Terrorism Insurance: Treasury Needs to Collect and Analyze Data to Better Understand Fiscal Exposure and Clarify Guidance
Published: 2014-05-22T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Congress passed TRIA in 2002 to help ensure the availability and affordability of terrorism insurance for commercial property and casualty policyholders after the September 11, 2001, terrorist attacks. TRIA was amended and extended twice and currently will expire at the end of 2014. Under TRIA, Treasury administers a program in which the federal government and private sector share losses on commercial property and casualty policies resulting from a terrorist attack. Because the federal government will cover a portion of insured losses, the program creates fiscal exposures for the government. GAO was asked to review TRIA.
This report evaluates (1) the extent of available data on terrorism insurance and Treasury's efforts in determining federal exposure, (2) changes in the terrorism insurance market since 2002, and (3) potential impacts of selected changes to TRIA. To address these objectives, GAO analyzed insurance data, information from 15 insurers selected primarily based on size of insurer, interviewed Treasury staff and industry participants, updated prior work, and developed examples to illustrate potential fiscal exposure under TRIA.
section_title: What GAO Found
paragraphs: Comprehensive data on the terrorism insurance market are not readily available and Department of the Treasury (Treasury) analysis to better understand federal fiscal exposure under various scenarios of terrorist attacks has been limited. Treasury compiled some market data from industry sources, but the data are not comprehensive. Federal internal control standards state that agencies should obtain needed data and analyze risks, and industry best practices indicate that analysis of the location and amount of coverage helps understand financial risks. However, without more data and analysis, Treasury lacks the information needed to help ensure the goals of the Terrorism Risk Insurance Act (TRIA) of ensuring the availability and affordability of terrorism risk insurance and addressing market disruptions are being met and to better understand potential federal spending under different scenarios.
Available data show that terrorism insurance premiums and other market indicators are stable. For example, estimated terrorism insurance premiums have been relatively constant since 2010 (see figure). Insurers told GAO that, in 2012, terrorism insurance premiums made up on average less than 2 percent of commercial property and casualty premiums. According to industry participants, prices for terrorism coverage have declined, the percentage of businesses buying coverage seems to have leveled recently, and insurers' ability to provide it has remained constant.
Insurers and other industry participants cited concerns about the availability and price of terrorism coverage if TRIA expired or was changed substantially, but some changes could reduce federal fiscal exposure. Some insurers GAO contacted said they would stop covering terrorism if TRIA expired. Changes such as increasing the deductible or threshold for required recoupment of the government's share of losses through surcharges on all commercial policyholders could reduce federal fiscal exposure. Most insurers GAO contacted expressed concerns about solvency and ability to provide coverage if their deductible or share of losses increased. Insurers were less concerned about increases to the thresholds for government coverage to begin or to the required recoupment of the government's share of losses.
section_title: What GAO Recommends
paragraphs: Treasury should collect and analyze data on the terrorism insurance market to assess the market, estimate fiscal exposure under different scenarios, and analyze the impacts of changing program parameters. Treasury agreed with these recommendations.

section_title: Letter
paragraphs: The terrorist attacks of September 11, 2001, which resulted in reported  total insured losses of roughly $43 billion (2013 dollars), drastically  changed the way insurers viewed the risk of terrorism. Insurers must be  able to predict the frequency and severity of insured losses with some  reliability to best manage financial risk. Unpredictable and infrequent  events, such as terrorist attacks, can cause severe losses that  substantially deplete insurers’ capital. If a company determines that the  risk of loss is unacceptably high relative to the premiums it can charge,  the company may cease offering coverage. This was the case after  September 11, 2001, when insurers generally stopped covering terrorism  risk.
In November 2002, Congress enacted the Terrorism Risk Insurance Act  of 2002 (TRIA) to help ensure the continued availability and affordability  of commercial property and casualty insurance for terrorism risk and  address concerns that the lack of terrorism insurance could have  significant effects on the economy. TRIA requires the Department of the  Treasury (Treasury) to administer a program in which the government  would share some of the losses with private insurers in the event of a  certified act of terrorism. In addition to requiring insurers to make  terrorism coverage available to commercial policyholders, the program  creates a public-private loss-sharing mechanism—through which private  insurers pay deductibles and copayments (or coshares) in the event of a  terrorist attack and the government shares a portion of the losses. The  amount of government loss sharing depends on the size of the insured  loss. The program was intended to be temporary (3 years), but was  extended and modified twice––in 2005 and 2007––and expires on  December 31, 2014. As of May 2014, no certified acts of terrorism had  occurred to trigger the program. As a result, the program has not received  any claims from insurers and made no payments.
Recently, policymakers and insurance industry experts have debated the  role of the federal government in supporting insurance coverage for acts  of terrorism. Some have raised questions about whether the program  hinders the development of the private market and continues to expose  the government (and thus taxpayers) to insurance losses on private  property. Others in the insurance sector have stated that insurers would  be unwilling to cover terrorism risk without the government program in  place. In addition, some have indicated that because of recoupment the  program was designed to be budget neutral under most circumstances  (with the exception of very high insured losses that may result from a  large-scale attack). Finally, recent congressional hearings focused on  possible changes to the current program and debated the appropriate  time frame of any potential reauthorization.
You asked us to review the program and market for terrorism risk  insurance. This report (1) evaluates the extent of available data and  Treasury’s efforts in determining the government’s exposure, (2)  describes changes in the terrorism insurance market since 2002, and (3)  evaluates potential impacts of selected changes to TRIA.
To address these objectives, we obtained information and interviewed  representatives from Treasury and the National Association of Insurance  Commissioners (NAIC). We reviewed applicable laws, regulations, and  information about loss sharing created by the program and any  corresponding government recoupment. Additionally, we obtained and  reviewed available data on premiums, capacity, pricing, and take-up rates  (the percentage of businesses buying terrorism coverage) from 2003  through 2013 from insurance brokers Marsh and McLennan Companies,  Inc. (Marsh) and Aon plc, the largest insurance brokers in the United  States, and A.M. Best, an insurance rating agency. We interviewed  representatives from Marsh, Aon, and A.M. Best about their data  collection methods and reviewed related documentation to help ensure  we had a clear understanding of their data and any limitations. The data  from these sources, although not containing information from all insurers  that provide terrorism coverage, capture a large portion of this segment of  the insurance market. We found the data from these sources are the best  available and are sufficiently reliable for our purposes.
We also obtained information as part of a questionnaire we sent to 15  insurance companies (insurers), all of which had businesses purchase  terrorism coverage from them in 2012. The 15 companies are not  representative of the entire market, but represented a major portion–– roughly 40 percent of the commercial property and casualty market by  direct earned premium volume for 2012, according to SNL Financial  data. Through the questionnaire and follow-up interviews, we obtained  proprietary data from the insurers about their terrorism coverage,  premium volume, and underwriting decisions. Additionally, we obtained  their views on potential modifications to TRIA and how any modifications  would affect the market. For the purposes of this report, we aggregated  and summarized responses from these insurers. Their responses may or  may not be representative of all insurers in the property and casualty  market, but their experiences and views offer insights directly into this  group of insurers. We also interviewed industry participants about  terrorism insurance, such as representatives from insurance trade  associations, terrorism risk modeling firms, rating agencies, and  insurance brokers. Finally, we developed illustrative examples to help  demonstrate estimated changes in the magnitude of fiscal exposure  under different, hypothetical parameters for the terrorism risk insurance  program. To develop these examples, we consulted with experts from  terrorism risk modeling firms, reviewed relevant literature, and made  several assumptions. The illustrative examples are not specific  determinations of federal fiscal exposure under TRIA. Appendix I of this  report contains more detailed information about our objectives, scope,  and methodology.
We conducted this performance audit from July 2013 to May 2014 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: From an insurance standpoint, measuring and predicting terrorism risk is  challenging. According to standard insurance theory, four major principles  contribute to the ability of insurers to estimate and cover future losses: the  law of large numbers, measurability, fortuity, and the size of the potential  losses. When determining whether to offer coverage for a particular risk  and at what price, insurers evaluate whether sufficient information exists  about each of these principles. To underwrite insurance—that is, decide  whether to offer coverage and what price to charge—insurers consider  both the likelihood of an event (frequency) and the amount of damage it  would cause (severity). As we have reported, measuring and predicting  losses associated with terrorism risks can be particularly challenging for  reasons including lack of experience with similar attacks, difficulty in  predicting terrorists’ intentions, and the potentially catastrophic losses that  could result from terrorist attacks. Increasingly, insurers use  sophisticated modeling tools to assess terrorism risk, but there have been  very few terrorist attacks, so there are little data on which to base  estimates of future losses, in terms of frequency or severity, or both.
When Congress passed TRIA in 2002, its purposes included making  terrorism insurance widely available and affordable for businesses. As  required by TRIA, insurers must make terrorism coverage available to  commercial policyholders, although commercial policyholders are not  required to buy it. As shown in table 1, many lines of commercial property  and casualty insurance are eligible for TRIA, but the legislation  specifically excludes certain lines. For example, the law excludes  personal property and casualty insurance, as well as health and life  insurance.
TRIA requires an insurer to make terrorism coverage available to its  policyholders for insured losses that does not differ materially from the  terms, amounts, and other coverage limitations applicable to losses  arising from events other than acts of terrorism. For example, an insurer  offering $100 million in commercial property coverage must offer $100  million in coverage for property damage from a certified terrorist attack.  Insurers can charge a separate premium to cover terrorism risk, although  some include the price in their base rates for all-risk policies.
subsections: section_title: Public-Private Loss Sharing under TRIA
paragraphs: Under the current program, Treasury would reimburse insurers for a  share of losses associated with certain certified acts of foreign or  domestic terrorism. A single terrorist act must cause at least $5 million in  insured losses to be certified; separately, the aggregate industry insured  loss from certified acts must be at least $100 million for government  coverage to begin (program trigger). If an event were to be certified as an  act of terrorism and the insured losses exceed the program trigger, then  an individual insurer that experienced losses would pay a deductible of 20  percent of its previous year’s direct earned premiums in TRIA-eligible  lines (insurer deductible). After the insurer pays its deductible, the federal  government would reimburse the insurer for 85 percent of its losses and  the insurer would be responsible for the remaining 15 percent (coshare).  Annual coverage for losses is limited––aggregate industry insured losses  in excess of $100 billion are not covered by private insurers or the federal  government (cap). See figure 1 for an illustration of these program  parameters.
