Locating properties on a flood map only shows the flood zone a building is in and whether the zone is high risk, while flood modeling provides loss projections, Macartney says. "For a client that has a property in a flood area, it gives them a good idea of the future flooding."

The ability to model flooding has lagged behind the modeling of other catastrophes, like earthquakes and hurricanes, in part because modeling floods requires so much data, says Don Parkes, senior director of business solutions at First American Spatial Solutions, a unit of First American, the Santa Ana, Calif.-based provider of title insurance.

While hurricanes and earthquakes involve only parts of the country, modeling floods means mapping the entire United States, Parkes says. And because flooding can hit one property and leave untouched another property just 100 meters away, modeling the risk must take into account myriad details if it's to be accurate, he says. "Elevation and structure and how the water flows really matter."

Identifying the precise location of a property is also important if modeling is to be accurate, and that's where First American's database comes in. "We've mapped over 85% of the property lines in the United States, with a heavy emphasis along the coast line and river areas, and population areas," Parkes says.

Marsh's fee for the modeling is based on the total insurance value of the client's property, Macartney says, adding that "there's a lot of risk management you can do through getting the modeling."

Achieving a better understanding of how much exposure its properties have to flooding can save a company money by identifying properties that don't require flood insurance, he says. The information can also help companies decide how much flood insurance they need, play a role in decisions about acquiring property or indicate that certain facilities could benefit from remediation, Macartney says. "It's also very helpful to the underwriters when they assess the client's risk."

RISK MANAGEMENT

Internal Auditors Regroup

While complying with Sarbanes-Oxley kept internal auditors busy earlier in this decade, internal audit departments are now reorienting themselves to a broader range of responsibilities. Seventy-three percent of audit executives surveyed by risk consultancy Protiviti in May say they are working on rebalancing their priorities or have already done so.

Richard Chambers, CEO of the Institute of Internal Auditors, notes that internal audit is charged with assessing a company's higher-risk areas, and over the last 18 to 24 months, many companies' risk profiles have changed greatly.

"The economy has created a new set of risks," Chambers says, and notes that during recessions, internal audit groups tend to focus more on cost containment and the detection of fraud.

One method companies are using to move beyond Sarbanes-Oxley is to implement risk-based testing, which was cited by 66% of the audit executives surveyed by Protiviti; rescoping their workload was cited by 65%.