYOD policy. A few key questions are: (CONTINUED ON NEXT PAGE) 4

(BRING YOUR OWN DEVICE CONTINUED FROM PG. 4) 1. Does your company have a security policy and the necessary technology to reduce the risk of data loss on personal devices?

5 (BRING YOUR OWN DEVICE CONTINUED FROM PG. 4) 1. Does your company have a security policy and the necessary technology to reduce the risk of data loss on personal devices? Security precautions for employee-owned devices should be as stringent as those for company-owned devices. Company-enforced mobile device management controls such as password protection, data encryption and remote data-wipe applications are essential. Companies should consider how difficult it will be to implement and regulate such preventative measures on personal devices. Requiring BYOD users to agree to the corporate mobile policy in a contract will allow companies to maintain the necessary level of control and may encourage employees to take the necessary precautions in securing their devices. 2. Will a new BYOD policy increase the number of users that have access to company data on their mobile devices? There has been little evidence that personal device usage for business purposes increases the frequency or severity of security or privacy losses. If the number of employees that will have access to customer or employee personal information increases with the institution of a new BYOD policy, or if the policy leads to an greater number of devices being used by employees, then the probability of a data loss will certainly trend upward. If the company is simply swapping out personal devices for company issued equipment, then the probability of loss is only influenced by how secure each user s personal device actually is. 3. Does your company s Network Security and Privacy Liability (a.k.a. Cyber Liability) insurance policy cover a privacy or security loss arising out of an employee s personal laptop, tablet or smart phone? State-of-the-art policy forms will cover losses regardless of whether the employer or the employee owns the device used. For example, if the loss of an employee s personal ipad in an airport required his or her employer to notify thousands of customers that their private information may have been breached, a good State-of-the-art policy forms will policy form would pay for such notification expenses. cover losses regardless of whether the There would be no restriction of coverage due to the employer or the employee owns the fact that the ipad was not owned and issued by the device used. company. To avoid new potential loss scenarios, systems-related questions should be asked, coordinated risk control techniques should be implemented and insurance solutions should be put in place prior to the institution of an employee-owned device program. These risk management precautions will allow a business to minimize their risk and reap the benefits a BYOD policy offers. 5

COURTROOM CASE NOTES: NEWS YOU CAN USE FROM RECENT DECISIONS Severability provisions in lawyers E&O policy do not apply to prior knowledge exclusion Background Professional liability policies

6 COURTROOM CASE NOTES: NEWS YOU CAN USE FROM RECENT DECISIONS Severability provisions in lawyers E&O policy do not apply to prior knowledge exclusion Background Professional liability policies typically have exclusions that apply to claims arising from matters that an insured knew about at the inception of the policy period and that could result in a claim. This case demonstrates that the exclusion can be applied to all insureds even if only one of them knew about the excluded matter. What Happened? In One Beacon Ins. Co. v. T. Wade Welch & Assocs., 2012 WL (S.D. Tex. Apr. 5, 2012), several attorneys with the Welch law firm were sanctioned by a court because they engaged in unreasonable and vexatious conduct. The firm later ran into similar trouble in other cases. The firm s client in the later cases asked the firm to agree to toll the statute of limitations on a legal malpractice claim. The firm agreed, and reported the request to its professional liability insurer, One Beacon Insurance Company. One Beacon ultimately denied coverage and filed suit against the firm and its lawyers. One Beacon alleged, among other things, that one lawyer at the Welch firm knew that certain wrongful acts, violations of disciplinary rules and acts of professional misconduct could result in a claim before the first One Beacon policy period began and that a policy exclusion for such matters applied. The insureds argued that the knowledge of a single lawyer, which was concealed from the rest of the firm, could not be used to deny coverage to firm and its other lawyers. They argued that severability language pertaining to other exclusions should also be applied to the prior knowledge exclusion. What Did the Court Decide? One Beacon won. The District Court found that the severability language did not apply to the prior knowledge exclusion, and that by its plain language the prior knowledge exclusion applied to all insureds. WHY IS THIS IMPORTANT? It is not unusual for exclusion severability language to be limited to exclusions for fraud, dishonesty and illegal personal profit. Insurance underwriters will not always agree to broaden that language. This case is a good example of why they should be asked to do so. (CONTINUED ON NEXT PAGE) 6

(NEWS YOU CAN USE CONTINUED FROM PG. 6) Loss Data breach/loss covered under crime policy Background Crime policies often include coverage for computer fraud.