The amount of federal loss-sharing varies with the amount of industry  insured losses, as the following shows:  In general, for an event with insured losses of less than $100 million,  private industry covers the entire loss and the federal government  faces no responsibility to cover losses.  In general, for an event with insured losses from $100 million to $100  billion private industry and the federal government initially share the  losses, but TRIA includes a provision for mandatory recoupment of  the federal share of losses when private industry’s uncompensated  insured losses are less than $27.5 billion. Treasury must impose  policyholder premium surcharges on all property and casualty  insurance policies until total industry payments reached the  mandatory recoupment amount or the government is fully repaid,  whichever comes first. The mandatory recoupment amount is the  difference between $27.5 billion and the aggregate amount of  insurers’ uncompensated insured losses. This industry aggregate  retention amount was set in the 2005 reauthorization for the year  2007 at $27.5 billion and extended as applicable for all future years  under the program by the 2007 reauthorization. When the amount of  federal assistance exceeds any mandatory recoupment amount, TRIA  also allows for discretionary recoupment, if Treasury determines  additional amounts should be recouped. Under TRIA, any  discretionary recoupment would be based on the ultimate cost to  taxpayers, the economic conditions in the marketplace, the  affordability of insurance for small and medium-sized businesses, and  any other factors Treasury considered appropriate.
As initially enacted, one of the purposes of TRIA was to provide a  transitional period in which the insurance market could determine how to  model and price terrorism risk. Congress reauthorized TRIA twice––in  2005 and 2007. As shown in table 2, the reauthorizations changed  several aspects of the terrorism risk insurance program, including the  insurer deductible, lines of insurance covered, and types of terrorist acts  covered (added domestic terrorism). TRIA covers insured losses resulting  from an act of terrorism, which is defined, in part, as a “violent act or an  act that is dangerous” to human life, property, or infrastructure. The act is  silent about losses from attacks with nuclear, biological, chemical, or  radiological weapons (NBCR) or from cyber terrorism.
section_title: Program Administration and Reporting Requirements
paragraphs: TRIA authorizes Treasury to administer the Terrorism Insurance Program.  Specifically, the Terrorism Risk Insurance Program Office within  Treasury’s Office of Domestic Finance administers the program and  manages day-to-day operations, with oversight and assistance from the  Federal Insurance Office, according to Treasury officials. In 2004,  Treasury issued regulations to implement TRIA’s procedures for filing  claims for payment of the federal share of compensation for insured  losses. Upon certification of an act of terrorism, Treasury will activate a  web-based facility for receiving claims from insurers and responding to  insurers that seek assistance. According to Treasury, currently five staff  work directly on the program and the program is assisted by others in  Treasury. Staff responsibilities include managing contractors in place to  process claims in the event of an attack and making any necessary  changes to program regulations. According to Treasury, the spending for  this program has generally declined since 2003 (see fig. 2).
TRIA mandates various studies and data compilation efforts. For  example, TRIA requires GAO, Treasury, and the President’s Working  Group on Financial Markets (PWG) to complete various studies related to  terrorism risk insurance. We have completed and submitted to Congress  several mandated studies on TRIA. Treasury completed an assessment  of the program and submitted a report to Congress in 2005. PWG must  periodically report on terrorism market conditions (in 2006, 2010, and  2013). TRIA also requires Treasury to annually compile information on  the terrorism risk insurance premium rates of insurers for the preceding  year. In the event that information is not otherwise available to Treasury,  Treasury may require each insurer to submit that information to NAIC. We  discuss data compilation requirements in more detail later in this report.
section_title: State Regulation of Insurance
paragraphs: Insurance in the United States is primarily regulated at the state level.  The insurance regulators of the 50 states, the District of Columbia, and  the U.S. territories created and govern NAIC, which is the standard- setting and regulatory support organization for the U.S. insurance  industry. Through NAIC, state insurance regulators establish standards  and best practices, conduct peer review, and coordinate their regulatory  oversight. According to NAIC, insurers set the rates for terrorism  coverage, and state law requires insurers to file those rates (and to file  insurance forms) with state regulators. Generally state insurance  regulators receive information from insurers regarding the products the  insurers plan to sell in the state. States vary with regard to timing and  depth of the reviews of the insurers’ rates and contractual language.  Many state laws have filing and/or review exemptions that apply to large  commercial policyholders. For exempt commercial policyholders, state  insurance regulators perform neither rate nor form reviews because it is  presumed that these large businesses have a better understanding of  insurance contracts and pricing than the average personal-lines  consumer and as such, are able to effectively negotiate price and contract  terms with the insurers.
section_title: Comprehensive Data on Terrorism Insurance Are Not Readily Available and Treasury’s Analysis to Better Understand Fiscal Exposure Has Been Limited
paragraphs: Comprehensive data on the terrorism risk insurance market are not  readily available. In general, individual insurers maintain data on the  terrorism coverage they underwrite. While Treasury has obtained some  market data from industry sources, those data are limited because they  do not include information from the entire industry. Federal internal  control standards state that agencies should identify and obtain relevant  and needed data to be able to meet program goals. TRIA requires  Treasury to annually compile information on the terrorism risk insurance  premium rates of insurers, and if the information is not available permits  Treasury to require insurers to submit that information to NAIC, but  Treasury has not taken either action. Without comprehensive market  data, including the number of insurers in the market and whether  differences exist in pricing or take-up rates, Treasury may not have a full  understanding of the terrorism risk insurance market and be unable to  assess whether TRIA’s program goals of helping to ensure the continued  widespread availability and affordability of terrorism risk insurance and  addressing market disruptions are being met. Furthermore, Treasury has  conducted limited analysis of the federal government’s fiscal exposure  under different scenarios of potential terrorist attacks. Analyzing such  risks is a federal internal control standard and insurance industry best  practice. Without additional analyses, Treasury does not have enough  information to help understand the potential magnitude of federal fiscal  exposure in the event of a certified terrorist attack, and will not be in the  position to provide Congress with analysis to inform decisions about  reauthorization, including any changes that would limit exposure.
subsections: section_title: Terrorism Insurance Data Available from Industry Sources Are Limited
paragraphs: Comprehensive market data on terrorism insurance, including premiums  and the number of insurers underwriting terrorism risk, are not readily  available. In general, individual insurers maintain data on the terrorism  coverage they underwrite, including data on the percentage of policies  with terrorism coverage and premiums for such coverage. However,  these data are proprietary and are not publicly available. Further, NAIC  manages an electronic system that many insurance companies use to file  premium rates and policy language with state regulators for approval. But  NAIC officials stated that they generally cannot extract terrorism coverage  information from it, such as the number of insurers providing such  coverage or the prices charged. Moreover, using the property and  casualty information NAIC collects likely would overestimate any numbers  on terrorism insurance because not all policies provide terrorism  coverage. NAIC officials told us that obtaining a complete view of the  terrorism insurance market would require reviewing insurers’ filings with  each state.
Many insurance industry organizations are important sources of data on  the terrorism insurance market, but data from these sources are also  limited in some respects. For example, although A.M. Best, an insurance- rating and information organization, and the Insurance Services Office,  Inc. (ISO), an advisory organization and data and analytics provider,  collect premium information from their clients, these data are not publicly  available and may not be representative of the entire industry. Insurance  brokers also compile market data such as pricing, take-up rates, and  coverage by industry sector from their clients. Similarly, some of these  data are not publicly available and are not representative of the entire  market.
section_title: Terrorism Insurance Information Treasury Collects Is Not Comprehensive, and Treasury Does Not Require Insurers to Provide Data
paragraphs: Treasury officials told us they periodically consulted with industry  participants to obtain information about the terrorism insurance market,  such as take-up rates, pricing, and capacity, but noted that the industry  relies on the two largest insurance brokers for this information. However,  as discussed above, the information that brokers compile is not  comprehensive because it does not include detailed data on terrorism  coverage from the insurance industry as a whole. In addition, PWG also  solicited comments from the insurance industry on the availability and  affordability of terrorism risk insurance for three studies mandated by  TRIA. For example, according to Treasury officials, 29 entities submitted  comments for the 2014 PWG report. In addition, Treasury conducted  numerous interviews with industry participants. However, the comments  PWG solicited and received from industry participants for these studies  generally were anecdotal representations from the organizations that  chose to submit information, rather than comprehensive data  representing the entire industry. Treasury officials acknowledged that  their information on the terrorism insurance market could be  supplemented with more detailed information.
Furthermore, TRIA requires Treasury to annually compile information on  the terrorism insurance premium rates of insurers, and if the information  is not available, also permits Treasury to require insurers to submit that  information to NAIC, but Treasury has not taken either action. According  to Treasury officials, Treasury has not compiled information on an annual  basis, and has not collected market data on terrorism risk insurance  directly from insurers. Treasury officials told us this was because the  agency has periodically collected market data on terrorism risk insurance  for the three PWG reports from industry sources, which has been  sufficient for purposes of responding to TRIA’s reporting requirements. If  the premium rate information was not otherwise available, TRIA states  that Treasury may require each insurer to submit the information to NAIC,  which then would make the information available to Treasury. Treasury  officials noted that the premium rate data TRIA requires Treasury to  compile may not be the only helpful data points for understanding the  terrorism insurance market and said that additional baseline data would  be crucial for a more detailed analysis. The officials said they may seek  additional market data and evaluate whether the sources previously used  were adequate.
While TRIA states that Treasury has the authorities necessary to carry  out the terrorism risk insurance program, including prescribing regulations  and procedures to effectively administer and implement it, whether these  authorities allow Treasury to collect comprehensive market data directly  from insurers is unclear. However, federal internal control standards state  that agencies should identify and obtain relevant and needed data to be  able to meet program goals. As stated earlier, the purposes of the  terrorism insurance program include helping to ensure the continued  widespread availability and affordability of property and casualty  insurance for terrorism risk and addressing market disruptions. Without  comprehensive, nationwide market data, including the number of insurers  in the market and whether differences exist in pricing or take-up rates for  companies of different sizes, industries, or geographic locations, Treasury  might not have a full understanding of the terrorism risk insurance market,  including how changing program parameters may impact the market.  Treasury may also be unable to assess whether the program is meeting  its goals of helping to ensure the continued widespread availability and  affordability of terrorism risk insurance and addressing market  disruptions.
section_title: Treasury Performs Limited Analysis to Help Estimate Federal Fiscal Exposure under TRIA
paragraphs: Treasury has conducted limited analysis to help estimate the potential  magnitude of the federal government’s fiscal exposure under TRIA under  different scenarios of potential terrorist attacks. We developed a  conceptual framework for fiscal exposures to aid discussion of long-term  costs and uncertainties that present risks for the federal budget. Fiscal  exposures vary widely by source, extent of the government’s legal  commitment, and magnitude. Fiscal exposures may be explicit (the  government is legally required to fund the commitment) or implicit  (exposures arise not from a legal commitment, but from current policy,  past practices, or other factors that may create the expectation for future  spending). The government’s legal commitment to pay losses when a  certified terrorist event occurs makes the terrorism risk insurance program  an explicit exposure. The amount of federal spending resulting from the  fiscal exposure under the terrorism risk insurance program depends on  the extent of insured losses.
