Gilsbar Inc. has had a detailed disaster recovery and business continuity plan in place since 1996. The New Orleans-based third-party administrator, which handles claims for about 150,000 members, employs a certified disaster recovery specialist. And, the company's executives and technical staff go through tabletop disaster recovery scenarios at least twice a year.Like many other insurance companies, Gilsbar is prepared for catastrophes. However, when Hurricane Katrina hit last year, insurance executives were caught by surprise and had to act on their feet and respond to a bevy of unexpected circumstances.
It wasn't that these insurance companies didn't expect a hurricane; they just didn't plan for the likes of Katrina.
"Certainly, the industry was not surprised that a strong hurricane could hit," says Paul VanderMark, executive vice president at Risk Management Solutions (RMS), a Newark, Calif.-based company that offers catastrophic risk management products and services.
The severity of Katrina-and the aftereffects of the storm-however, caught the insurance industry by surprise. For example, many insurers didn't plan for the flooding, the forced evacuations, the extensive property loss, the looting and the business interruption, VanderMark points out.
The storm, which is being described as the worst to hit American soil, is estimated to cost $100 billion in damage, making it the most expensive U.S. natural disaster ever. The insurance industry is pegged to pay out about $60 billion in claims, according to industry estimates.
Response to the unexpected and unwieldy storm, however, has taught insurance companies a number of lessons including:
- How to act quickly and change disaster recovery plans on the fly in order to get operations back on track and communicate with customers.
- What to include in future disaster plans in an effort to mount a better response to catastrophes (see "How Insurers Have Updated Their Disaster Plans," page 18).
- How to take better advantage of catastrophic modeling and, therefore, have a better handle on risk.
Dealing with the unexpected
Although many insurance companies such as Gilsbar had detailed, well-thought-out disaster recovery plans in place, none seemed to account for all of the havoc caused by Katrina.
"We had to rethink our plan in the middle of the disaster. This was so unlike any disaster we could have imagined. There were so many things that we just could not have predicted or prepared for," says Neal Hennegan, director of technology at Gilsbar.
Sure enough, after the storm hit on Monday, Aug. 29, 2005, Hennegan began to suspect that Gilsbar's efforts would have to go beyond what was laid out in the company's detailed disaster recovery plan.
By Tuesday afternoon, Hennegan headed for the office, which is located about 30 miles from the eye of the storm. While en route, he met up with the owner of the company and the vice president of operations "on the road to the middle of nowhere with fallen trees and debris everywhere," Hennegan recalls.
"We had not talked to any of the other members of the company. And, we really were not sure what their conditions were or if they were safe," Hennegan says.
Faced with so much uncertainty, the three executives decided to meet again on Wednesday morning to discuss how the company would respond to Katrina. "We had to rethink our disaster recovery plan in the middle of the disaster. It was unlike any disaster that we could prepare for," Hennegan says.
Problem No. 1? The storm left Gilsbar, and most other companies in the Gulf Coast region, without any reliable means of communication. Land telephone lines, cell phone towers and Internet connections were all compromised by the storm-a situation simply unthinkable before Katrina.
"We couldn't reach each other through any of the traditional means of communication. The land line and cell phones just didn't work," Hennegan says.
As a result, communicating with employees posed quite a challenge. "Many employees were evacuated from their homes. So, we were just trying to figure out how we could make sure that everyone was alive and OK," Hennegan says.
First off, to start the recovery process, Hennegan had to drive 50 miles all the way to Baton Rouge, La., just to gain access to telephone communications. Once Hennegan gained access to phone communications, he called SunGard Availability Services, the Wayne, Pa.-based disaster recovery company Gilsbar had contracted with.
He learned that the company would have to recover its business in Chicago, not in Atlanta as planned because the facility was already filled to capacity. So, Hennegan had to reach customer service employees-and tell them to head for Chicago instead.
"We were able to get about 40 of our employees to Chicago to start taking phone calls and servicing our customers," Hennegan says. "We were able to start taking phone calls the Sunday after the storm, and we had all of our major systems up and running about one week after the storm."
