From an insurance standpoint, measuring and predicting terrorism risk is challenging. According to standard insurance theory, four major principles contribute to the ability of insurers to estimate and cover future losses: the law of large numbers, measurability, fortuity, and the size of the potential losses. When determining whether to offer coverage for a particular risk and at what price, insurers evaluate whether sufficient information exists about each of these principles. To underwrite insurance—that is, decide whether to offer coverage and what price to charge—insurers consider both the likelihood of an event (frequency) and the amount of damage it would cause (severity). As we have reported, measuring and predicting losses associated with terrorism risks can be particularly challenging for reasons including lack of experience with similar attacks, difficulty in predicting terrorists’ intentions, and the potentially catastrophic losses that could result from terrorist attacks. Increasingly, insurers use sophisticated modeling tools to assess terrorism risk, but there have been very few terrorist attacks, so there are little data on which to base estimates of future losses, in terms of frequency or severity, or both. When Congress passed TRIA in 2002, its purposes included making terrorism insurance widely available and affordable for businesses. As required by TRIA, insurers must make terrorism coverage available to commercial policyholders, although commercial policyholders are not required to buy it. As shown in table 1, many lines of commercial property and casualty insurance are eligible for TRIA, but the legislation specifically excludes certain lines. For example, the law excludes personal property and casualty insurance, as well as health and life insurance. TRIA requires an insurer to make terrorism coverage available to its policyholders for insured losses that does not differ materially from the terms, amounts, and other coverage limitations applicable to losses arising from events other than acts of terrorism. For example, an insurer offering $100 million in commercial property coverage must offer $100 million in coverage for property damage from a certified terrorist attack. Insurers can charge a separate premium to cover terrorism risk, although some include the price in their base rates for all-risk policies. Under the current program, Treasury would reimburse insurers for a share of losses associated with certain certified acts of foreign or domestic terrorism. A single terrorist act must cause at least $5 million in insured losses to be certified; separately, the aggregate industry insured loss from certified acts must be at least $100 million for government coverage to begin (program trigger). If an event were to be certified as an act of terrorism and the insured losses exceed the program trigger, then an individual insurer that experienced losses would pay a deductible of 20 percent of its previous year’s direct earned premiums in TRIA-eligible lines (insurer deductible). After the insurer pays its deductible, the federal government would reimburse the insurer for 85 percent of its losses and the insurer would be responsible for the remaining 15 percent (coshare). Annual coverage for losses is limited––aggregate industry insured losses in excess of $100 billion are not covered by private insurers or the federal government (cap). See figure 1 for an illustration of these program parameters. The amount of federal loss-sharing varies with the amount of industry insured losses, as the following shows: In general, for an event with insured losses of less than $100 million, private industry covers the entire loss and the federal government faces no responsibility to cover losses. In general, for an event with insured losses from $100 million to $100 billion private industry and the federal government initially share the losses, but TRIA includes a provision for mandatory recoupment of the federal share of losses when private industry’s uncompensated insured losses are less than $27.5 billion. Treasury must impose policyholder premium surcharges on all property and casualty insurance policies until total industry payments reached the mandatory recoupment amount or the government is fully repaid, whichever comes first. The mandatory recoupment amount is the difference between $27.5 billion and the aggregate amount of insurers’ uncompensated insured losses. This industry aggregate retention amount was set in the 2005 reauthorization for the year 2007 at $27.5 billion and extended as applicable for all future years under the program by the 2007 reauthorization. When the amount of federal assistance exceeds any mandatory recoupment amount, TRIA also allows for discretionary recoupment, if Treasury determines additional amounts should be recouped. Under TRIA, any discretionary recoupment would be based on the ultimate cost to taxpayers, the economic conditions in the marketplace, the affordability of insurance for small and medium-sized businesses, and any other factors Treasury considered appropriate. As initially enacted, one of the purposes of TRIA was to provide a transitional period in which the insurance market could determine how to model and price terrorism risk. Congress reauthorized TRIA twice––in 2005 and 2007. As shown in table 2, the reauthorizations changed several aspects of the terrorism risk insurance program, including the insurer deductible, lines of insurance covered, and types of terrorist acts covered (added domestic terrorism). TRIA covers insured losses resulting from an act of terrorism, which is defined, in part, as a “violent act or an act that is dangerous” to human life, property, or infrastructure. The act is silent about losses from attacks with nuclear, biological, chemical, or radiological weapons (NBCR) or from cyber terrorism. TRIA authorizes Treasury to administer the Terrorism Insurance Program. Specifically, the Terrorism Risk Insurance Program Office within Treasury’s Office of Domestic Finance administers the program and manages day-to-day operations, with oversight and assistance from the Federal Insurance Office, according to Treasury officials. In 2004, Treasury issued regulations to implement TRIA’s procedures for filing claims for payment of the federal share of compensation for insured losses. Upon certification of an act of terrorism, Treasury will activate a web-based facility for receiving claims from insurers and responding to insurers that seek assistance. According to Treasury, currently five staff work directly on the program and the program is assisted by others in Treasury. Staff responsibilities include managing contractors in place to process claims in the event of an attack and making any necessary changes to program regulations. According to Treasury, the spending for this program has generally declined since 2003 (see fig. 2). TRIA mandates various studies and data compilation efforts. For example, TRIA requires GAO, Treasury, and the President’s Working Group on Financial Markets (PWG) to complete various studies related to terrorism risk insurance. We have completed and submitted to Congress several mandated studies on TRIA. Treasury completed an assessment of the program and submitted a report to Congress in 2005. PWG must periodically report on terrorism market conditions (in 2006, 2010, and 2013). TRIA also requires Treasury to annually compile information on the terrorism risk insurance premium rates of insurers for the preceding year. In the event that information