In 2009, Treasury contracted with ISO to develop and implement a  method for estimating total average annual insured terrorism losses in the  aggregate for TRIA-eligible lines, review certain material, and advise on  the appropriateness of its use for projecting potential payout rates of the  federal share of insured losses. The study provides estimates (both  gross and net) of the federal share of losses and was used to aid  Treasury in its development of a federal budget item for the terrorism risk  insurance program. ISO representatives stated that it was important to  understand that the study provides an estimate of average annual losses  in any given year, but in years with losses, the numbers likely would be  significantly higher than the average. ISO representatives also noted that  the study had some data limitations and relied on assumptions such as  take-up rates for terrorism coverage that could affect the results of the  analysis. This is the only study Treasury has commissioned that  examines the potential overall fiscal exposure of the terrorism risk  insurance program to the federal government.
In addition to the ISO study, Treasury officials provided us with a  hypothetical loss scenario that shows private-sector and federal loss  sharing under a specific set of circumstances. According to Treasury  officials, this example was not an official work product and they  emphasized that they developed the example purely to illustrate the  recoupment calculations and it should not be considered as a projection  of the fiscal exposure of a terrorist event to the government. The exact  amount of government spending or the government’s obligation is difficult  to predict because, among other factors, it depends on the distribution of  losses among insurers. For example, the aggregated 20 percent  deductible equaled $37 billion (20 percent of direct earned premiums for  TRIA-eligible lines), according to our analysis of SNL Financial’s 2012  insurance data. However, losses from a terrorist attack are highly unlikely  to affect all insurers or be distributed evenly among all insurers. As a  result, if fewer insurers had losses, the deductible amount would be lower  and the government’s share of losses likely would be triggered at an  amount less than the aggregated industry deductible. Therefore, the  government’s spending or obligation likely would begin at an amount less  than the industry’s aggregated deductible.
Federal internal control standards state that agencies should identify and  analyze risks associated with achieving program objectives, and use this  information as a basis for developing a plan for mitigating the risks. For  example, because the amount of the government’s fiscal exposure varies  according to the specific program’s design and characteristics, estimates  could be developed to better understand the potential costs of changes to  certain program parameters under various scenarios of potential terrorist  attacks. This could increase the attention given to fiscal exposures,  while also providing decision makers relevant information to consider  when determining the best way to achieve various policy goals or design  a program. According to the insurers and other industry participants we  spoke to, insurers’ best practices also show that an insurer’s analysis of  the location and amount of coverage written is prudent for understanding  the financial risks of a potential terrorist attack of a specific size. Insurers  work with terrorism risk modeling firms to help understand their potential  financial exposure from a future terrorist attack. For example, to help  illustrate how an insurer would be financially affected after a terrorist  event and how losses would be shared between the private sector and  the federal government under TRIA, some industry participants have  developed hypothetical scenarios. According to a study published by the  Wharton Risk Management and Decision Processes Center, insurers use  such scenarios to determine their maximum exposure to a range of  possible attacks. Ultimately, the amount of fiscal exposure created by  TRIA will be determined by the program parameters and the specific  circumstances of a future attack (such as the number of insurers affected  and number of businesses that had purchased terrorism coverage).  However, these scenarios can be used to help understand risk and the  impact of the financial losses under TRIA under specific scenarios of  potential terrorist events, and to analyze losses if TRIA were not renewed  (that is, if the private sector would be responsible for all losses). In  addition to information on the type of attack (for example, damage from 2- to-10 ton truck bombs), these scenarios can rely on estimates of insurers’  market share and direct premiums earned, among other data points. For  public policy purposes, in 2014 the Reinsurance Association of America  developed a model to help participants evaluate various loss scenarios.  We also have developed hypothetical examples to help illustrate the  potential magnitude of the federal government’s fiscal exposure, which  will be discussed later in this report.
Treasury officials said that they have conducted limited analysis on the  government’s fiscal exposure under TRIA because the amount of the  government’s fiscal exposure is ultimately determined by program  parameters and the risk modeling and exposure analyses used by  insurers are not entirely applicable in understanding how to reduce  federal exposure. According to Treasury officials, insurers manage risk by  first understanding and then limiting their exposures by insurance line or  geographic location. Fiscal exposure under TRIA is limited by the  program parameters and the circumstances of a future attack (such as  number of insurers affected and number of businesses that had  purchased terrorism coverage). Treasury officials also said that the  amount of fiscal exposure is difficult to determine because it is shaped by  variables, such as geography, type of event, and number of affected  insurers. However, Treasury officials acknowledged that hypothetical  analyses that provide illustrative analyses and estimate the potential total  amount of losses may be helpful in understanding fiscal exposure.  Without analyzing comprehensive market data on the type and amount of  coverage provided from all insurers participating in the market, Treasury  does not have enough information to help understand potential federal  spending under various scenarios of potential terrorist attacks. In addition,  Treasury is not in the position to provide Congress with analysis to inform  decisions about reauthorization and the future structure of the program,  including any changes that would limit exposure, one of the goals that  Treasury recently articulated in its 2015 budget justification.
section_title: Insurance Market for Terrorism Risk Has Stabilized
paragraphs: Available data on the market for terrorism risk insurance generally  indicate a stable market in recent years. Total terrorism insurance  premiums, which make up a small percentage of insurers’ overall  premiums, increased after the original act and reached a high in 2007,  then declined, and have stabilized since 2010. Insurers report capacity to  provide terrorism coverage over the past decade has remained  unchanged. In general, prices appeared to have decreased as the  number of businesses buying terrorism coverage (take-up rates)  increased from 2003 to 2006, but have been constant since 2010. The  transference of terrorism risk through reinsurance or alternatives to  reinsurance, such as insurance-linked securities (catastrophe bonds), has  remained limited.
subsections: section_title: Terrorism Insurance Premiums Have Stabilized and Made Up a Small Percentage of Overall Premiums
paragraphs: Available data show terrorism insurance premiums have stabilized over  the past few years (see fig. 3). For instance, total premiums generally  increased through 2007, then declined, and stabilized from 2010 through  2012. In 2012, the most recent year for which data are available,  estimated terrorism insurance premiums were $1.7 billion, down from a  high of $2 billion in 2007. A.M. Best’s estimates about $17 billion was  collected for terrorism insurance premiums from 2004 through 2012.  Furthermore, terrorism insurance premiums collected on workers’  compensation and commercial property insurance lines each made up  about 40 percent of the estimated total terrorism insurance premiums,  with the remaining 20 percent from all other commercial lines. These  proportions remained relatively stable in recent years.
Based on our analysis of A.M. Best and SNL Financial insurance data,  trends in terrorism insurance premiums have not differed markedly from  trends in other commercial insurance line premiums. For example,  premiums for all commercial property and casualty lines showed the  same pattern––increases until 2007, declines from 2007 through 2010,  and then increases in 2011 and 2012. Commercial property and casualty  generally follows an insurance industry cycle, characterized by periods of  soft market conditions––a market with abundant willingness to write new  policies (capacity), increasing competition, and rates (prices) that grow  marginally or decrease––followed by periods of hard market conditions–– in which capacity is relatively low, competition decreases, rates increase,  and capital is scarce. This cyclical nature of the property and casualty  industry likely plays a role in the hardness or softness of the terrorism  insurance market. For example, the similarity in trends in premiums  indicates that the terrorism insurance market is closely related to the  overall commercial property and casualty market. The 2007-2009  financial crisis affected the overall commercial property and casualty  market and most likely affected the terrorism insurance market in similar  ways. For instance, the financial crisis generally affected commercial  property and casualty insurers through decreased net income, as  underwriting and investment results deteriorated. However, making an  accurate assessment of the terrorism insurance market is challenging.  According to industry participants, uncertainty surrounding the two  previous TRIA reauthorizations––whether the program would be  reauthorized and if so, with what changes––led to periods of market  instability.
Insurers told us their terrorism insurance premiums made up a very small  amount of their overall premiums. As previously mentioned, we obtained  information from 15 insurers as part of a questionnaire. According to the  responses, on average terrorism insurance premiums made up less than  2 percent of commercial property and casualty premiums, or roughly $1.7  billion in calendar year 2012 (the range for the 15 insurers was 0.7 to 3  percent). An insurer told us terrorism insurance premiums have not  significantly affected overall capital levels because premiums collected for  terrorism risk have been low and insurers use some of the terrorism  insurance premiums to account for reinsurance, expenses, and taxes.
A.M. Best and SNL Financial data also indicate that, in terms of the share  of total premium, coverage for terrorism risk is concentrated among the  largest insurers. In the case of terrorism insurance premiums, according  to A.M. Best data, 10 insurers made up roughly 70 percent of premium  volume (see table 3). The same 10 insurers accounted for 44 percent of  premiums in all insurance lines subject to TRIA and 39 percent of  premiums in all commercial property and casualty lines. An industry  representative with whom we spoke said only the largest insurers have  the ability to underwrite large terrorism risks and hence account for a  large portion of the industry’s terrorism insurance premiums. The  composition of the terrorism insurance market resembles other insurance  markets that the Federal Insurance Office has characterized as  concentrated. For example, according to the Federal Insurance Office’s  2013 annual report, 10 insurers made up 47 percent of the property and  casualty market (both commercial and personal) and 72 percent of the life  and health insurance market, in 2012—both of which the report  characterizes as concentrated markets.
Although we present an estimated number of insurers that provide  coverage for terrorism risk, identifying the precise number of insurers in  this market is difficult because of the lack of comprehensive data. As  noted previously, insurers are not required to report data about terrorism  risks to Treasury or NAIC. As shown in table 3, according to SNL  Financial data, more than 800 insurers reported premiums in insurance  lines subject to TRIA and therefore, by law, offered coverage. A.M.  Best’s survey data provides further context for this market. For 2012, A.M.  Best estimated more than 200 insurers provided coverage for terrorism  risk. Insurers providing coverage in the insurance lines subject to TRIA  must offer terrorism coverage, but businesses are not required to buy it.  Therefore, the number of insurers offering coverage in the insurance lines  subject to TRIA (more than 800) and the number of insurers covering  terrorism risk and collecting terrorism insurance premiums (estimated at  more than 200) will differ.
section_title: Capacity Has Remained the Same, Prices Declined, and Take-up Rates Flattened in Recent Years
subsections: section_title: Capacity
paragraphs: According to an insurance broker, capacity seems to have improved, but  insurers report that capacity has remained the same and that they limit  capacity as needed to manage their overall exposure. Capacity is the  amount that insurers are willing to allocate to underwrite a specific risk.  Terrorism coverage typically is embedded in an all-risk property policy  and therefore available terrorism capacity is tied to overall capacity for all- risk property policies. According to information from an insurance broker,  the reported market capacity for terrorism risk seems to have increased.  According to an Aon report, in 2013 about $14 billion per risk was  available to any one insured for an all-risk property policy. This amount  increased from $13.5 billion in 2010 and $8 billion in 2005. This  represents the amount of coverage an insurer is willing to provide to any  one insured. However, the actual capacity for terrorism risk is much lower  than $14 billion per risk because the amounts above encompass capacity  for risks in addition to acts of terrorism. According to Aon, non-terrorism- related exposures, such as natural catastrophes (earthquake and  windstorm), can vastly decrease the available capacity for terrorism risk.