Like the executives at Gilsbar, the executives at Pan American Life Insurance Co., New Orleans, also had to think on their feet after Katrina hit, even though the company had a thorough disaster recovery plan in place.
"You can never plan for this kind of disaster entirely," says Patrick McGunagle, executive vice president.
Certainly, McGunagle didn't expect to be operating without access to 21st-century technology such as phones, computers and cell phones. "Our phones and cell phones were useless, and our e-mail was down," he says. "We had to rely on 20th-century technology to communicate with our employees. We took newspaper ads out in five cities just to locate our employees."
Operating for a longer period of time
In addition, Pan American Life had to extend its disaster recovery efforts to account for more than just a short recovery period.
"Most disaster recovery plans anticipate a few days of disruption," McGunagle says. "But after Katrina there was a question of whether we would ever be able to return to New Orleans. So, we had to go into a different mode and start thinking about how we could operate and recover our business for an entire six months."
Instead of simply holding things together for a few days, the company had to come up with a way to operate for a long period of time. Fortunately, McGunagle was able to strike a deal with Computer Sciences Corp. (CSC), El Segundo, Calif., and lease 200 workstations for an extended period of time.
Although getting operations up and running was first and foremost for most companies, insurers then had to turn their attention to communicating with customers, including dealing with an onslaught of claims and questions that arose from the storm previously unmatched in natural disaster history.
State Farm Mutual Automobile Insurance Co., a Bloomington, Ill.-based insurer that serves about 73 million policyholders, established a Web page where customers could start the claims process online.
The site walks customers through the claims submission process, answering anticipated questions along the way.
In addition, the company set up 29 dedicated catastrophe offices in the storm-impacted region. These offices include mobile facilities in Louisiana and Mississippi that have satellite connectivity and office space.
Liberty Mutual, Boston, also established a Web site page where customers could report claims online. In addition, the site enables customers to report flood claims, which Liberty Mutual then passes on to the National Flood Insurance Program, which is administered by the Federal Emergency Management Agency.
The Liberty Mutual site also contains pages that help customers prepare and respond to a variety of potential disasters such as hurricanes, earthquakes, floods and tornados.
Looking forward
Getting businesses back on track, however, is only part of the disaster recovery equation. Insurers also need to be able to emerge from disasters in good financial condition.
Doing so in the wake of Katrina is proving quite a challenge for many carriers. U.S. P&C insurers are expected to pay homeowners and businesses a record $56.8 billion for 2005 insured property losses from 24 catastrophic events-more than twice the prior record set in 2004, according to preliminary estimates by ISO's Property Claim Services unit, Jersey City, N.J.
Individual insurance companies, naturally, are struggling with the aftermath of the storm. For example, Allstate Corp., Northbrook, Ill., reported a 2005 third-quarter loss of $1.55 billion, its biggest quarterly loss as a publicly traded company. The company reported catastrophe losses of $3.06 billion, of which $2.39 billion was from Hurricane Katrina and $553 million form Hurricane Rita, along with smaller amounts from Dennis and Ophelia. In January, the company announced it would cut 600 to 700 jobs at its corporate headquarters through a voluntary buy-out program.
Of the many ways carriers can avert such financial fallout, many industry observers are calling for companies to make better use of catastrophic modeling (CAT).
"Insurance companies need to take a close look at CAT modeling and geographic exposure," says Donald Light, a consultant with Celent Communications, Boston. "Although insurance companies have come a long way since 9-11, they still need to visit and revisit once again how they are using CAT modeling."
According to Frank Fischer, client relations manager at Air Worldwide Corp., a Boston-based risk modeling company, CAT modeling can help insurers survive large disasters by:
- Minimizing the risk or extreme events through portfolio management, which helps insurers reduce over-concentration of exposures.
- Analyzing various risk transfer options.
- Developing underwriting guidelines to enable growth in premiums while controlling loss potential.