is not otherwise available to Treasury, Treasury may require each insurer to submit that information to NAIC. We discuss data compilation requirements in more detail later in this report. Insurance in the United States is primarily regulated at the state level. The insurance regulators of the 50 states, the District of Columbia, and the U.S. territories created and govern NAIC, which is the standard- setting and regulatory support organization for the U.S. insurance industry. Through NAIC, state insurance regulators establish standards and best practices, conduct peer review, and coordinate their regulatory oversight. According to NAIC, insurers set the rates for terrorism coverage, and state law requires insurers to file those rates (and to file insurance forms) with state regulators. Generally state insurance regulators receive information from insurers regarding the products the insurers plan to sell in the state. States vary with regard to timing and depth of the reviews of the insurers’ rates and contractual language. Many state laws have filing and/or review exemptions that apply to large commercial policyholders. For exempt commercial policyholders, state insurance regulators perform neither rate nor form reviews because it is presumed that these large businesses have a better understanding of insurance contracts and pricing than the average personal-lines consumer and as such, are able to effectively negotiate price and contract terms with the insurers. Comprehensive data on the terrorism risk insurance market are not readily available. In general, individual insurers maintain data on the terrorism coverage they underwrite. While Treasury has obtained some market data from industry sources, those data are limited because they do not include information from the entire industry. Federal internal control standards state that agencies should identify and obtain relevant and needed data to be able to meet program goals. TRIA requires Treasury to annually compile information on the terrorism risk insurance premium rates of insurers, and if the information is not available permits Treasury to require insurers to submit that information to NAIC, but Treasury has not taken either action. Without comprehensive market data, including the number of insurers in the market and whether differences exist in pricing or take-up rates, Treasury may not have a full understanding of the terrorism risk insurance market and be unable to assess whether TRIA’s program goals of helping to ensure the continued widespread availability and affordability of terrorism risk insurance and addressing market disruptions are being met. Furthermore, Treasury has conducted limited analysis of the federal government’s fiscal exposure under different scenarios of potential terrorist attacks. Analyzing such risks is a federal internal control standard and insurance industry best practice. Without additional analyses, Treasury does not have enough information to help understand the potential magnitude of federal fiscal exposure in the event of a certified terrorist attack, and will not be in the position to provide Congress with analysis to inform decisions about reauthorization, including any changes that would limit exposure. Comprehensive market data on terrorism insurance, including premiums and the number of insurers underwriting terrorism risk, are not readily available. In general, individual insurers maintain data on the terrorism coverage they underwrite, including data on the percentage of policies with terrorism coverage and premiums for such coverage. However, these data are proprietary and are not publicly available. Further, NAIC manages an electronic system that many insurance companies use to file premium rates and policy language with state regulators for approval. But NAIC officials stated that they generally cannot extract terrorism coverage information from it, such as the number of insurers providing such coverage or the prices charged. Moreover, using the property and casualty information NAIC collects likely would overestimate any numbers on terrorism insurance because not all policies provide terrorism coverage. NAIC officials told us that obtaining a complete view of the terrorism insurance market would require reviewing insurers’ filings with each state. Many insurance industry organizations are important sources of data on the terrorism insurance market, but data from these sources are also limited in some respects. For example, although A.M. Best, an insurance- rating and information organization, and the Insurance Services Office, Inc. (ISO), an advisory organization and data and analytics provider, collect premium information from their clients, these data are not publicly available and may not be representative of the entire industry. Insurance brokers also compile market data such as pricing, take-up rates, and coverage by industry sector from their clients. Similarly, some of these data are not publicly available and are not representative of the entire market. Treasury officials told us they periodically consulted with industry participants to obtain information about the terrorism insurance market, such as take-up rates, pricing, and capacity, but noted that the industry relies on the two largest insurance brokers for this information. However, as discussed above, the information that brokers compile is not comprehensive because it does not include detailed data on terrorism coverage from the insurance industry as a whole. In addition, PWG also solicited comments from the insurance industry on the availability and affordability of terrorism risk insurance for three studies mandated by TRIA. For example, according to Treasury officials, 29 entities submitted comments for the 2014 PWG report. In addition, Treasury conducted numerous interviews with industry participants. However, the comments PWG solicited and received from industry participants for these studies generally were anecdotal representations from the organizations that chose to submit information, rather than comprehensive data representing the entire industry. Treasury officials acknowledged that their information on the terrorism insurance market could be supplemented with more detailed information. Furthermore, TRIA requires Treasury to annually compile information on the terrorism insurance premium rates of insurers, and if the information is not available, also permits Treasury to require insurers to submit that information to NAIC, but Treasury has not taken either action. According to Treasury officials, Treasury has not compiled information on an annual basis, and has not collected market data on terrorism risk insurance directly from insurers. Treasury officials told us this was because the agency has periodically collected market data on terrorism risk insurance for the three PWG reports from industry sources, which has been sufficient for purposes of responding to TRIA’s reporting requirements. If the premium rate information was not otherwise available, TRIA states that Treasury may require each insurer to submit the information to NAIC, which then would make the information available to Treasury. Treasury officials noted that the premium rate data TRIA requires Treasury to compile may not be the only helpful data points for understanding the terrorism insurance market and said that additional baseline data would be crucial for a more detailed analysis. The officials said they may seek additional market data and evaluate whether the sources previously used were adequate. While