Moreover, individual insurers’ capacity to underwrite terrorism will differ,  and insurers told us they would limit capacity as needed based on their  aggregate terrorism exposures, geographic concentration of terrorism  exposures, and terrorism exposures relative to other natural catastrophe  exposures. Most insurer representatives with whom we spoke reported  that capacity to provide terrorism coverage over the past decade  remained constant and 6 out of the 15 insurers stated that they limited  capacity as needed to manage their overall exposures. About half of the  insurers told us TRIA enabled them to provide capacity for terrorism risks,  but TRIA also was the reason why capacity has remained relatively  unchanged—because insurers managed their exposures based on the  program parameters. In general, insurers assume some financial risk  when covering terrorism risk, but they also employ various underwriting  standards to manage the risk and limit potential financial exposures. As  we previously reported, insurers’ willingness to provide coverage in  certain areas may change frequently as new clients or properties are  added to or removed from their book of business.
In response to our questionnaire, most insurers told us they determined  the amount of coverage they were willing to provide in defined geographic  areas, depending on their risk tolerance. These amounts are sometimes  called coverage limits (capacity limits) and are managed in relation to  overall terrorism exposures. Almost all insurers told us factors such as  loss estimates from terrorism models, aggregation of exposures in  defined areas, proximity of exposures to high-profile targets or buildings,  and individual property characteristics affect their terrorism underwriting  decisions. Insurers may decide to limit capacity; that is, decide not to  underwrite certain coverage, if taking on the additional risk would exceed  their internal capacity limits. A few insurers that we interviewed also told  us that over the past decade they have benefitted from significant  improvements to their data systems and models that track terrorism  exposures; in turn, the better systems and models have improved their  ability to make sound underwriting decisions when renewing or writing  new policies.
section_title: Pricing
paragraphs: Prices have declined and insurers say TRIA has allowed them to offer  coverage at prices policyholders are willing to pay. Insurers may charge  an additional premium for terrorism coverage, as TRIA does not provide  specific guidance on pricing. According to data from Marsh, prices for  terrorism coverage, as part of a commercial property policy, generally  declined over the past decade (see fig. 4). These data are not  necessarily reflective of the entire market, but represent the best available  data on pricing. While prices slightly increased from 2003 to 2004,  prices steadily declined since 2006. In 2013, the nationwide median  amount that businesses paid per million dollars of coverage for terrorism  insurance was $27. Using the 2013 nationwide median rate, a company  purchasing $100 million in coverage for property damage would have  paid approximately $2,700 in terrorism insurance premiums.
In addition, prices that businesses pay will vary depending on company  size, location, and industry. For example, prices will typically decrease as  the size of the company increases (size measured in terms of insured  value and prices measured in millions of dollars of coverage), are typically  higher in the Northeast, and higher in certain industry subsectors (such as  construction, power and utilities, and media) due to perceived or actual  risk exposure to terrorism. But because comprehensive pricing data are  not readily available, it is difficult to clearly understand how prices differ  by company size, location, or industry.
According to data from Marsh, from 2003 to 2013, companies paid  approximately from 4 to 9 percent of their total property premium for  terrorism coverage (see fig. 5). Analyzing the price of terrorism coverage  as a part of overall property premiums allows companies to understand  how terrorism coverage affected their overall property insurance budget.  Businesses paid no more than approximately 5 percent of their total  property premium for terrorism coverage since 2011. Using the 2013  data, a company purchasing $100 million in property coverage would  have paid approximately 4 percent of its $67,500 overall property  premiums for terrorism coverage (or $2,700).
Insurers told us TRIA allows them to offer coverage at prices their  policyholders are willing to pay. Insurers said their primary concern for  covering terrorism risks was limiting their exposures (that is, capacity)  because the losses could be huge under certain types of terrorist attacks  and that pricing was secondary. TRIA addresses insurers’ primary  concerns about the size of potential losses—it provides a structure in  which insurers know, before an event, what their losses could be because  the deductible and coshare are defined by law and losses are capped.  For most insurance products, insurers typically use the potential  frequency and severity of events to calculate premiums that are  commensurate with the risks. Because the frequency and severity of  terrorism are difficult to predict, the limits established in TRIA, which cap  the potential severity of losses to insurers, make underwriting the risk and  determining a price for terrorism coverage easier for insurers.
Furthermore, most insurers said their companies’ experiences with  collecting terrorism insurance premiums and providing terrorism coverage  over the past decade have had minimal or no impact on their pricing  strategy. Insurer responses suggest this is mainly because terrorism is so  different from other perils. For example, one insurer noted that with  natural catastrophes, insurers have a long history of experience writing  and pricing (based on claims), but this is not the case with terrorism.
Another insurer noted that terrorism risk provides too few data points to  inform pricing and underwriting decisions. Additionally, one insurer told us  it is a very competitive market and they do not charge terrorism insurance  premiums that would cover their potential losses from a terrorist attack.  For example, this insurer noted that if insurers did charge premiums that  would cover potential losses, businesses would not buy it.
section_title: Take-up Rates
paragraphs: Take-up rates—which are the percentage of businesses buying terrorism  coverage and help measure the demand for terrorism risk insurance— increased from 2003 to 2006 and have remained relatively constant (and  above 60 percent) since 2010, according to data from Marsh (see fig. 6).  According to Treasury and NAIC, neither collects this type of information.  Take-up rate data for businesses buying terrorism coverage as part of  commercial property policies are only available from insurance brokers.  The take-up rate for businesses buying terrorism coverage as part of  workers’ compensation policies is 100 percent because state laws require  businesses to purchase workers’ compensation insurance and do not  permit insurers to exclude terrorism from workers’ compensation policies.
Take-up rates will vary depending on company size, location, and  industry. For example, larger companies are more likely to purchase  coverage than smaller companies, the Northeast has the highest take-up  rates, and certain industry subsectors have higher take-up rates than  others (for example, media, education, and financial institutions).  According to our questionnaire results, overall take-up rates for insurers  varied significantly (from 26 to 100 percent). One respondent noted that  analyzing insurers’ overall take-up rates can be misleading and it is more  appropriate to look at take-up rates for terrorism coverage in each line of  insurance subject to TRIA. According to our questionnaire results, the  lines of insurance with the highest take-up rates for terrorism coverage  are commercial multiperil and inland marine, and the lines with the lowest  take-up rates for terrorism coverage are aircraft and boiler and  machinery. However, because Treasury and NAIC do not collect take- up rate data from insurers, it is difficult to thoroughly analyze take-up  rates by line of insurance.
According to industry participants, take-up rates may have reached a  plateau—that is, most businesses that want the coverage already have  purchased it. From 2003 through 2013, take-up rates doubled, while  prices declined by 50 percent. In more recent years, take-up rates  remained relatively constant, although prices continued to decline (as  shown in figures 4 and 6). Since 2010, both take-up rates and estimated  terrorism insurance premiums have been relatively stable (see fig. 7).
The changing proportions of new versus renewal policies covering  terrorism risk offer further evidence that demand may be leveling off. On  the basis of our questionnaire results, the majority of policies are  renewals rather than new issuances, and this has stayed the same over  the past several years (on average, about 83 percent renewals in 2008  and in 2012).
section_title: Use of Reinsurance and Insurance-Linked Securities for Significant Amounts of Terrorism Risk Remains Limited
paragraphs: The transference of terrorism risk—namely, through reinsurance and  alternatives to reinsurance such as insurance-linked securities—has been  limited. Reinsurance capacity for terrorism risk has increased, but  remains small relative to the federal reimbursements available through  TRIA. For example, according to industry participants about $6 billion to  $10 billion in terrorism reinsurance capacity was available in the United  States in 2013, which was an increase from the $4 billion to $6 billion  available several years ago, but was still small compared with the federal  assumption of 85 percent of losses (up to $100 billion of aggregate  industry exposure minus items such as the insurer deductibles) in TRIA.  Without TRIA, current reinsurance capacity would be insufficient to  respond to a large-scale terrorist attack, in particular up to the limits the  government program provides, according to a reinsurance trade  association representative. Additionally, terrorism reinsurance capacity is  small in relation to capacity for other perils. For example, the total amount  of reinsurance capacity available for natural catastrophe risks in the  United States in 2012 ranged from $90 billion to $120 billion.
Several factors limit the market for reinsurance of terrorism risk. For  instance, unlike primary insurers, reinsurers are not subject to TRIA and  therefore are not required to offer primary insurers coverage for terrorism  risk. According to industry representatives, reinsurers face the same  challenges as primary insurers––that is, terrorism risk is difficult to model  and price, which also contributes to a limited market. Finally, insurers told  us they typically purchase terrorism reinsurance as part of a multiperil  policy that covers terrorism risk in addition to other risks. To help  manage their exposures to concentrated losses, reinsurers frequently  write terrorism coverage with specific limits for individual properties rather  than reinsure a share of an insurance company’s overall holdings.
According to brokers and reinsurers, terrorism reinsurance prices  generally have declined by 50 percent over the past decade and more.  Reasons these industry participants cite for the price declines include the  passage of time since the September 11 attacks, the lack of subsequent  terrorist attacks resulting in significant losses, decreased demand from  primary insurers, and increased supply of reinsurance. However, the  location of exposures also affects the price of terrorism reinsurance. For  example, reinsurance coverage is more expensive for exposures in  densely populated urban areas than less densely populated areas.
Although individual insurers’ reinsurance patterns vary, insurers have  been reinsuring a limited amount of their terrorism risk and retaining  roughly 80 percent of it according to the 2010 PWG report. Insurers make  decisions on how much reinsurance to purchase based on their  perception of risk, price of coverage, ability to manage risk, and other  factors. One insurer contributing to this report commented that terrorism  risk reinsurance remains insufficient to serve the market’s current risk  exposure. According to our questionnaire results, 13 insurers purchased  reinsurance for terrorism risk and 2 did not. Some responding insurers  that purchased reinsurance for terrorism risk noted an increase in their  purchasing levels, some noted a decrease, and still others noted  fluctuations in their purchasing patterns. One insurer purchased terrorism  reinsurance coverage continuously since 2002 and increased its limits as  capacity became available and pricing became more affordable. Two  insurers said that their purchases of terrorism reinsurance decreased  over time. The two insurers that did not purchase reinsurance for  terrorism noted that while some reinsurers were willing to provide a  modest capacity for terrorism risk, the cost was prohibitive for them.  Additionally, insurers noted that potential modifications to TRIA would  affect their demand for reinsurance. For example, potential modifications  that would increase insurers’ deductible and coshare amounts would  result in increased demand from primary insurers for reinsurance, but  supply might stay the same.