More specifically, models can help insurers identify ZIP codes and even individual policies that will have the largest impact on losses and, thereby, help insurers improve profitability, according to Fischer.
To get the most out of CAT modeling, say analysts, insurers need to gather high-quality, complete data. Yet, according to a recent analysis conducted by Boston-based AIR Worldwide Corp., insurers' data is sorely lacking-with inaccurate property replacement values, incomplete information on construction type, occupancy class and locations leading the list of data troubles.
Spurred by the aftereffects of Hurricane Katrina, however, insurance companies are likely to realize just how important it is to use good data in these CAT models, says RMS' VanderMark.
"Although the insurance industry has come long way in capturing better information on the insured, Katrina revealed many gaps, shortcomings and deficiencies in the quality, resolution and completeness of data that insurance carriers have on what they are insuring," VanderMark says.
For example, insurers should make it a goal to bring more complete and granular data to their CAT models. When working in high-risk areas, for instance, insurers should not only get ZIP code information but should pinpoint exactly where the insured lives.
"They need to know if they are insuring someone on the beach or if they are just insuring someone who lives in a ZIP code that is on the beach," VanderMark says.
How Insurers Have Updated Their Disaster Plans
Getting back on track and serving the needs of customers were certainly the most pressing tasks at hand in the wake of Katrina. Job No. 2? Learning from the experience. Indeed, insurance companies are now incorporating what they learned to move forward with even more effective disaster recovery plans.
Executives at Pan American Life Insurance Co., New Orleans, are meeting regularly to talk about what they learned from the disaster and how they can improve their disaster recovery plans based on some of these lessons.
"We have been meeting every two weeks to discuss what went well and what we could have done differently," McGonagle says. "Then, we are updating our plans with some of these new ideas."
Here are just a few of the "lessons" that Pan American and other companies are incorporating into their new disaster recovery plans:
Share the decision-making power. Gilsbar Inc., a New Orleans-based third-party administrator, had designated executives who could declare disasters and start to implement disaster plans before Katrina. After dealing with the severity of the storm, however, executives realized that when disasters hit, employees need to have a higher level of empowerment.
"Before, only the president and COO could declare a disaster," Hennegan says. "Now, however, there is an expanded set of executives who can declare a disaster. Basically, they can declare the disaster and start the business on the road to recovery without having to wait."
Pan American is also providing its staff members with more decision-making authority. "In times of disaster, people need to make decisions quickly. You need to be able to drop the hierarchy and job description, do what you need to do and apologize later," McGunagle says
.- Create a mirror Web site. Gilsbar is creating a mirrored Web site, essentially a replica of its existing site that can be accessed when and if the original site is no longer available due to a disaster. "If we experience another disaster where we lose access to our building or lose Internet service, then we will be able to quickly direct the public to our mirrored Web site," Hennegan says.
Outsource data processing. While executives at Pan American had been considering outsourcing their data processing and networking functions to a service provider for some time, the decision was easy to make in the aftermath of Katrina, McGonagle says.
"We decided to outsource our data processing and networking to CSC so in the event of another hurricane or major disaster, we won't have to worry about that aspect of the recovery," McGonagle says. In addition, by using CSC-a global outsourcing company-the data will not be as vulnerable as if it were in one location.
"They are just more immune to some of the effects of a disaster because they have so many sites. They can instantaneously switch our data from one location to another location virtually anywhere in the world," McGonagle says.
Develop a long-term recovery plan. While most, if not all, insurance companies had disaster recovery plans in place, many of these plans only accounted for relatively short recovery times. As companies move forward with new disaster recovery plans, they are likely to account for the possibility of much longer recovery times.
"We had an emergency plan in place but it was based on the possibility of being out of the office for maximum of one week. Now, as we revise our plan, we will be looking at the possibility of not having access to our offices for much, much longer periods of time," says W. Anderson Baker, III, president of Gillis, Ellis & Baker, Inc., an insurance agency based in New Orleans.
John McCormack is a freelance writer based in Riverside, Ill.