TRIA states that Treasury has the authorities necessary to carry out the terrorism risk insurance program, including prescribing regulations and procedures to effectively administer and implement it, whether these authorities allow Treasury to collect comprehensive market data directly from insurers is unclear. However, federal internal control standards state that agencies should identify and obtain relevant and needed data to be able to meet program goals. As stated earlier, the purposes of the terrorism insurance program include helping to ensure the continued widespread availability and affordability of property and casualty insurance for terrorism risk and addressing market disruptions. Without comprehensive, nationwide market data, including the number of insurers in the market and whether differences exist in pricing or take-up rates for companies of different sizes, industries, or geographic locations, Treasury might not have a full understanding of the terrorism risk insurance market, including how changing program parameters may impact the market. Treasury may also be unable to assess whether the program is meeting its goals of helping to ensure the continued widespread availability and affordability of terrorism risk insurance and addressing market disruptions. Treasury has conducted limited analysis to help estimate the potential magnitude of the federal government’s fiscal exposure under TRIA under different scenarios of potential terrorist attacks. We developed a conceptual framework for fiscal exposures to aid discussion of long-term costs and uncertainties that present risks for the federal budget. Fiscal exposures vary widely by source, extent of the government’s legal commitment, and magnitude. Fiscal exposures may be explicit (the government is legally required to fund the commitment) or implicit (exposures arise not from a legal commitment, but from current policy, past practices, or other factors that may create the expectation for future spending). The government’s legal commitment to pay losses when a certified terrorist event occurs makes the terrorism risk insurance program an explicit exposure. The amount of federal spending resulting from the fiscal exposure under the terrorism risk insurance program depends on the extent of insured losses. In 2009, Treasury contracted with ISO to develop and implement a method for estimating total average annual insured terrorism losses in the aggregate for TRIA-eligible lines, review certain material, and advise on the appropriateness of its use for projecting potential payout rates of the federal share of insured losses. The study provides estimates (both gross and net) of the federal share of losses and was used to aid Treasury in its development of a federal budget item for the terrorism risk insurance program. ISO representatives stated that it was important to understand that the study provides an estimate of average annual losses in any given year, but in years with losses, the numbers likely would be significantly higher than the average. ISO representatives also noted that the study had some data limitations and relied on assumptions such as take-up rates for terrorism coverage that could affect the results of the analysis. This is the only study Treasury has commissioned that examines the potential overall fiscal exposure of the terrorism risk insurance program to the federal government. In addition to the ISO study, Treasury officials provided us with a hypothetical loss scenario that shows private-sector and federal loss sharing under a specific set of circumstances. According to Treasury officials, this example was not an official work product and they emphasized that they developed the example purely to illustrate the recoupment calculations and it should not be considered as a projection of the fiscal exposure of a terrorist event to the government. The exact amount of government spending or the government’s obligation is difficult to predict because, among other factors, it depends on the distribution of losses among insurers. For example, the aggregated 20 percent deductible equaled $37 billion (20 percent of direct earned premiums for TRIA-eligible lines), according to our analysis of SNL Financial’s 2012 insurance data. However, losses from a terrorist attack are highly unlikely to affect all insurers or be distributed evenly among all insurers. As a result, if fewer insurers had losses, the deductible amount would be lower and the government’s share of losses likely would be triggered at an amount less than the aggregated industry deductible. Therefore, the government’s spending or obligation likely would begin at an amount less than the industry’s aggregated deductible. Federal internal control standards state that agencies should identify and analyze risks associated with achieving program objectives, and use this information as a basis for developing a plan for mitigating the risks. For example, because the amount of the government’s fiscal exposure varies according to the specific program’s design and characteristics, estimates could be developed to better understand the potential costs of changes to certain program parameters under various scenarios of potential terrorist attacks. This could increase the attention given to fiscal exposures, while also providing decision makers relevant information to consider when determining the best way to achieve various policy goals or design a program. According to the insurers and other industry participants we spoke to, insurers’ best practices also show that an insurer’s analysis of the location and amount of coverage written is prudent for understanding the financial risks of a potential terrorist attack of a specific size. Insurers work with terrorism risk modeling firms to help understand their potential financial exposure from a future terrorist attack. For example, to help illustrate how an insurer would be financially affected after a terrorist event and how losses would be shared between the private sector and the federal government under TRIA, some industry participants have developed hypothetical scenarios. According to a study published by the Wharton Risk Management and Decision Processes Center, insurers use such scenarios to determine their maximum exposure to a range of possible attacks. Ultimately, the amount of fiscal exposure created by TRIA will be determined by the program parameters and the specific circumstances of a future attack (such as the number of insurers affected and number of businesses that had purchased terrorism coverage). However, these scenarios can be used to help understand risk and the impact of the financial losses under TRIA under specific scenarios of potential terrorist events, and to analyze losses if TRIA were not renewed (that is, if the private sector would be responsible for all losses). In addition to information on the type of attack (for example, damage from 2- to-10 ton truck bombs), these scenarios can rely on estimates of insurers’ market share and direct premiums earned, among other data points. For public policy purposes, in 2014 the Reinsurance Association of America developed a model to help participants evaluate various loss scenarios. We also have developed hypothetical examples to help illustrate the potential magnitude of the federal government’s fiscal exposure, which will be discussed later in this report. Treasury officials said that they have conducted limited analysis on the government’s fiscal exposure under TRIA because the amount of the government’s