When Hurricane Sandy struck the Northeastern United States in October 2012, many corporate risk managers and insurance companies were taken by surprise. Few were prepared for hurricane-force winds in Atlantic City, New Jersey, or for the storm surge that hit New York City. Total damages are estimated at more than $50 billion, making “Superstorm Sandy” the second-costliest hurricane in U.S. history.

As a result, insurers are reconsidering the pricing and terms of policies for businesses up and down the East Coast. Now that the 2013 hurricane season has arrived, Treasury & Risk asked Al Tobin, national property practice leader for Aon Risk Solutions, what finance and risk managers should be doing to prepare their businesses for the next major storm.

T&R:  What impact did Hurricane Sandy have on the insurance industry in the U.S.?

Al Tobin:  Sandy had a big impact. In 2011, people were surprised by Hurricane Irene. Then in 2012 Sandy came along, and it was much larger than Irene. These storms caused considerable damage from both winds and rain all the way up through the state of Vermont. Hurricanes are expected in Florida, but the insurance companies were really taken aback to have events of this magnitude in the Northeast.

These two hurricanes have changed forever the way insurance companies evaluate risks in this part of the country. They're taking a hard look at the capacity they're going to provide, especially when it comes to locations in the flood plain. Zone A Flood has always been a restricted kind of coverage, but it was loosened over the past decade or two. That has been tightened up.

T&R:  What is changing for corporate risk managers as a result?

AT:  Today the carriers are looking harder at exposures related to hurricanes in the Northeast. If you're near the coast, you probably have a different deductible today than you had prior to Irene.

T&R:  Are companies having difficulty finding insurance, or is it mostly a matter of pricing and limits?

AT:  The changes have mostly affected pricing and terms and conditions. We view availability as strong right now.

T&R:  Beyond the obvious property damage, how did Sandy impact businesses in the region?

AT:  The commercial real estate industry was very severely affected. From large, national schedules all the way down to local owners of one or two buildings in Manhattan, the water destroyed a lot of the equipment in the buildings down here.

T&R:  Were there also a lot of claims related to business continuity or supply chain issues?

AT:  I wouldn't say a lot. Supply chain and BCP (business continuity plan) problems arise more with events like a tsunami in Thailand or an earthquake in Japan. But what you did have in New York and across the region were losses that stemmed from civil authority. Some companies that didn't have physical damage lost revenues because there was an evacuation of the area.

T&R:  So, what can risk managers do now to prepare for another storm like Irene or Sandy?

AT:  In the Northeast, prior to Irene, the take-up rate was pretty low for the National Flood Insurance Program, the NFIP. Plus, when companies had a chance to look at flood sub-limits, sometimes they'd save the money because they had never experienced a flood-related loss.

So the first thing risk managers should do to prepare is to look into the NFIP. For corporations, they generally have a reasonable cost. And the insurance companies are going to raise flood deductibles, so clients will want to mitigate that deductible change by buying flood insurance. Secondly, risk managers need to make sure they know the limits that they're buying and the sub-limits for flood coverage. If they aren't comfortable with those limits, they can consider buying what we call “excess flood insurance.”

Suppose you're a business in Flood Zone A. You might have a program that starts with the National Flood Insurance. That basically picks up your deductible for a broader business policy that you purchase from, let's say, Insurance Company A. But Insurance Company A will only provide a $5 million sub-limit for floods, because that's their maximum. If you think you're susceptible to a loss greater than the limits of the NFIP and the $5 million, you can add another policy, maybe $10 million of excess flood insurance placed in the open market.

T&R:  Is there anything risk managers can do to mitigate potential future damage?

AT:  There are lots of available tools and services to help evaluate risk, but if you own a 40-year-old building and you're in a flood zone, there's not much you can do to prevent losses except buy flood insurance. I can tell you this, though: After events where people suffer a loss—especially if it's a total loss—they tend to build their property back as robustly as they can.

T&R:  What else can a corporate risk manager learn from Hurricane Sandy?

AT:  One of the most important things is that they need to read their insurance policy. It's boring and pretty basic, but you really need to know what your limits and sub-limits are. I've been to a few conferences post-Sandy, and I've come away a little shocked. Some of the smaller businesses and smaller brokerages knew very little about what their policy would cover in the event of a hurricane, or what to do after a loss to be indemnified. I guess that's a function of the fact that they'd never had to use their flood coverage. But these days, whether you're paying $50,000 or $5 million, you need to read your policy and have a general idea of what's insured under it.

Also, companies need to have a written plan for how the business is going to run after there's been an event. It should identify, before the event, the professionals that the company is going to use—such as accounting firms, remediation firms, and the like—and it needs to stay updated. If your business continuity plan is 10 years old, it's not going to be very effective. Phones, computers, everything is different. Putting that together is definitely worth some time.