Given the number of major flood occurrences in India in the past decade, European and US companies with exposures in the country should review their insurance coverage and disaster management planning.
As the waters start to subside following India’s latest monsoon flooding disaster, IT companies and call centres in the country’s high tech hubs of Bengalaru and Gurgaon begin counting the cost.
Whilst cyber is currently one of the hottest topics in the insurance market, the focus has been on hacking, data breaches and malicious attacks, as opposed to the more tangible risk of natural catastrophes and flooding on a company’s IT infrastructure. As cloud computing and outsourcing continue to become commonplace, has due consideration been given to the location of data centres and outsourcing companies and the risks they face?
India is one of the most susceptible countries to flooding with average annual economic losses in excess of USD 7 billion according to the United Nations Office for Disaster Risk Reduction (UNISDR). Some of the worst flooding in recent years has occurred in the north (Bihar, Assam and Utterakhand) resulting in terrible loss of life, but somewhat limited economic effects. However, worryingly these events have become increasingly commonplace in India’s metropolises, with many blaming poor urban planning. This has been typified by the 2015 Chennai floods and the latest inundations in Bangaluru and Guragon, putting at risk higher numbers of casualties and significant economic losses.
Third Party IT Companies
The key selling point of third party IT outsourcing companies is keeping costs down. Unsurprisingly many may not have the resources to engage in sophisticated levels of risk management, and may only have a minimal or non-existent disaster recovery plan. This calls into question how quickly these businesses can recover from a flooding event regardless of whether or not insurance coverage is in place. Even if the building can be recovered quickly, what about vital services such as electricity, water and internet, or the surrounding infrastructure such as roads, bridges and railways which allow employees to get to work? What about key personnel whose houses and possessions may have been lost or damaged in the same event? All of which take time to recover.
Typically, Business Interruption (BI) policies have the option for a “customers and suppliers” extension to cover contingent business interruption (CBI). However, unnamed suppliers are usually subject to lower sub-limits, since underwriters cannot accurately gauge potential exposure. Given the complexity of supply chains and increase in outsourcing, it is paramount that consideration be given to the definition of a supplier, and whether the extension applies to direct suppliers only or broadened to consider additional tiers. For example, many US or UK based IT companies have a large number of their global workforce and back office infrastructure located in India, therefore whilst your contract may be with a US or UK company, the services may ultimately be performed further afield by a second tier, unnamed supplier. This may result in a claim that is subject to sub-limits or even worse for the insured, not covered at all, as the supplier must fit within the definition of an insured supplier for the coverage to apply.
“Denial of Access” and “Service Interruption” coverages are important, especially where employees are your key capital and services such as electricity and the internet are vital to business functionality. These coverages (where present) may also carry further sub-limits and/or longer waiting periods. Consideration should be given to potential outages caused by these exposures. The wording for “Denial of Access” should also be considered in light of potential scenarios, since there may be limits in proximity. Yet a damaged bridge or railway line further afield could leave employees unable to reach work. In the event of a significant outage at a third party IT outsourcing company, it is possible that economic losses to a business will significantly exceed sub-limits and will consequently hit the company’s bottom line. It could be suggested as being somewhat short-sighted to outsource IT to places such as India from a cost reduction perspective, without considering the risk management consequences. There may well be a service level agreement (SLA) in place, however this is not much protection when the IT outsourcing company is under several feet of water for a week or more.
For call centres, another business service which has historically flourished in India, the flooding may have caused physical damage to property or service interruption to phone lines and internet infrastructure, meaning calls cannot be responded to. Of course, the calls will keep coming in, therefore this may lead to an increased cost of working (ICOW) for businesses as they re-route calls to other call staff in the UK, or elsewhere, for a period of time, whilst incurring overtime costs and unsociable hours’ payments to staff to cover the downtime of their Indian counterparts. Where calls cannot be answered, non-placement of orders could potentially lead to Business Interruption losses if customers are forced to go to the competitor to source what they need.
With flooding also preventing employees’ ability to get to work, there may be coverage issues for Insurers to consider, especially where premises remain undamaged. Identifying the cause or multiple causes of loss has been a common issue where wide area damage (WAD) is present, such as following the 2011 Thailand floods. Applying the principles of the Orient Express decision could lead to a significant reduction in the recoverable business interruption claim, if losses were deemed to have been suffered concurrently with an uninsured cause, such as general transportation difficulties.
Virtual IT Support
For software engineers and coders who can work from virtually anywhere with a computer and an internet connection, travelling to work may not be an issue, but what happens when they don’t have an internet connection? Can they work overtime to catch up? Can a delay to a software launch be quantified?
Unfortunately, in a country where insurance penetration is notoriously low, it is likely that many of these companies will not have relevant cover. In fact, based on India’s General Insurance Corporation just USD 300 million of claims were reported from the Chennai floods in 2015 compared with estimated total economic losses in the region of USD 3 billion, according to AON Benfield’s catastrophe report. It would therefore seem likely that this latest flood will run a similar course.
Given the number of major flood occurrences over the last decade, companies with exposure in India should at the very least, revisit their insurance coverage and disaster planning, otherwise the next event could be extremely costly.