fiscal exposure is ultimately determined by program parameters and the risk modeling and exposure analyses used by insurers are not entirely applicable in understanding how to reduce federal exposure. According to Treasury officials, insurers manage risk by first understanding and then limiting their exposures by insurance line or geographic location. Fiscal exposure under TRIA is limited by the program parameters and the circumstances of a future attack (such as number of insurers affected and number of businesses that had purchased terrorism coverage). Treasury officials also said that the amount of fiscal exposure is difficult to determine because it is shaped by variables, such as geography, type of event, and number of affected insurers. However, Treasury officials acknowledged that hypothetical analyses that provide illustrative analyses and estimate the potential total amount of losses may be helpful in understanding fiscal exposure. Without analyzing comprehensive market data on the type and amount of coverage provided from all insurers participating in the market, Treasury does not have enough information to help understand potential federal spending under various scenarios of potential terrorist attacks. In addition, Treasury is not in the position to provide Congress with analysis to inform decisions about reauthorization and the future structure of the program, including any changes that would limit exposure, one of the goals that Treasury recently articulated in its 2015 budget justification. Available data on the market for terrorism risk insurance generally indicate a stable market in recent years. Total terrorism insurance premiums, which make up a small percentage of insurers’ overall premiums, increased after the original act and reached a high in 2007, then declined, and have stabilized since 2010. Insurers report capacity to provide terrorism coverage over the past decade has remained unchanged. In general, prices appeared to have decreased as the number of businesses buying terrorism coverage (take-up rates) increased from 2003 to 2006, but have been constant since 2010. The transference of terrorism risk through reinsurance or alternatives to reinsurance, such as insurance-linked securities (catastrophe bonds), has remained limited. Available data show terrorism insurance premiums have stabilized over the past few years (see fig. 3). For instance, total premiums generally increased through 2007, then declined, and stabilized from 2010 through 2012. In 2012, the most recent year for which data are available, estimated terrorism insurance premiums were $1.7 billion, down from a high of $2 billion in 2007. A.M. Best’s estimates about $17 billion was collected for terrorism insurance premiums from 2004 through 2012. Furthermore, terrorism insurance premiums collected on workers’ compensation and commercial property insurance lines each made up about 40 percent of the estimated total terrorism insurance premiums, with the remaining 20 percent from all other commercial lines. These proportions remained relatively stable in recent years. Based on our analysis of A.M. Best and SNL Financial insurance data, trends in terrorism insurance premiums have not differed markedly from trends in other commercial insurance line premiums. For example, premiums for all commercial property and casualty lines showed the same pattern––increases until 2007, declines from 2007 through 2010, and then increases in 2011 and 2012. Commercial property and casualty generally follows an insurance industry cycle, characterized by periods of soft market conditions––a market with abundant willingness to write new policies (capacity), increasing competition, and rates (prices) that grow marginally or decrease––followed by periods of hard market conditions–– in which capacity is relatively low, competition decreases, rates increase, and capital is scarce. This cyclical nature of the property and casualty industry likely plays a role in the hardness or softness of the terrorism insurance market. For example, the similarity in trends in premiums indicates that the terrorism insurance market is closely related to the overall commercial property and casualty market. The 2007-2009 financial crisis affected the overall commercial property and casualty market and most likely affected the terrorism insurance market in similar ways. For instance, the financial crisis generally affected commercial property and casualty insurers through decreased net income, as underwriting and investment results deteriorated. However, making an accurate assessment of the terrorism insurance market is challenging. According to industry participants, uncertainty surrounding the two previous TRIA reauthorizations––whether the program would be reauthorized and if so, with what changes––led to periods of market instability. Insurers told us their terrorism insurance premiums made up a very small amount of their overall premiums. As previously mentioned, we obtained information from 15 insurers as part of a questionnaire. According to the responses, on average terrorism insurance premiums made up less than 2 percent of commercial property and casualty premiums, or roughly $1.7 billion in calendar year 2012 (the range for the 15 insurers was 0.7 to 3 percent). An insurer told us terrorism insurance premiums have not significantly affected overall capital levels because premiums collected for terrorism risk have been low and insurers use some of the terrorism insurance premiums to account for reinsurance, expenses, and taxes. A.M. Best and SNL Financial data also indicate that, in terms of the share of total premium, coverage for terrorism risk is concentrated among the largest insurers. In the case of terrorism insurance premiums, according to A.M. Best data, 10 insurers made up roughly 70 percent of premium volume (see table 3). The same 10 insurers accounted for 44 percent of premiums in all insurance lines subject to TRIA and 39 percent of premiums in all commercial property and casualty lines. An industry representative with whom we spoke said only the largest insurers have the ability to underwrite large terrorism risks and hence account for a large portion of the industry’s terrorism insurance premiums. The composition of the terrorism insurance market resembles other insurance markets that the Federal Insurance Office has characterized as concentrated. For example, according to the Federal Insurance Office’s 2013 annual report, 10 insurers made up 47 percent of the property and casualty market (both commercial and personal) and 72 percent of the life and health insurance market, in 2012—both of which the report characterizes as concentrated markets. Although we present an estimated number of insurers that provide coverage for terrorism risk, identifying the precise number of insurers in this market is difficult because of the lack of comprehensive data. As noted previously, insurers are not required to report data about terrorism risks to Treasury or NAIC. As shown in table 3, according to SNL Financial data, more than 800 insurers reported premiums in insurance lines subject to TRIA and therefore, by law, offered coverage. A.M. Best’s survey data provides further context for this market. For 2012, A.M. Best estimated more than 200 insurers provided coverage for terrorism risk. Insurers providing coverage in the insurance lines subject to TRIA must offer terrorism coverage, but businesses are not required to buy it. Therefore, the number of insurers offering coverage in the insurance