As an alternative to reinsurance, insurance-linked securities have  remained a limited option for covering terrorism risk. Specifically,  catastrophe bonds, insurance-linked securities that typically cover natural  catastrophes, have been used over the past 20 years mainly because of  the large amount of resources available in capital markets. Catastrophe  bonds are risk-based securities that pay relatively high interest rates and  provide insurance companies with a form of reinsurance to pay losses  from natural catastrophes. A catastrophe bond offering typically is made  through an investment entity that may be sponsored by an insurance or  reinsurance company. The investment entity issues bonds or debt  securities for purchase by investors, thus spreading risk. Catastrophe  bonds, by tapping into the securities markets, offer the opportunity to  expand the pool of capital available to cover a particular risk. Some  insurers and reinsurers issue catastrophe bonds because they allow for  risk transfer and may lower the costs of insuring against the most severe  catastrophes (compared with traditional reinsurance).
Although catastrophe bonds have become more common, two have been  issued to date that cover terrorism risk and neither is explicitly a terrorism  risk bond that covers risks included under TRIA. Each is a multi-event  bond associated with the risks of natural disaster, pandemic, or terrorist  attack. However, these bonds are mortality bonds and therefore would  be an alternative for a life insurance policy (which is not a line of  insurance eligible for TRIA) and not an alternative to commercial property  and casualty insurance. As of April 2014, no property and casualty  terrorism bonds have been issued.
Industry representatives mentioned various challenges to issuing  catastrophe bonds covering terrorism risk.
Investors generally avoid risks not widely underwritten in reinsurance  markets and therefore lack interest in such catastrophe bonds.  Investors are reluctant to make investments in which losses may be  correlated with widespread financial market losses (as was the case  with terrorism losses after September 11, 2001) as well as low returns  or payouts.
Rating agencies have not been willing to use terrorism loss models  that estimate the probability of terrorism events (probabilistic models)  for rating purposes and at least for terrorism risk investors tend to  avoid risks that cannot be credibly modeled and rated.
The difficulty of modeling terrorism represents an additional overall  challenge to the development of the private market for terrorism  insurance. Models used to estimate terrorism risk have become more  sophisticated in estimating the severity of specific events in recent years.
However, they remain fundamentally different from those used to assess  natural hazard risks, which estimate both the severity and probability. For  example, according to the Reinsurance Association of America, terrorism  modeling is primarily a means for underwriters to measure how much  they have at risk in a given geographic area and losses from a specific  type of event (that is, the severity of an event), not to estimate the  probability of such events. Terrorism risk is unlike other catastrophic  risks—such as earthquake or hurricane—in that terrorists can alter their  behavior, which makes it hard to model the probability of potential events  with the level of accuracy required to accurately price the coverage.  There are relatively few instances on which to base probability estimates  for acts of terror in the United States, which means that such estimates  lack actuarial credibility. Additionally, insurers and modeling firms have no  access to data used internally by U.S. intelligence and counterterrorism  agencies. Moreover it may be impossible to build a model that provides a  valid representation of all individuals and groups that might decide to try  to use terrorism as a tactic against the United States. In addition, as  opposed to other types of risks that are random to some extent, terrorist  acts are intentional and terrorists continually attempt to defeat loss  prevention and mitigation strategies.
section_title: TRIA Expiration or Modification Could Affect Availability of Terrorism Coverage and Federal Fiscal Exposure, but Additional Clarification of Covered Risks Is Needed
paragraphs: Insurers and other industry participants cited concerns about the  availability and price of terrorism coverage if TRIA expired or was  changed substantially, but some changes could reduce the government’s  fiscal exposure. For example, some insurers we interviewed said they  would stop covering terrorism risks if TRIA expired. In addition, most of  the insurers we interviewed, including larger and smaller insurers, cited  potential consequences associated with increasing the deductible or  coshare, such as impacts on pricing, the need to reevaluate risk and  capacity, and threats to their solvency in the event of a large industry  loss. These concerns are consistent with points industry participants  raised before previous reauthorizations of the program. However, several  insurers told us they were less concerned about an increase to the  aggregate retention amount or program trigger. Further, we found that  increasing the deductible, coshare, or industry aggregate retention  amount could reduce the government’s fiscal exposure under certain  terrorist event scenarios. Responses to our questionnaire revealed that  insurers were uncertain about whether TRIA covers risks from a cyber  terrorism attack. Without clarification of the coverage of cyber risks, some  insurers may not offer cyber coverage and the coverage may not be as  available.
subsections: section_title: Insurers May Limit Terrorism Insurance if TRIA Expires, but Long- Term Impacts of Expiration Are Difficult to Determine
paragraphs: The long-term impact of expiration of the terrorism risk insurance  program’s authority is difficult to determine, but according to insurers, in  the short run, the availability of terrorism coverage may become more  limited. Some insurers told us that they will stop providing terrorism  coverage if TRIA expires on December 31, 2014. As indicated by  responses to our questionnaire and other surveys of insurers, some  insurers already made regulatory filings or issued notices to policyholders  indicating that terrorism coverage would be excluded from policies in  force beginning on January 1, 2015, if TRIA expired. For example, one  insurer said that if TRIA were not renewed, the company would either  exclude terrorism coverage or not underwrite businesses in states that  prohibit terrorism exclusions. Insurers could further limit terrorism  exposures, particularly in geographic areas considered at high risk for  attacks.
Because some states prohibit excluding certain risks, if a large-scale  event occurred in the absence of TRIA, some insurers could face higher  risk of insolvency or have more incentives to leave the market. For  example, New York state insurance law prohibits terrorism exclusions for  property and casualty policies that include standard fire coverage. In  some other states, property insurers must cover losses from fire  regardless of the cause of the fire, including a terrorist attack, even if the  policyholder declined terrorism coverage. Thus, if TRIA expired, insurers  operating in these states still would have to cover damage from fire  following a terrorist attack. Such situations might leave some insurers  bearing risks they could not adequately reinsure and leave them at  increased risk for insolvency. Some insurers might decide their exposures  were too great without TRIA and exit the market or decline to insure  commercial property altogether.
Some industry observers have noted that, in the long term if no large  losses occur, the private insurance market might be able to address the  need for terrorism coverage without support from the program. The  amount of insurance and reinsurance written is related, in part, to the  amount of surplus held by insurers and reinsurers. Over time, the  private insurers and reinsurers might develop additional terrorism  capacity if there are no losses due to terrorism. If capacity did not  increase in the terrorism insurance and reinsurance markets, the  insurance-linked securities market might develop and insurers might  increasingly attempt to access capital markets to help spread terrorism  risk. One capital markets participant said that in the past catastrophic  shocks have led to more interest in insurance-linked securities and  accelerated issuance of natural catastrophe bonds and that the expiration  of the program could similarly foster interest in bonds for terrorism risk.  However, insurers and reinsurers continue to question whether the  market can accurately price terrorism risk. As a result, insurers and  reinsurers might continue to believe they were unable to accurately price  for such risks and leave the market for terrorism risk insurance (as  happened after September 11, 2001). Furthermore, because losses  would no longer be capped, rating agencies might downgrade ratings for  insurers and reinsurers, affecting the companies’ ability to raise capital. In  the long term, policyholders (businesses) also might increase terrorism  mitigation and deterrence efforts. For example, businesses might locate  some operations away from high-risk areas, invest in mitigation measures  (retrofitting properties to better withstand an attack or improve evacuation  measures), or both.
In the case of workers’ compensation, businesses unable to find  coverage from insurers would have to obtain coverage from state funds,  which might be more expensive than coverage from primary insurers.  For example, representatives of one industry association told us that after  the September 11, 2001, attacks, participation in state funds in New York,  Washington, D.C., and Virginia increased, as some businesses were  unable to find workers’ compensation coverage from primary insurers.  Over time, businesses were able to leave the state funds and find  coverage in the primary market, but workers’ compensation insurers  became more selective about the number of employers they insured in a  particular location.
Finally, past experience following disasters suggests that the federal  government may provide assistance to businesses after a terrorist event  in the absence of a federal terrorism insurance program. For example,  following the September 11, 2001, terrorist attacks, we reported in 2003  that Congress committed at least $18.5 billion to individuals, businesses,  and government entities in the New York City area for initial response  efforts, compensation for disaster-related costs and losses, infrastructure  restoration and improvement, and economic revitalization. As we  reported in 2009, many federal agencies and program components  administer supplemental programs and funding, reprogram funds, or  expedite normal procedures after a disaster. For example, forms of  disaster assistance available from federal agencies include grants, loans,  loan guarantees, temporary housing, counseling, technical assistance to  state and local governments, and rebuilding or recovery projects.  Following the April 2013 bombings in Boston, the federal government  issued an emergency declaration for the state of Massachusetts that  made federal assistance for equipment, resources, or protection available  as needed. In 2012, we reported that the growing number of major  disaster declarations contributed to an increase in federal expenditures  for disaster assistance. For fiscal years 2004 through 2011, the federal  government obligated more than $80 billion in disaster relief, about half of  which followed Hurricane Katrina. And about $50 billion in federal  assistance supported rebuilding efforts after Superstorm Sandy.
section_title: Certain Modifications to TRIA Could Affect Availability of Terrorism Coverage, but Insurers Said Other Changes May Not Significantly Affect the Market
paragraphs: As previously discussed, each of the program parameters—program  trigger, deductible, coshare, and industry aggregate retention amount— have changed since the program was enacted. It is not clear what impact  these past changes have had on insurers in the market, but insurers told  us that they generally preferred no additional changes. According to  responses from our questionnaire, 11 of 15 insurers said that the TRIA  program trigger (currently $100 million) could be increased without  significantly changing their ability to provide coverage. In particular, 6 of  those 11 insurers noted their companies would be able to offer terrorism  coverage if the program trigger were raised up to $500 million, while of  the remaining 5 insurers, 4 said they could offer coverage if the trigger  were raised up to $1 billion and one insurer said that the trigger could be  increased to more than $1 billion. Insurers said that they could continue  offering coverage under an increased trigger amount because their  current deductibles under the program were higher than the program  trigger and increasing the trigger would not impact their share of losses.
