robintek

Most privately held businesses have not implemented effective steps to protect themselves against a variety of risks, according to a recent nationwide study.

The Chubb 2013 Private Company Survey, based on interviews from executives at 450 U.S. companies, uncovered a number of disturbing conclusions. For example:

• Although nearly three in four of respondents (73%) use a third-party provider to administer their employee benefits plan, fewer than half (46%) have taken steps to reduce their fiduciary liability.
• Only two in five (42%) have a broad policy against hiring employees with criminal backgrounds, which could be a violation of state law.
• Among the more than two in three companies( 68%) that use social media, only one in ten (12%) percent are concerned about being sued for defamatory posts, while fewer than half (48%) have a written social media usage policy for employees.

During the past three years, approximately half of respondents suffered at least one loss from such exposures as employment practices liability, fiduciary liability, crime, workplace violence, and cyber liability.

“Many private companies have not taken loss prevention measures or purchased the appropriate insurance to help insulate themselves from litigation, government fines, and their related financial and reputational consequences,” says Tracey Vispoli, Chubb Senior Vice President and Specialty Insurance Global Customer Segments Leader. She add that, “This is surprising, because a large number of these firms have been sued in recent years by employees, customers, government agencies; and other parties; and many are planning to participate in activities such as mergers that can increase their risk profile.”

How effective is your risk management program?

In its 2013 Data Breach Investigations Report, Verizon Enterprise found that nearly three in four cybersecurity breaches (74%) to small businesses are “crimes of opportunity” that occur because a hacker notices and exploits a weakness in the system: the cyber equivalent of a robber seeing a window propped open and a wallet on the sill.

The report also shows that nearly half of these breaches (48%) result from basic mistakes by non-technical employees with no expertise in in data security.

To protect themselves against financial losses from stolen or compromised client information, more and more firms are carrying cyber liability coverage. However, a preventive approach that focuses on beefing up IT security can play a key role in minimizing costly claims from data breaches– which helps keeps premiums under control and reduces the time, expense, and hassle of litigation from angry clients.

Ted Devine, CEO of TechInsurance (Allen, TX), recommends that businesses reduce this risk exposure by going “back to the basics.”

1. Provide training. Make sure that non-tech employees understand and implement best practices for storing data, sharing files, and transporting hardware.
2. Encourage password security measures. According to the Verizon Enterprises report, more than three in four data breaches (76%) take place because a hacker is able to guess a password. The solution: create strong passwords and update them regularly.
3. Use antivirus software.
4. Encrypt sensitive data and limit access to it.
5. Set up protocols for off-premises work.

For more information, see the article “Workers’ Electronic Devices Pose Risks for Employers” in this newsletter).

If you’d like a complimentary review of your company’s data security procedures, just give us a call.

The widespread practice of employees bringing their own electronic devices to work can be risky for businesses. However, despite the growth of this trend, one nationwide study found that 60% of companies surveyed had no policy for dealing with remote access, while 80% provided no training about the potential risks involved.

One key issue with the use of these devices is the blurring of lines between employees’ personal and work life, which involves such questions as: 1) potential violations of employees’ privacy rights; 2) whether firms should buy electronic devices for lower-level workers who would not purchase them on their own; 3) who backs up the data and where; 4) whether companies should pay overtime when workers use these devices outside of regular hours: and 5) who owns the data (an issue that can arise when an employee leaves the company).

Another major danger involves a firm’s loss of control over its data.

The good news: you can take steps to reduce these risks. For example, workers should be sure to use effective password protection procedures. Warns one data security specialist, “Don’t just use ‘1234,’ and whatever password you choose, never put a sticky note on the back of your device.” Experts also recommend loading security apps onto devices to protect them and requiring workers to turn on the remote erasure capabilities of their devices.

Last, but not least, make sure to encrypt data on all devices. (Many states exempt companies from notifying clients about a data breach on lost or stolen devices if this information is encrypted).

Our specialists would be glad to offer their expertise on helping you reduce the risks of your workers using mobile devices on the job.

Twenty-five years ago, the oil tanker Exxon Valdez struck a reef in Prince William Sound, AK, spilling more than 11 million gallons of crude oil – an environmental catastrophe that cost ExxonMobil $507 million in punitive damages (not to mention the impact to the company’s reputation).

In the wake of this disaster, the giant conglomerate implemented a fundamental shift in its corporate culture to stress safety and preparedness throughout the organization – a focus that businesses from mom-and-pop retail stores to construction companies can use to manage risk. Rather than simply publishing policy and procedural guidelines, ExxonMobil management stressed the need for workers to execute every task, even the most basic, with care and consideration for unintended consequences. For example:

• Employees were told to back their cars into parking spaces so they could see clearly if they needed to pull away during a potential emergency.
• Daily acts that might have hazardous consequences (such as not turning off a coffee burner or wiping up after a spill) could lead to written reprimands.
• Departments organized safety meetings and competitions, with prizes for acts as minor as making sure that file drawers were closed. Managers and workers used these sessions to share stories of near misses or catastrophes averted. This approach was so pervasive that it spread to sharing safety tips for employees’ personal lives.

The result: dramatic reductions in insurance claims (and premiums) litigation, on-the-job accidents, and lost worker hours – not to mention human misery.

Your business can learn from ExxonMobil’s example by creating and promulgating your own culture of preparedness.

As always, our agency stands ready to help you implement a comprehensive risk management program.