lines subject to TRIA (more than 800) and the number of insurers covering terrorism risk and collecting terrorism insurance premiums (estimated at more than 200) will differ. According to an insurance broker, capacity seems to have improved, but insurers report that capacity has remained the same and that they limit capacity as needed to manage their overall exposure. Capacity is the amount that insurers are willing to allocate to underwrite a specific risk. Terrorism coverage typically is embedded in an all-risk property policy and therefore available terrorism capacity is tied to overall capacity for all- risk property policies. According to information from an insurance broker, the reported market capacity for terrorism risk seems to have increased. According to an Aon report, in 2013 about $14 billion per risk was available to any one insured for an all-risk property policy. This amount increased from $13.5 billion in 2010 and $8 billion in 2005. This represents the amount of coverage an insurer is willing to provide to any one insured. However, the actual capacity for terrorism risk is much lower than $14 billion per risk because the amounts above encompass capacity for risks in addition to acts of terrorism. According to Aon, non-terrorism- related exposures, such as natural catastrophes (earthquake and windstorm), can vastly decrease the available capacity for terrorism risk. Moreover, individual insurers’ capacity to underwrite terrorism will differ, and insurers told us they would limit capacity as needed based on their aggregate terrorism exposures, geographic concentration of terrorism exposures, and terrorism exposures relative to other natural catastrophe exposures. Most insurer representatives with whom we spoke reported that capacity to provide terrorism coverage over the past decade remained constant and 6 out of the 15 insurers stated that they limited capacity as needed to manage their overall exposures. About half of the insurers told us TRIA enabled them to provide capacity for terrorism risks, but TRIA also was the reason why capacity has remained relatively unchanged—because insurers managed their exposures based on the program parameters. In general, insurers assume some financial risk when covering terrorism risk, but they also employ various underwriting standards to manage the risk and limit potential financial exposures. As we previously reported, insurers’ willingness to provide coverage in certain areas may change frequently as new clients or properties are added to or removed from their book of business. In response to our questionnaire, most insurers told us they determined the amount of coverage they were willing to provide in defined geographic areas, depending on their risk tolerance. These amounts are sometimes called coverage limits (capacity limits) and are managed in relation to overall terrorism exposures. Almost all insurers told us factors such as loss estimates from terrorism models, aggregation of exposures in defined areas, proximity of exposures to high-profile targets or buildings, and individual property characteristics affect their terrorism underwriting decisions. Insurers may decide to limit capacity; that is, decide not to underwrite certain coverage, if taking on the additional risk would exceed their internal capacity limits. A few insurers that we interviewed also told us that over the past decade they have benefitted from significant improvements to their data systems and models that track terrorism exposures; in turn, the better systems and models have improved their ability to make sound underwriting decisions when renewing or writing new policies. Prices have declined and insurers say TRIA has allowed them to offer coverage at prices policyholders are willing to pay. Insurers may charge an additional premium for terrorism coverage, as TRIA does not provide specific guidance on pricing. According to data from Marsh, prices for terrorism coverage, as part of a commercial property policy, generally declined over the past decade (see fig. 4). These data are not necessarily reflective of the entire market, but represent the best available data on pricing. While prices slightly increased from 2003 to 2004, prices steadily declined since 2006. In 2013, the nationwide median amount that businesses paid per million dollars of coverage for terrorism insurance was $27. Using the 2013 nationwide median rate, a company purchasing $100 million in coverage for property damage would have paid approximately $2,700 in terrorism insurance premiums. In addition, prices that businesses pay will vary depending on company size, location, and industry. For example, prices will typically decrease as the size of the company increases (size measured in terms of insured value and prices measured in millions of dollars of coverage), are typically higher in the Northeast, and higher in certain industry subsectors (such as construction, power and utilities, and media) due to perceived or actual risk exposure to terrorism. But because comprehensive pricing data are not readily available, it is difficult to clearly understand how prices differ by company size, location, or industry. According to data from Marsh, from 2003 to 2013, companies paid approximately from 4 to 9 percent of their total property premium for terrorism coverage (see fig. 5). Analyzing the price of terrorism coverage as a part of overall property premiums allows companies to understand how terrorism coverage affected their overall property insurance budget. Businesses paid no more than approximately 5 percent of their total property premium for terrorism coverage since 2011. Using the 2013 data, a company purchasing $100 million in property coverage would have paid approximately 4 percent of its $67,500 overall property premiums for terrorism coverage (or $2,700). Insurers told us TRIA allows them to offer coverage at prices their policyholders are willing to pay. Insurers said their primary concern for covering terrorism risks was limiting their exposures (that is, capacity) because the losses could be huge under certain types of terrorist attacks and that pricing was secondary. TRIA addresses insurers’ primary concerns about the size of potential losses—it provides a structure in which insurers know, before an event, what their losses could be because the deductible and coshare are defined by law and losses are capped. For most insurance products, insurers typically use the potential frequency and severity of events to calculate premiums that are commensurate with the risks. Because the frequency and severity of terrorism are difficult to predict, the limits established in TRIA, which cap the potential severity of losses to insurers, make underwriting the risk and determining a price for terrorism coverage easier for insurers. Furthermore, most insurers said their companies’ experiences with collecting terrorism insurance premiums and providing terrorism coverage over the past decade have had minimal or no impact on their pricing strategy. Insurer responses suggest this is mainly because terrorism is so different from other perils. For example, one insurer noted that with natural catastrophes, insurers have a long history of experience writing and pricing (based on claims), but this is not the case with terrorism. Another insurer noted that terrorism risk provides too few data points to inform pricing and underwriting decisions. Additionally, one insurer told us it is a very competitive market and they do not charge terrorism insurance premiums that