For example, using 2012 data, the 10 largest insurers in TRIA-eligible  lines all had deductibles much greater than $100 million. As stated  previously, while government coverage is triggered once aggregate  industry losses exceed $100 million, individual insurers that experienced  losses would first pay their deductibles and only then be eligible to  receive federal reimbursement for 85 percent of their losses. One insurer  explained it was less concerned with changes to the program trigger than  to the deductible and coshare percentages, because changes to the latter  were more likely to have direct impacts on insurers’ liquidity and result in  significant market disruptions. Further, we found that increases to the  program’s parameters could reduce federal fiscal exposure in certain  situations, as long as the private sector’s share of losses is below the  industry aggregate retention amount of $27.5 billion. As previously  discussed, TRIA includes a provision for mandatory recoupment of the  federal share of losses when private industry’s uncompensated insured  losses are less than the industry aggregate amount of $27.5 billion.  Insurers that responded that they preferred that no change be made to  the program trigger cited concerns about capacity limitations, increased  terrorism insurance premiums, and an increase in the cost for terrorism  reinsurance if the trigger were increased.
Most of the insurers said that increases to the current deductible (20  percent of previous year’s direct earned premium) or private-sector  coshare (currently at 15 percent) could affect insurer capacity and pricing.  For example, insurers commented that an increase in either of these  parameters would result in their companies reevaluating their risk, and  likely reducing their capacity or increasing policyholders’ premiums. One  insurer said that it had adjusted its terrorism risk-management program  according to the current program, and that any increases almost certainly  would result in the company taking risk-mitigation actions, including  reducing terrorism exposures, to offset the increased risk to the  company’s surplus. In addition, insurers stated that increasing the  deductible or private-sector coshare would bring many companies under  rating agency scrutiny for risk concentrations, which likely would result in  industry-wide reductions in terrorism exposure. However, some insurers  (3 of 15) told us that their companies could absorb a higher deductible  amount, including one insurer that told us its company could absorb an  increase in the deductible up to 29 percent. However, this same insurer  cautioned that such an increase likely would result in increased premiums  for terrorism coverage and decreased take-up rates.
Insurers also expressed concerns about impacts on their solvency if the  deductible or coshare percentages were increased. For example, insurers  commented that such increases could affect rating agency assessments  of companies’ financial strength. Representatives of A.M. Best told us that  they use a stress test of different scenarios to measure insurers’ financial  strength and notified 34 insurers their ratings could be negatively affected  without a sufficient action plan as a result of failing the stress test.  Insurers told us that increasing the deductible or private-sector coshare— and thus the amount of losses insurers would be responsible for paying— could adversely affect insurers’ liquidity and solvency in the event of large  terrorism losses given the levels of surplus available from which to pay  these losses. Industry participants consider deductible in relation to  surplus as a metric to help understand how much of the company’s  surplus would be at stake to pay the TRIA deductible amount in the event  of a certified act of terrorism. (Insures also must have surplus available  to cover unexpectedly large losses in all other lines of insurance they  underwrite.) We found the TRIA deductible has generally represented an  increasing portion of insurers’ surplus. Under the current program  parameters, in 2012 the industry-wide TRIA deductible made up  approximately 17 percent of estimated surplus of insurers potentially  exposed to terrorism risk. Deductibles remained at 15 percent or higher  of estimated surplus since 2005 (see fig. 8).
Smaller insurers’ surplus would be affected more than larger insurers’  surplus in the event of a large terrorism loss. For example, according to  our analysis of 2012 SNL Financial insurance data, on average, smaller  insurers’ TRIA deductible amounts made up 23 percent of surplus  compared with 12 percent for larger insurers (that is, the 10 largest  commercial property and casualty insurers in TRIA-eligible lines).  However, some larger insurers’ surplus also would be at heightened risk.  For example, the TRIA deductible amounts represented from 7 to 19  percent of surplus of larger insurers. If the deductible was increased to 35  percent, surplus at stake (using 2012 data and holding the estimate for  surplus constant) would nearly double to 30 percent, greatly increasing  the possibility of insurer insolvencies due to certified terrorism losses.
In contrast to insurer responses on the program deductible and coshare  percentages, some insurers told us that the industry could absorb an  increase to the industry aggregate retention amount. According to  responses from our questionnaire, 7 out of 15 insurers said the industry  aggregate retention amount should stay the same and 5 said it could be  increased. Two insurers that said increasing the retention amount was  reasonable because the industry has grown. For example, one insurer  commented that the $27.5 billion amount was roughly based on 20  percent of industry premiums for TRIA-eligible lines in 2006. This insurer  stated that because of growth in premiums, the insurance industry was  capable of assuming a higher aggregate retention. Another insurer  commented that surplus for the property and casualty industry has grown  by approximately 20 percent since the 2007 reauthorization; therefore,  the insurance industry might be able to absorb an increase in the amount  based on the growth in surplus, which would be approximately $33  billion. However, 7 insurers reported that they preferred to maintain the  current industry aggregate retention amount and most of those insurers  cited concerns about the impact a higher retention amount would have on  policyholders, due to the surcharges that would be added to policyholder  premiums in the event of recoupment. One industry participant noted  that according to experience in other lines of insurance, any surcharge  that resulted in a premium increase of more than 2 percent might result in  policyholders deciding not to purchase this coverage.
section_title: Changes to Program Parameters Could Reduce Federal Fiscal Exposure under Certain Circumstances
paragraphs: Changes to program parameters not only would affect insurers but also  estimates for fiscal exposure under TRIA. The legal commitment to pay a  share of the losses when a certified terrorist attack occurs makes the  program an explicit fiscal exposure for the U.S. government. The  amount of federal spending resulting from this exposure depends on the  extent of covered losses incurred as a result of a certified attack. Because  the potential amounts of fiscal exposure and loss sharing would depend  on the specifics of a certified act of terrorism, we developed illustrative  examples to help demonstrate estimated changes in the magnitude of  fiscal exposure when the deductible, coshare, or industry aggregate  retention amounts were individually changed. We found that increasing  the insurer deductible, coshare, or aggregate retention amount could  reduce the government’s fiscal exposure in certain situations (see fig. 9).  More specifically, as the deductible or coshare percentages increase, the  government’s overall share of losses decreases, but only when the  private sector’s share of losses exceeds $27.5 billion (because of  mandatory recoupment).
Increasing the industry aggregate retention amount would have a greater  impact on reducing fiscal exposure than increasing either the deductible  or coshare percentages by certain specified amounts (see fig. 10). The  potential reduction to federal exposures was most pronounced in our  scenario with a $50 billion loss and an increased retention amount. Such  a scenario would approximate current-dollar losses similar to those that  resulted from the September 11, 2001, terrorist attacks. Potentially, every  $1 increase in the retention amount can result in an equal $1 decrease in  federal exposure, when the insured losses are more than the industry  aggregate retention amount of $27.5 billion. The insurers’ share of losses  increases with any decrease in federal fiscal exposures.
According to this $50 billion loss scenario, under the current program  parameters the government’s share of losses after mandatory  recoupment would be $23 billion. If the industry aggregate retention  amount were increased to $35 billion, as suggested by increased surplus  levels in the industry, federal exposure could decrease to $15 billion (see  fig. 10). To achieve similar levels of reduction in the government’s share  of losses, the deductible would have to be raised from 20 to more than 35  percent. There was no observable change to federal exposure when the  coshare was increased in this $50 billion loss example because of the  mandatory recoupment amount.
The impact of changing the industry aggregate retention amount  compared to changes to the deductible or coshare is even more evident  under our $75 billion loss scenario (see fig. 11).
section_title: Most Insurers Not Willing to Cover NBCR Outside of Workers’ Compensation Policies
paragraphs: As we have previously reported, insurers generally have attempted to  limit their exposure to nuclear, biological, chemical, or radiological  (NBCR) risks by excluding nearly all NBCR events from property and  casualty coverage. According to industry representatives, property and  casualty insurers believe they have excluded NBCR coverage by  interpreting existing exclusions in their policies to apply to NBCR risks,  but some of the exclusions could be challenged in courts. In 2004  Treasury issued an interpretive letter that clarified that the act’s definition  of insured loss does not exclude losses resulting from NBCR attacks or  preclude Treasury from certifying a terrorist attack involving NBCR  weapons. According to Treasury’s interpretive letter, the program covers  insured losses from NBCR events resulting from a certified act of  terrorism, if the coverage for those perils is provided in the policy issued  by the insurer.
While Treasury has confirmed that NBCR losses would qualify for loss  sharing under TRIA, we found insurers generally excluded coverage for  NBCR risks. Several insurers told us that they do not underwrite  NBCR risks because of the lack of data to assess frequency and severity,  which makes it difficult to determine an accurate price for the coverage.  One insurer told us that NBCR events are uninsurable because of the  scale of losses, difficulties in modeling, and the deliberate nature of the  acts. Several insurers also told us they generally exclude NBCR risk  where state law permits.
However, insurers are generally required to cover NBCR losses for  workers’ compensation policies, and may provide NBCR coverage in  other limited circumstances. For instance, two insurers we interviewed  provide NBCR coverage in limited circumstances. One insurer told us that  the company covers NBCR risks in its general liability policies, and  another said some of its environmental policies include NBCR coverage.  As stated previously, workers’ compensation insurers generally include  NBCR coverage because states generally prohibit the exclusion of any  peril for workers’ compensation. Also, certain states require insurers to  cover fire following an event, regardless of the cause of the fire. Thus, an  NBCR event that leads to a fire may activate a fire policy providing  coverage to a policyholder.
Other options for NBCR coverage exist. For instance, NBCR coverage  can be obtained through the use of captive insurers accessing the TRIA  program and we previously reported that some large businesses elected  this coverage route. There also is a limited stand-alone terrorism  insurance market for NBCR, but high prices have prevented most  businesses from purchasing coverage. And, although reinsurance  companies traditionally excluded NBCR, about two-thirds of reinsurance  companies offered some coverage for NBCR events, according to a 2010  survey.