7 (NEWS YOU CAN USE CONTINUED FROM PG. 6) Loss Data breach/loss covered under crime policy Background Crime policies often include coverage for computer fraud. While such coverage typically will not respond to losses resulting from data breaches, this case is a good reminder that crime policies may be implicated if the facts are right. What Happened? In Retail Ventures, Inc. v. National Union Fire Ins. Co. of Pittsburgh, Pa., 2012 WL (6th Cir. Aug. 23, 2012), hackers used a wireless network at a Designer Shoe Warehouse (DSW) store to access DSW s customer accounts and steal credit card and checking account information of more than 1.4 million customers. The hackers used the information to engage in fraudulent transactions. DSW incurred expenses for customer communications, public relations, customer claims and lawsuits, and attorneys fees in connection with investigations by seven state attorney generals and the Federal Trade Commission. DSW sought coverage for its loss under the computer fraud coverage in its crime policy with National Union. National Union denied coverage in part on the grounds that the theft of the customer information only indirectly led to the loss because third parties had to use the information in fraudulent transactions to actually produce the loss. DSW filed suit to challenge the denial. What Did the Court Decide? DSW won. The court found that policy language requiring that loss as a result directly from computer fraud must be interpreted to cover all loss proximately caused by the fraud, not just loss that is caused solely by, and results immediately from the fraud. WHY IS THIS IMPORTANT? This case is important on multiple levels. First, it suggests that data breach losses may be covered under crime policies with computer fraud coverage. To the extent that coverage is barred because the loss is not the direct result of a data breach this case will be helpful. As insurers believe data breach losses should be covered under cyber policies, it seems likely that underwriters will modify computer fraud coverage extensions in crime policies to assure that those losses are not covered going forward. This case is important because the court s analysis of the direct loss issue will help insureds seeking coverage in other situations where the insurer contends that the loss is not a direct result of a covered event. (CONTINUED ON NEXT PAGE) 7

8 Autumn 2012 Lockton Companies (CONTINUED FROM PG. 7) Insured vs. insured exclusion does not apply to claims by non-insureds Background D&O and other professional liability policies contain an exclusion for claims brought by one insured against another. These exclusions are designed to prevent insureds from colluding to manufacture a claim in order to tap insurance policy proceeds. Insurers often take the position that the exclusion applies to an entire claim even if some of the claimants are not insureds. What Happened? In Miller v. St. Paul Mercury Ins. Co., 683 F.3d 871 (7th Cir. 2012) five plaintiffs filed suit against Strategic Capital Bancorp, Inc. (SCBI). Two of the plaintiffs were former directors of SCBI. SCBI reported the suit under its D&O policy with St. Paul. St. Paul denied coverage on the basis that the policy s insured vs. insured exclusion applied. SCBI argued that the exclusion cannot be applied to claims brought by plaintiffs who are not insureds. What Did the Court Decide? SCBI won. The court held that policy language requiring that loss be allocated between covered and non-covered claims limited the reach of the insured vs. insured exclusion and that it would not apply to claims brought by non-insureds. W H Y I S THI S IMPORTANT? This case does not break new ground. Other courts have reached similar conclusions. This decision is a good reminder that allocation provisions should be considered in the event an insurer attempts to apply an exclusion to an entire claim when the exclusion only reaches part of it. 8