would cover their potential losses from a terrorist attack. For example, this insurer noted that if insurers did charge premiums that would cover potential losses, businesses would not buy it. Take-up rates—which are the percentage of businesses buying terrorism coverage and help measure the demand for terrorism risk insurance— increased from 2003 to 2006 and have remained relatively constant (and above 60 percent) since 2010, according to data from Marsh (see fig. 6). According to Treasury and NAIC, neither collects this type of information. Take-up rate data for businesses buying terrorism coverage as part of commercial property policies are only available from insurance brokers. The take-up rate for businesses buying terrorism coverage as part of workers’ compensation policies is 100 percent because state laws require businesses to purchase workers’ compensation insurance and do not permit insurers to exclude terrorism from workers’ compensation policies. Take-up rates will vary depending on company size, location, and industry. For example, larger companies are more likely to purchase coverage than smaller companies, the Northeast has the highest take-up rates, and certain industry subsectors have higher take-up rates than others (for example, media, education, and financial institutions). According to our questionnaire results, overall take-up rates for insurers varied significantly (from 26 to 100 percent). One respondent noted that analyzing insurers’ overall take-up rates can be misleading and it is more appropriate to look at take-up rates for terrorism coverage in each line of insurance subject to TRIA. According to our questionnaire results, the lines of insurance with the highest take-up rates for terrorism coverage are commercial multiperil and inland marine, and the lines with the lowest take-up rates for terrorism coverage are aircraft and boiler and machinery. However, because Treasury and NAIC do not collect take- up rate data from insurers, it is difficult to thoroughly analyze take-up rates by line of insurance. According to industry participants, take-up rates may have reached a plateau—that is, most businesses that want the coverage already have purchased it. From 2003 through 2013, take-up rates doubled, while prices declined by 50 percent. In more recent years, take-up rates remained relatively constant, although prices continued to decline (as shown in figures 4 and 6). Since 2010, both take-up rates and estimated terrorism insurance premiums have been relatively stable (see fig. 7). The changing proportions of new versus renewal policies covering terrorism risk offer further evidence that demand may be leveling off. On the basis of our questionnaire results, the majority of policies are renewals rather than new issuances, and this has stayed the same over the past several years (on average, about 83 percent renewals in 2008 and in 2012). The transference of terrorism risk—namely, through reinsurance and alternatives to reinsurance such as insurance-linked securities—has been limited. Reinsurance capacity for terrorism risk has increased, but remains small relative to the federal reimbursements available through TRIA. For example, according to industry participants about $6 billion to $10 billion in terrorism reinsurance capacity was available in the United States in 2013, which was an increase from the $4 billion to $6 billion available several years ago, but was still small compared with the federal assumption of 85 percent of losses (up to $100 billion of aggregate industry exposure minus items such as the insurer deductibles) in TRIA. Without TRIA, current reinsurance capacity would be insufficient to respond to a large-scale terrorist attack, in particular up to the limits the government program provides, according to a reinsurance trade association representative. Additionally, terrorism reinsurance capacity is small in relation to capacity for other perils. For example, the total amount of reinsurance capacity available for natural catastrophe risks in the United States in 2012 ranged from $90 billion to $120 billion. Several factors limit the market for reinsurance of terrorism risk. For instance, unlike primary insurers, reinsurers are not subject to TRIA and therefore are not required to offer primary insurers coverage for terrorism risk. According to industry representatives, reinsurers face the same challenges as primary insurers––that is, terrorism risk is difficult to model and price, which also contributes to a limited market. Finally, insurers told us they typically purchase terrorism reinsurance as part of a multiperil policy that covers terrorism risk in addition to other risks. To help manage their exposures to concentrated losses, reinsurers frequently write terrorism coverage with specific limits for individual properties rather than reinsure a share of an insurance company’s overall holdings. According to brokers and reinsurers, terrorism reinsurance prices generally have declined by 50 percent over the past decade and more. Reasons these industry participants cite for the price declines include the passage of time since the September 11 attacks, the lack of subsequent terrorist attacks resulting in significant losses, decreased demand from primary insurers, and increased supply of reinsurance. However, the location of exposures also affects the price of terrorism reinsurance. For example, reinsurance coverage is more expensive for exposures in densely populated urban areas than less densely populated areas. Although individual insurers’ reinsurance patterns vary, insurers have been reinsuring a limited amount of their terrorism risk and retaining roughly 80 percent of it according to the 2010 PWG report. Insurers make decisions on how much reinsurance to purchase based on their perception of risk, price of coverage, ability to manage risk, and other factors. One insurer contributing to this report commented that terrorism risk reinsurance remains insufficient to serve the market’s current risk exposure. According to our questionnaire results, 13 insurers purchased reinsurance for terrorism risk and 2 did not. Some responding insurers that purchased reinsurance for terrorism risk noted an increase in their purchasing levels, some noted a decrease, and still others noted fluctuations in their purchasing patterns. One insurer purchased terrorism reinsurance coverage continuously since 2002 and increased its limits as capacity became available and pricing became more affordable. Two insurers said that their purchases of terrorism reinsurance decreased over time. The two insurers that did not purchase reinsurance for terrorism noted that while some reinsurers were willing to provide a modest capacity for terrorism risk, the cost was prohibitive for them. Additionally, insurers noted that potential modifications to TRIA would affect their demand for reinsurance. For example, potential modifications that would increase insurers’ deductible and coshare amounts would result in increased demand from primary insurers for reinsurance, but supply might stay the same. As an alternative to reinsurance, insurance-linked securities have remained a limited option for covering terrorism risk. Specifically, catastrophe bonds, insurance-linked securities that typically cover natural catastrophes, have been used over the past 20 years mainly because of the large amount of resources available in capital markets. Catastrophe bonds are risk-based securities that pay relatively high interest rates and provide insurance