Some insurers told us that expanding TRIA to require insurers to make  NBCR coverage available would result in significant disruptions to the  market. Some insurers said that an NBCR event could render the  insurance industry insolvent. Another insurer told us that underwriting  NBCR risks would decrease its capacity to underwrite other types of  insurance. Several insurers did not support changing TRIA to require  coverage for NBCR events because, in their opinion, NBCR was not an  insurable risk. One insurer said effective underwriting and pricing of  NBCR exposure was not possible and attempting to do so would be  contrary to basic principles of insurance underwriting and pricing. One  company told us that significant market disruptions would occur if NBCR  coverage were mandatory. Additionally, one insurer told us that  reinsurance capacity for NBCR risks was minimal and, as a result, the  ability of any insurer to offer NBCR coverage was limited.
section_title: Insurers Reported Numerous Obstacles Involved in Charging for Federal Reinsurance
paragraphs: According to responses to our questionnaire, 10 of 15 insurers said that  they did not favor establishing a prefunding mechanism (such as a pool)  in place of the current postfunding mechanism under TRIA (recoupment).  For example, a prefunding mechanism could potentially allow insurers to  set aside tax-deductible reserves for terrorist events or the creation of  risk-sharing pools. One insurer supported a prefunding mechanism and  four other insurers did not provide comments on the advantages and  disadvantages associated with a prefunding mechanism. Insurers not in  favor of a mechanism to charge for federal reinsurance cited a number of  obstacles that would need to be considered, such as the following:  Increased administrative costs. Several insurers commented that a  prefunding mechanism would require additional resources and staff to  administer. For example, one insurer said that Treasury would have to  expand its staff and augment their expertise to administer a  prefunding mechanism. This insurer also noted that Treasury would  have to collect and analyze exposure and other pricing data, utilize  terrorism risk models, obtain staff with actuarial and underwriting  expertise, conduct audits of insurers, and manage a billing process.
Difficulties funding a reinsurance pool. Insurers noted challenges in  accumulating sufficient reserves for a pool, and effectively managing  the pool. For example, one insurer commented that the federal  government likely would not be able to accumulate enough funds for  such a pool. Insurers also cited other challenges involved in  prefunding federal reinsurance, such as decreases in the purchase of  terrorism insurance due to its increased cost or lack of coverage after  an event depletes the fund.
Challenges in estimating the frequency of terrorist attacks. The  unpredictability of terrorist attacks and the inability to effectively  underwrite against terrorism risk would need to be considered. One  insurer commented that any prefunding mechanism would be purely  speculative and contribution amounts would bear little relationship to  the likely losses from an event. Additionally, because it is difficult to  assess the potential frequency and severity of a terrorism event (key  components in pricing or funding for risk), insurers commented that  postfunding (recoupment) was the preferable approach for terrorism  risk.
Increased cost to policyholders. Insurers commented that if a  prefunding mechanism were established, it likely would result in  increased costs, such as administrative costs and increased costs to  policyholders. For example, one insurer told us that as users of such a  mechanism, its costs for such a mechanism would be passed to  policyholders. This insurer also noted that additional costs may cause  policyholders to forgo terrorism coverage; therefore, in their view a  prefunding mechanism could contravene the purpose of TRIA—to  encourage the availability and affordability of terrorism coverage for  policyholders that want to insure against terrorism exposure.
section_title: While Some Insurers Cover Cyber Terrorism Risks, Others Not Certain If TRIA Covers This Risk
paragraphs: Some uncertainty exists in the market about whether TRIA covers cyber  terrorism risks. According to industry participants, cyber attacks could  involve a wide spectrum of potential threats that could impact property,  critical communications, and utility and transportation infrastructure,  among other unconventional threats. Industry participants also pointed  out that cyber events have the ability to impact numerous lines of  insurance coverage. While TRIA does not explicitly exclude coverage of  cyber risks (or other specific perils) it also does not explicitly cover it.  Program guidance and other official communications have been silent on  this point—thus, allowing for confusion or uncertainties about coverage.  According to our questionnaire, 8 of 15 insurers considered losses  resulting from cyber terrorism as covered by TRIA as long as the insurer  underwrote cyber terrorism coverage as part of the underlying policy.  However, our questionnaire also revealed uncertainty about such TRIA  coverage. For example, 7 other insurers said that, based on their  understanding of TRIA, they did not know if losses resulting from cyber  terrorism would be covered by TRIA. Insurers commented that more  clarity about the treatment of cyber terrorism under the program would be  helpful to eliminate any uncertainty in the insurance industry about  coverage of this type of risk.
Insurers also commented that because cyber terrorism is an emerging  risk there was some uncertainty about what the term encompassed. For  example, one insurer noted that there is no statutory definition for cyber  terrorism and that depending on the definition of cyber terrorism the  program may or may not be triggered; therefore, the insurer said that a  consistent definition would be needed. Another insurer said it was unsure  if the industry has had a consistent approach to defining and covering  cyber terrorism in policies and suggested that a technical working group  or clarification from Treasury could help make this clearer. Some insurers,  industry associations, and brokers also noted that because cyber  terrorism risk is a new and evolving risk that recently has come into focus,  some clarification about how this risk would be covered under TRIA would  be helpful and could help increase capacity in the market. For example, in  its comments to PWG, Aon noted a lack of cyber insurance capacity in  certain industries, such as large energy, utility, gas, and water entities. In  addition, in their 2013 statement to PWG, the American Academy of  Actuaries stated that cyber terrorism is a significant risk, and that  clarification is important because of the nation’s ever-increasing  dependence on technology, including for commerce and business  administration.
As discussed earlier in this report, Treasury issued an interpretive letter in  2004 that clarified whether losses from an NBCR event would be covered  under TRIA. In addition, our work on fiscal exposures demonstrates the  importance of complete information about fiscal exposures.  Specifically, a more complete understanding of the sources of fiscal  exposure and the way they change can provide enhanced control and  oversight over federal resources. Treasury acknowledged that there has  been growth in the cyber insurance market. Treasury officials said that  they have not issued any clarifications because clarification was  unnecessary and explicitly listing TRIA-covered events may create  unnecessary coverage disputes. While TRIA does not explicitly prohibit  coverage of cyber terrorism risk, neither does it explicitly allow it.  However, without clarification of the coverage of cyber risks, some  insurers may not offer cyber coverage or may not explicitly exclude  coverage. As a result, coverage may not be as available. Additionally,  inclusion of cyber risks affects the government’s fiscal exposure under  TRIA, and without gathering information from the industry to help provide  clarity surrounding the definition and coverage of this risk, the federal  government would not have an understanding of the potential impact of  losses from a cyber attack.
section_title: Conclusions
paragraphs: Congress enacted TRIA and its reauthorizations to help ensure the  availability and affordability of insurance for terrorism risk and provide a  transitional period in which the private insurance market could determine  how to model and price terrorism risk. However, Treasury has not  collected comprehensive data directly from insurers. Federal internal  control standards state that agencies should identify and obtain relevant  and needed data to be able to meet program goals. Obtaining  comprehensive data is necessary to thoroughly analyze the market. While  Treasury stated that the information available from other sources has  been sufficient for purposes of responding to TRIA’s reporting  requirements, more data and periodic assessments of the market would  help Treasury assess whether the program goals of ensuring the  continued widespread availability and affordability of terrorism risk  insurance and addressing market disruptions are being met, and advance  decision making about any potential program changes and the impact of  those program changes on the market.
Moreover, Treasury has performed limited analyses of the potential  amount of fiscal exposure the program represents. While no terrorist  attacks have triggered TRIA, the program still creates an explicit fiscal  exposure for the government because the government is legally required  to make payments for certified terrorist events. According to industry best  practices, analysis of exposures is important for understanding the  financial risks of a potential terrorist attack. In addition, federal internal  control standards state the importance of analyzing risks to programs,  and our prior work on fiscal exposures highlights how estimates could be  developed to better understand fiscal exposures. By enhancing its data  analyses, Treasury would be in a better position to estimate the amount  of fiscal exposure under various scenarios of potential terrorist attacks  and to inform Congress of the potential fiscal implications of any program  changes. By better understanding fiscal exposure, Treasury can aid  Congress in monitoring the financial condition of the program and its  potential impact on the federal budget over the longer term.
In the last few years, demand for terrorism insurance may have leveled  off, as indicated by available data. However, insurers are concerned  about how a new type of terrorist threat, cyber attacks, would be treated  under the program and some industry sectors have experienced difficulty  obtaining coverage. Some terrorism risk insurers told us they do not know  whether losses resulting from cyber terrorism would qualify for coverage  under TRIA, which may impact their decision to cover it. In the past,  Treasury issued an interpretive letter to clarify the treatment of NBCR  risks under the program. TRIA is silent on cyber threats. Clarification of  the coverage of cyber risks could spur additional capacity in the market  for this type of risk. Additionally, clarification of cyber risks could help  estimates of the government’s fiscal exposure more accurately reflect the  potential risks.
section_title: Recommendations for Executive Action
paragraphs: We recommend that the Secretary of the Treasury take the following  three actions:
Collect the data needed to analyze the terrorism insurance market.
Types of data may include terrorism coverage by line of insurance  and terrorism insurance premiums earned. In taking this action,  Treasury should determine whether any additional authority is needed  and, if so, work with Congress to ensure it has the authority needed to  carry out this action.
Periodically assess data collected related to terrorism insurance,  including analyzing differences in terrorism insurance by company  size, geography, or industry sector; conducting hypothetical illustrative  examples to help estimate the potential magnitude of fiscal exposure;  and analyzing how changing program parameters may impact the  market and fiscal exposure.
Gather additional information needed from the insurance industry  related to how cyber terrorism is defined and used in policies, and  clarify whether losses that may result from cyber terrorism are  covered under TRIA––clarification could be made through an  interpretative letter or revisions to program regulations, some  combination or any other vehicle that Treasury deems appropriate.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report for review and comment to the  Department of the Treasury (Treasury), including the Federal Insurance  Office, and National Association of Insurance Commissioners (NAIC). We  received written comments from Treasury, which are presented in  appendix II. NAIC did not provide written comments. Treasury and NAIC  also provided technical comments, which we incorporated as appropriate.  In its written comments, Treasury agreed with our recommendations on  collecting and assessing data to analyze the terrorism insurance market,  but with respect to our recommendation about clarifying guidance on  coverage of cyber terrorism, said that it did not believe advance  determination of such an event would be helpful or appropriate.
Treasury agreed to collect the data needed to analyze the terrorism  insurance market and to periodically assess these data for certain  purposes, such as for differences in terrorism insurance by company size,  geography, or industry sector and effects on the market for terrorism risk  insurance of changing program parameters. Treasury also noted that  collecting and analyzing market data would not provide a basis to  meaningfully estimate the fiscal exposure of the government under the  program and that the amount of federal payments to insurers resulting  from acts of terrorism hinges on multiple variables that cannot be  predicted with precision. As discussed in the report, limitations of  modeling the probability of this type of risk exist, but we maintain that  estimating the potential magnitude of fiscal exposure under various  hypothetical scenarios of terrorist attacks could help inform Congress of  the potential fiscal implications of any program changes, including  changes that could limit federal fiscal exposure. Further, accounting for  insurers’ deductibles and recoupment in these estimates could aid  Treasury in monitoring the potential impact of the program on the federal  budget over the longer term. In light of Treasury’s response, we have  revised our draft recommendation to clarify what types of analyses to  conduct and to specify that illustrative examples of different terrorist  attack scenarios could be used for the analysis of the potential magnitude  of fiscal exposure.