9 Autumn 2012 Lockton Companies (CONTINUED FROM PG. 8) A demand to fulfill a contract is not a claim Background One of the best defenses an insurer has to a claim under a policy covering only claims made and reported to the insurer during the policy period is that the claim was made before the policy period began. Insurers therefore look at correspondence that led up to the claim to determine if any of it contained a demand for monetary or non-monetary relief. This case sheds light on what will and will not be considered a claim. What Happened? In St. Paul Mercury Ins. Co. v. RMG Capital Corp., 2012 WL (C.D. Cal. June 7, 2012) a borrower sued RMG Capital and Fullerton Community Bank (FCB) for FCB s alleged failure to perform on a contruction loan. In January 2009 counsel for the borrower sent FCB a letter demanding that it continue advancing money as required by the loan. FCB did not do so, and the borrower filed suit in December FCB reported the lawsuit to St. Paul under a policy covering lender liability claims. On learning of the January 2009 letter, St. Paul took the position that it was a demand for non-monetary relief. St. Paul then filed suit to establish that the claim was not covered. What Did the Court Decide? FCB won. The court decided that the January 2009 letter was not a claim as defined in the policy because it did not seek or threaten to seek non-monetary relief in the form of a court-ordered benefit. W H Y I S THI S IMPORTANT? This case establishes a good analytical approach insureds can use to rebut arguments by insurers that pre-claim correspondence amounts to a claim made before the policy period began. This is a commonsense result that fits with the reality that there is often give and take between parties that takes place before the dispute becomes formal. There is seldom any benefit to having an insurer involved at that early stage, so requiring notice to an insurer at that point would be not be helpful to anyone. 9

After getting the denial letter, the client was disappointed that the insurance they purchased was failing to meet their expectations and asked Lockton to help.

10 After getting the denial letter, the client was disappointed that the insurance they purchased was failing to meet their expectations and asked Lockton to help. LOCKTON CLAIMS ADVOCACY IN ACTION By Don Glazier, Lockton Financial Services, Chicago Insurance company claims departments face the same pressure that is being imposed on almost every industry: to do more with less. As a consequence of that pressure, an in-house claims analyst who previously was responsible for reviewing coverage in connection with 120 professional liability claims now must routinely handle more than 200. As a result, his or her analysis may be not as thorough as it should be, and if the analyst concludes that no coverage is available for a particular claim, he or she may not explore alternative avenues of coverage. Lockton sees this situation with increasing frequency. Recently a large, nationwide automotive supply company client submitted a claim under an employment practices liability policy that alleged negligence in hiring an employee whose actions resulted in the death of another employee. The insurer s claims specialist reviewed it and concluded there was no coverage because it was not a covered third-party employment claim. After getting the denial letter, the client was disappointed that the insurance they purchased was failing to meet their expectations and asked Lockton to help. Lockton reviewed the denial and discovered that after the claims analyst concluded there was no coverage for the claim, he stopped his evaluation. He failed to review the policy s other coverage sections which appeared to offer coverage. With the client s approval, Lockton quickly engaged with the insurer and within two weeks had persuaded them to accept coverage and agree to defense counsel selected by our client. Our client was obviously pleased with our efforts on their behalf. The client s general counsel commented that he would have to have paid coverage counsel more than $20,000 to achieve the same result. This claim illustrates the need for clients to have a strong advocate throughout the claims process so that they don t become the victims of shoddy claims service. 10

SM Autumn 2012 Lockton Companies LOCKTON S GLOBAL

Partners EXECUTIVE RISK REPORT AUTHORS WILLIAM A.

Counsel Lockton Financial Services 816.960.

com DON GLAZIER Vice President Insurance & Claims

com ADAM BALENTINE Account Manager 816.960.

11 SM Autumn 2012 Lockton Companies LOCKTON S GLOBAL REACH SERVICE AROUND THE WORLD Strategic Service Partners EXECUTIVE RISK REPORT AUTHORS WILLIAM A. BOECK Senior Vice President Insurance & Claims Counsel Lockton Financial Services wboeck@lockton.com DON GLAZIER Vice President Insurance & Claims Counsel dglazier@lockton.com ADAM BALENTINE Account Manager abalentine@lockton.com MARK WEINTRAUB Assistant Vice President Insurance & Claims Counsel mweintraub@lockton.com 11

12 Our Mission To be the worldwide value and service leader in insurance brokerage, employee benefits, and risk management Our Goal To be the best place to do business and to work Lockton, Inc. All rights reserved. Images 2012 Thinkstock. All rights reserved. g:\resources\newsletters\executive risk report\2012\fall 2012.indd:ckf

FIDUCIARY LIABILITY Risk review performed for: Date:

ForeFront Portfolio SM Risk Analyzer for Privately Held Companies FIDUCIARY LIABILITY Risk review performed for: Date: The Purpose of the Risk Analyzer When it comes to insuring your company, you can