companies with a form of reinsurance to pay losses from natural catastrophes. A catastrophe bond offering typically is made through an investment entity that may be sponsored by an insurance or reinsurance company. The investment entity issues bonds or debt securities for purchase by investors, thus spreading risk. Catastrophe bonds, by tapping into the securities markets, offer the opportunity to expand the pool of capital available to cover a particular risk. Some insurers and reinsurers issue catastrophe bonds because they allow for risk transfer and may lower the costs of insuring against the most severe catastrophes (compared with traditional reinsurance). Although catastrophe bonds have become more common, two have been issued to date that cover terrorism risk and neither is explicitly a terrorism risk bond that covers risks included under TRIA. Each is a multi-event bond associated with the risks of natural disaster, pandemic, or terrorist attack. However, these bonds are mortality bonds and therefore would be an alternative for a life insurance policy (which is not a line of insurance eligible for TRIA) and not an alternative to commercial property and casualty insurance. As of April 2014, no property and casualty terrorism bonds have been issued. Industry representatives mentioned various challenges to issuing catastrophe bonds covering terrorism risk. Investors generally avoid risks not widely underwritten in reinsurance markets and therefore lack interest in such catastrophe bonds. Investors are reluctant to make investments in which losses may be correlated with widespread financial market losses (as was the case with terrorism losses after September 11, 2001) as well as low returns or payouts. Rating agencies have not been willing to use terrorism loss models that estimate the probability of terrorism events (probabilistic models) for rating purposes and at least for terrorism risk investors tend to avoid risks that cannot be credibly modeled and rated. The difficulty of modeling terrorism represents an additional overall challenge to the development of the private market for terrorism insurance. Models used to estimate terrorism risk have become more sophisticated in estimating the severity of specific events in recent years. However, they remain fundamentally different from those used to assess natural hazard risks, which estimate both the severity and probability. For example, according to the Reinsurance Association of America, terrorism modeling is primarily a means for underwriters to measure how much they have at risk in a given geographic area and losses from a specific type of event (that is, the severity of an event), not to estimate the probability of such events. Terrorism risk is unlike other catastrophic risks—such as earthquake or hurricane—in that terrorists can alter their behavior, which makes it hard to model the probability of potential events with the level of accuracy required to accurately price the coverage. There are relatively few instances on which to base probability estimates for acts of terror in the United States, which means that such estimates lack actuarial credibility. Additionally, insurers and modeling firms have no access to data used internally by U.S. intelligence and counterterrorism agencies. Moreover it may be impossible to build a model that provides a valid representation of all individuals and groups that might decide to try to use terrorism as a tactic against the United States. In addition, as opposed to other types of risks that are random to some extent, terrorist acts are intentional and terrorists continually attempt to defeat loss prevention and mitigation strategies. Insurers and other industry participants cited concerns about the availability and price of terrorism coverage if TRIA expired or was changed substantially, but some changes could reduce the government’s fiscal exposure. For example, some insurers we interviewed said they would stop covering terrorism risks if TRIA expired. In addition, most of the insurers we interviewed, including larger and smaller insurers, cited potential consequences associated with increasing the deductible or coshare, such as impacts on pricing, the need to reevaluate risk and capacity, and threats to their solvency in the event of a large industry loss. These concerns are consistent with points industry participants raised before previous reauthorizations of the program. However, several insurers told us they were less concerned about an increase to the aggregate retention amount or program trigger. Further, we found that increasing the deductible, coshare, or industry aggregate retention amount could reduce the government’s fiscal exposure under certain terrorist event scenarios. Responses to our questionnaire revealed that insurers were uncertain about whether TRIA covers risks from a cyber terrorism attack. Without clarification of the coverage of cyber risks, some insurers may not offer cyber coverage and the coverage may not be as available. The long-term impact of expiration of the terrorism risk insurance program’s authority is difficult to determine, but according to insurers, in the short run, the availability of terrorism coverage may become more limited. Some insurers told us that they will stop providing terrorism coverage if TRIA expires on December 31, 2014. As indicated by responses to our questionnaire and other surveys of insurers, some insurers already made regulatory filings or issued notices to policyholders indicating that terrorism coverage would be excluded from policies in force beginning on January 1, 2015, if TRIA expired. For example, one insurer said that if TRIA were not renewed, the company would either exclude terrorism coverage or not underwrite businesses in states that prohibit terrorism exclusions. Insurers could further limit terrorism exposures, particularly in geographic areas considered at high risk for attacks. Because some states prohibit excluding certain risks, if a large-scale event occurred in the absence of TRIA, some insurers could face higher risk of insolvency or have more incentives to leave the market. For example, New York state insurance law prohibits terrorism exclusions for property and casualty policies that include standard fire coverage. In some other states, property insurers must cover losses from fire regardless of the cause of the fire, including a terrorist attack, even if the policyholder declined terrorism coverage. Thus, if TRIA expired, insurers operating in these states still would have to cover damage from fire following a terrorist attack. Such situations might leave some insurers bearing risks they could not adequately reinsure and leave them at increased risk for insolvency. Some insurers might decide their exposures were too great without TRIA and exit the market or decline to insure commercial property altogether. Some industry observers have noted that, in the long term if no large losses occur, the private insurance market might be able to address the need for terrorism coverage without support from the program. The amount of insurance and reinsurance written is related, in part, to the amount of surplus held by insurers and reinsurers. Over time, the private insurers and reinsurers might develop additional terrorism capacity if there are no losses due to terrorism. If capacity did not increase in the terrorism insurance and reinsurance markets, the insurance-linked securities market might develop and insurers might increasingly attempt to access capital markets to help