Regarding our third recommendation that Treasury should clarify whether  losses that may result from cyber terrorism are covered under TRIA,  Treasury stated that TRIA does not preclude federal payments for a cyber  terrorism event if it meets the statutory criteria for an act of terrorism.  Treasury also stated that while the agency will continue to monitor this  issue as it develops and collect applicable market data as necessary, it  does not believe that providing an advance determination of when a cyber  event is an act of terrorism would be helpful or appropriate. As discussed  in the report, clarification of whether losses from a cyber terrorism event  could be eligible for coverage under TRIA is needed because of existing  uncertainties regarding this coverage. Such clarification would not  necessarily require an advance determination of what types of cyber  events would qualify as acts of terrorism under the statute. As we  discussed in the report, 7 of the 15 insurers responding to our  questionnaire did not know if losses resulting from cyber terrorism would  be covered by TRIA. In addition, a large broker noted a lack of cyber  insurance capacity in certain industries. Due to the uncertainties that exist  about what this emerging risk encompasses and whether losses resulting  from a cyber terrorism event would qualify for coverage under TRIA,  clarification would be helpful to spur additional market capacity for this  risk, consistent with the program’s goals of ensuring availability and  affordability of terrorism risk insurance. In light of Treasury’s response, we  revised our draft recommendation to specify the type of information to be  gathered from the industry to help inform Treasury’s decision regarding  guidance on cyber terrorism.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to Treasury, NAIC, and other  interested parties. In addition, the report will be available at no charge on  the GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-8678 or garciadiazd@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. Key contributors to this report are listed in  appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: The objectives of our report were to (1) evaluate the extent of available  data and the U.S. Department of the Treasury’s (Treasury) efforts in  determining the government’s exposure for the terrorism risk insurance  program, (2) describe changes in the terrorism insurance market since  2002, and (3) evaluate potential impacts of selected changes to the  Terrorism Risk Insurance Act (TRIA).
For each of our objectives, we reviewed relevant laws, particularly the  Terrorism Risk Insurance Act of 2002, its amendments, and implementing  regulations. We also reviewed relevant literature and past reports on  terrorism risk, including the Congressional Research Service’s reports on  the current program and recent legislation. Additionally, we reviewed  reports our previous reports on TRIA and updated our work accordingly.  We reviewed reports to Congress from the President’s Working Group on  Financial Markets (PWG). We also reviewed comments submitted from  the public to PWG for their most recent TRIA report. We interviewed  federal officials and staff from Treasury, the National Association of  Insurance Commissioners, and the Congressional Budget Office. We also  interviewed several industry participants (such as representatives from  insurance trade associations, terrorism risk modeling firms, rating  agencies, and insurance brokers) to obtain information for all our  objectives.
Because detailed information on terrorism insurance was not publicly  available, we developed a questionnaire to solicit information applicable  to all our objectives from 15 insurers from which businesses had  purchased terrorism coverage in 2012. The 15 companies—10 of the  largest U.S. commercial property and casualty insurers in lines subject to  TRIA (by premium volume) and 5 additional insurers recommended to us  by an insurance broker, trade association, or both—represented roughly  40 percent of the commercial property and casualty market (by direct  earned premium volume for 2012), according to SNL Financial data. We  included questions about coverage, premium volume, and underwriting  decisions. We also obtained views on potential modifications to TRIA and  how they might affect the market, which we took into account when  developing questions. We worked with a GAO specialist to draft  questions. To minimize errors arising from differences in how questions  might be interpreted and reduce variability in responses, we conducted  pretests with two different organizations in January 2014. On the basis of  feedback, we revised the questionnaire to improve organization and  clarity. We then sent the questionnaire to the 15 insurers in January 2014.  Some questions required close-ended responses, such as providing a  specific percentage or checking boxes. Other questions were open- ended, allowing the insurers to provide more in-depth responses on how  changes to TRIA might affect them. Since the 15 insurers we contacted  were selected on a nonprobability basis, the findings are only applicable  to the 15 companies that we interviewed and do not generalize to even  the commercial property and casualty insurers that sold terrorism  coverage in 2012. They do offer insight into how some private market  insurers currently view parameters and topics under consideration related  to government-backed terrorism insurance.
We took steps to verify the information gathered in the questionnaire and  analyzed the results. We initially reviewed returned questionnaires to  ensure company representatives had provided complete and consistent  responses. After we received the completed, written responses, we held  teleconferences with representatives from each insurer to discuss, clarify,  or amend responses, as appropriate. We aggregated the responses and  presented summary information in this report. We used standard  descriptive statistics to analyze quantitative responses and performed  content analysis on the open-ended responses to identify common  themes. Where possible, we corroborated insurers’ responses with  information or analysis from other sources. On the basis of our  questionnaire design and these follow-up procedures, we determined that  the data used in this report were sufficiently reliable for our purposes.  Finally, GAO data analysts independently verified all data analysis  programs and calculations for accuracy.
To evaluate the extent of comprehensive data, we obtained and reviewed  information on the availability of data on the terrorism insurance market  and Treasury’s efforts to help estimate federal exposure under TRIA. We  reviewed previous reports to Congress from PWG and Treasury on TRIA.  In addition, we interviewed and obtained information from officials and  staff at Treasury’s Federal Insurance Office and Terrorism Risk Insurance  Program Office. To obtain information on Treasury’s efforts in determining  federal exposure, we reviewed a study from the Insurance Services  Office, Inc. that provided an estimate of average annual losses under  TRIA in any given year. We also reviewed documents from Treasury, and  information on exposure analyses from risk modeling companies, such as  RMS and AIR Worldwide. We spoke to insurers, brokers, and terrorism  risk modeling firms to better understand how they analyze information  about terrorism exposures and obtain information about the industry’s  best practices. Finally, we reviewed our work on fiscal exposures to help  determine any explicit exposures created by TRIA. For example, a  certified terrorism attack would represent an explicit exposure because  some payment by the federal government would be legally required.
To describe changes in the terrorism risk insurance market, we obtained  and analyzed available information on premiums, capacity, pricing, and  take-up rates (the percentage of businesses buying terrorism coverage).  We obtained information on terrorism insurance premiums from 2004  through 2012 from A.M. Best, an insurance rating agency, which had  collected this information as part of its annual Supplemental Rating  Questionnaire. A.M. Best provided aggregated data to us. To compare  terrorism premiums with premiums collected for other insurance lines, we  obtained data from SNL Financial on premiums earned for commercial  property and casualty insurers for all commercial lines and for lines  subject to TRIA. Additionally, we obtained capacity, pricing, and take-up  rate information from 2003 through 2013 from two insurance brokers— Marsh and McLennan (Marsh) and Aon—as available. Marsh provided  nationwide pricing and take-up rate data, while Aon had information on  capacity. Marsh and Aon are the largest business insurance brokers in  the United States. We interviewed representatives from Marsh and Aon to  ensure we had a clear understanding of which insurers the data  represented and how the brokers obtain information from their data  systems. All data presented in this report from Marsh and Aon solely  represent their clients, cannot be generalized to the entire market, and  are attributed accordingly. Based on this, we determined that the data  used in this report from the insurance brokers were sufficiently reliable for  our purposes. To obtain information on the reinsurance market and  insurance-linked securities, we interviewed representatives from the  Reinsurance Association of America and Fermat Capital Management.  We also reviewed reports from industry participants, such as Swiss Re,  Munich Re, and Aon Benfield on the status of the reinsurance and  insurance-linked securities markets. Finally, as part of our questionnaire,  we asked insurers whether they purchased reinsurance for terrorism risk  and how reinsurance purchasing patterns have changed over the last  decade.
To evaluate the potential impact of selected changes to TRIA, we  identified certain changes to the program’s parameters based on our  analysis of the program’s structure, review of relevant literature,  testimonies from congressional hearings, and prior changes made in the  TRIA reauthorizations. On the basis of these, we asked the 15 insurers  who received our questionnaire for their input on how selected changes  would affect the insurance market for terrorism risk. For example, we  asked insurers to categorize the greatest changes to program parameters  and how such changes could affect each company’s capacity, pricing,  and take-up rates. We asked insurers to categorize the greatest change  to the aggregate industry retention amount (currently, $27.5 billion) that,  in their opinion, the industry could handle. We also asked insurers if their  companies underwrote nuclear, biological, chemical, or radiological risks  or cyber risks and what metrics or factors Congress would need to  consider if changes were made to TRIA related to losses as a result of  these types of risks. Finally, we asked insurers to indicate what metrics  and factors Congress would need to consider if the federal government  were to establish a prefunding mechanism (in place of the current  postfunding mechanism—recoupment). We obtained information from  A.M. Best on estimated policyholder surplus of insurers potentially  exposed to terrorism from 2003 through 2012, to compare, industry-wide,  the TRIA deductible amounts with estimates of policyholder surplus. We  also compared the average TRIA deductible as a percentage of estimated  policyholder surplus, for the 10 largest commercial property and casualty  insurers (in insurance lines subject to TRIA), with all other insurers, as  well as the range for the 10 largest insurers. We performed this analysis  to help determine whether any differences existed for large versus small  insurers in terms of their TRIA deductible amounts as a percentage of  surplus.
We also developed examples to illustrate the impact of certain changes to  the current program on the federal government’s fiscal exposure. To  develop the examples, we consulted with experts from terrorism risk  modeling firms and reviewed relevant literature. Additionally, to develop  the examples, we made assumptions for the number of insurers affected,  and their direct earned premiums, market share, insurance lines, and total  loss amount. We used SNL Financial insurance data and information from  A.M. Best to help develop these assumptions. We compared what federal  losses would be under the current program parameters (status quo) with  those after making changes to the current program. For example, we  compared changing the deductible from 20 to 35 percent and changing  the insurers’ coshare from 15 to 30 percent, in intervals of 2 to 3 percent.  We analyzed the federal share of losses for variously sized terrorist  attacks ($25 billion, $50 billion, $75 billion, and $100 billion) before and  after recoupment, using the current law’s aggregate industry retention  amount ($27.5 billion). To help assess the reliability of our analysis, we  verified that our results were consistent with a model developed by the  Reinsurance Association of America.
We conducted this performance audit from July 2013 through May 2014,  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Department of the Treasury
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Jill Naamane (Assistant Director);  William Chatlos; Robert Dacey; Rachel DeMarcus; Patrick Dynes; Beth  Ann Faraguna; Isidro Gomez; DuEwa Kamara; Shamiah Kerney; May  Lee; Marc Molino; Erika Navarro; Susan Offutt; Barbara Roesmann;  Jessica Sandler; Melvin Thomas; and Frank Todisco made key  contributions to this report.