When Hurricane Sandy struck the Northeastern United States inOctober 2012, many corporate risk managers and insurance companieswere taken by surprise. Few were prepared for hurricane-force windsin Atlantic City, New Jersey, or for the storm surge that hit NewYork City. Total damages are estimated at more than $50 billion,making “Superstorm Sandy” the second-costliest hurricane in U.S.history.

As a result, insurers are reconsidering the pricing and terms ofpolicies for businesses up and down the East Coast. Now that the2013 hurricane season has arrived, Treasury &Risk asked Al Tobin, national property practice leader forAon Risk Solutions, what finance and risk managers should be doingto prepare their businesses for the next major storm.

T&R: What impact did HurricaneSandy have on the insurance industry in the U.S.?

Al Tobin: Sandy had a big impact. In2011, people were surprised by Hurricane Irene. Then in 2012 Sandycame along, and it was much larger than Irene. These storms causedconsiderable damage from both winds and rain all the way up throughthe state of Vermont. Hurricanes are expected in Florida, but theinsurance companies were really taken aback to have events of thismagnitude in the Northeast.

These two hurricanes have changed forever the way insurancecompanies evaluate risks in this part of the country. They'retaking a hard look at the capacity they're going to provide,especially when it comes to locations in the flood plain. Zone AFlood has always been a restricted kind of coverage, but it wasloosened over the past decade or two. That has been tightenedup.

T&R: What is changing forcorporate risk managers as a result?

AT: Today the carriers are looking harderat exposures related to hurricanes in the Northeast. If you're nearthe coast, you probably have a different deductible today than youhad prior to Irene.

T&R: Are companies havingdifficulty finding insurance, or is it mostly a matter of pricingand limits?

AT: The changes have mostly affectedpricing and terms and conditions. We view availability as strongright now.

T&R: Beyond the obvious propertydamage, how did Sandy impact businesses in the region?

AT: The commercial real estate industrywas very severely affected. From large, national schedules all theway down to local owners of one or two buildings in Manhattan, thewater destroyed a lot of the equipment in the buildings downhere.

T&R: Were there also a lot ofclaims related to business continuity or supply chainissues?

AT: I wouldn't say a lot. Supply chainand BCP (business continuity plan) problems arise more with eventslike a tsunami in Thailand or an earthquake in Japan. But what youdid have in New York and across the region were losses that stemmedfrom civil authority. Some companies that didn't have physicaldamage lost revenues because there was an evacuation of thearea.

T&R: So, what can risk managersdo now to prepare for another storm like Irene or Sandy?

AT: In the Northeast, prior to Irene, thetake-up rate was pretty low for the National Flood InsuranceProgram, the NFIP. Plus, when companies had a chance to look atflood sub-limits, sometimes they'd save the money because they hadnever experienced a flood-related loss.

So the first thing risk managers should do to prepare is to lookinto the NFIP. For corporations, they generally have a reasonablecost. And the insurance companies are going to raise flooddeductibles, so clients will want to mitigate that deductiblechange by buying flood insurance. Secondly, risk managers need tomake sure they know the limits that they're buying and thesub-limits for flood coverage. If they aren't comfortable withthose limits, they can consider buying what we call “excess floodinsurance.”

Suppose you're a business in Flood Zone A. You might have aprogram that starts with the National Flood Insurance. Thatbasically picks up your deductible for a broader business policythat you purchase from, let's say, Insurance Company A. ButInsurance Company A will only provide a $5 million sub-limit forfloods, because that's their maximum. If you think you'resusceptible to a loss greater than the limits of the NFIP and the$5 million, you can add another policy, maybe $10 million of excessflood insurance placed in the open market.

T&R: Is there anything riskmanagers can do to mitigate potential future damage?

AT: There are lots of available tools andservices to help evaluate risk, but if you own a 40-year-oldbuilding and you're in a flood zone, there's not much you can do toprevent losses except buy flood insurance. I can tell you this,though: After events where people suffer a loss—especially if it'sa total loss—they tend to build their property back as robustly asthey can.

T&R: What else can a corporaterisk manager learn from Hurricane Sandy?

AT: One of the most important things isthat they need to read their insurance policy. It's boring andpretty basic, but you really need to know what your limits andsub-limits are. I've been to a few conferences post-Sandy, and I'vecome away a little shocked. Some of the smaller businesses andsmaller brokerages knew very little about what their policy wouldcover in the event of a hurricane, or what to do after a loss to beindemnified. I guess that's a function of the fact that they'dnever had to use their flood coverage. But these days, whetheryou're paying $50,000 or $5 million, you need to read your policyand have a general idea of what's insured under it.

Also, companies need to have a written plan for how the businessis going to run after there's been an event. It should identify,before the event, the professionals that the company is going touse—such as accounting firms, remediation firms, and the like—andit needs to stay updated. If your business continuity plan is 10years old, it's not going to be very effective. Phones, computers,everything is different. Putting that together is definitely worthsome time.