spread terrorism risk. One capital markets participant said that in the past catastrophic shocks have led to more interest in insurance-linked securities and accelerated issuance of natural catastrophe bonds and that the expiration of the program could similarly foster interest in bonds for terrorism risk. However, insurers and reinsurers continue to question whether the market can accurately price terrorism risk. As a result, insurers and reinsurers might continue to believe they were unable to accurately price for such risks and leave the market for terrorism risk insurance (as happened after September 11, 2001). Furthermore, because losses would no longer be capped, rating agencies might downgrade ratings for insurers and reinsurers, affecting the companies’ ability to raise capital. In the long term, policyholders (businesses) also might increase terrorism mitigation and deterrence efforts. For example, businesses might locate some operations away from high-risk areas, invest in mitigation measures (retrofitting properties to better withstand an attack or improve evacuation measures), or both. In the case of workers’ compensation, businesses unable to find coverage from insurers would have to obtain coverage from state funds, which might be more expensive than coverage from primary insurers. For example, representatives of one industry association told us that after the September 11, 2001, attacks, participation in state funds in New York, Washington, D.C., and Virginia increased, as some businesses were unable to find workers’ compensation coverage from primary insurers. Over time, businesses were able to leave the state funds and find coverage in the primary market, but workers’ compensation insurers became more selective about the number of employers they insured in a particular location. Finally, past experience following disasters suggests that the federal government may provide assistance to businesses after a terrorist event in the absence of a federal terrorism insurance program. For example, following the September 11, 2001, terrorist attacks, we reported in 2003 that Congress committed at least $18.5 billion to individuals, businesses, and government entities in the New York City area for initial response efforts, compensation for disaster-related costs and losses, infrastructure restoration and improvement, and economic revitalization. As we reported in 2009, many federal agencies and program components administer supplemental programs and funding, reprogram funds, or expedite normal procedures after a disaster. For example, forms of disaster assistance available from federal agencies include grants, loans, loan guarantees, temporary housing, counseling, technical assistance to state and local governments, and rebuilding or recovery projects. Following the April 2013 bombings in Boston, the federal government issued an emergency declaration for the state of Massachusetts that made federal assistance for equipment, resources, or protection available as needed. In 2012, we reported that the growing number of major disaster declarations contributed to an increase in federal expenditures for disaster assistance. For fiscal years 2004 through 2011, the federal government obligated more than $80 billion in disaster relief, about half of which followed Hurricane Katrina. And about $50 billion in federal assistance supported rebuilding efforts after Superstorm Sandy. As previously discussed, each of the program parameters—program trigger, deductible, coshare, and industry aggregate retention amount— have changed since the program was enacted. It is not clear what impact these past changes have had on insurers in the market, but insurers told us that they generally preferred no additional changes. According to responses from our questionnaire, 11 of 15 insurers said that the TRIA program trigger (currently $100 million) could be increased without significantly changing their ability to provide coverage. In particular, 6 of those 11 insurers noted their companies would be able to offer terrorism coverage if the program trigger were raised up to $500 million, while of the remaining 5 insurers, 4 said they could offer coverage if the trigger were raised up to $1 billion and one insurer said that the trigger could be increased to more than $1 billion. Insurers said that they could continue offering coverage under an increased trigger amount because their current deductibles under the program were higher than the program trigger and increasing the trigger would not impact their share of losses. For example, using 2012 data, the 10 largest insurers in TRIA-eligible lines all had deductibles much greater than $100 million. As stated previously, while government coverage is triggered once aggregate industry losses exceed $100 million, individual insurers that experienced losses would first pay their deductibles and only then be eligible to receive federal reimbursement for 85 percent of their losses. One insurer explained it was less concerned with changes to the program trigger than to the deductible and coshare percentages, because changes to the latter were more likely to have direct impacts on insurers’ liquidity and result in significant market disruptions. Further, we found that increases to the program’s parameters could reduce federal fiscal exposure in certain situations, as long as the private sector’s share of losses is below the industry aggregate retention amount of $27.5 billion. As previously discussed, TRIA includes a provision for mandatory recoupment of the federal share of losses when private industry’s uncompensated insured losses are less than the industry aggregate amount of $27.5 billion. Insurers that responded that they preferred that no change be made to the program trigger cited concerns about capacity limitations, increased terrorism insurance premiums, and an increase in the cost for terrorism reinsurance if the trigger were increased. Most of the insurers said that increases to the current deductible (20 percent of previous year’s direct earned premium) or private-sector coshare (currently at 15 percent) could affect insurer capacity and pricing. For example, insurers commented that an increase in either of these parameters would result in their companies reevaluating their risk, and likely reducing their capacity or increasing policyholders’ premiums. One insurer said that it had adjusted its terrorism risk-management program according to the current program, and that any increases almost certainly would result in the company taking risk-mitigation actions, including reducing terrorism exposures, to offset the increased risk to the company’s surplus. In addition, insurers stated that increasing the deductible or private-sector coshare would bring many companies under rating agency scrutiny for risk concentrations, which likely would result in industry-wide reductions in terrorism exposure. However, some insurers (3 of 15) told us that their companies could absorb a higher deductible amount, including one insurer that told us its company could absorb an increase in the deductible up to 29 percent. However, this same insurer cautioned that such an increase likely would result in increased premiums for terrorism coverage and decreased take-up rates. Insurers also expressed concerns about impacts on their solvency if the deductible or coshare percentages were increased. For example, insurers commented that such increases could affect rating agency assessments of companies’ financial strength. Representatives of A.M. Best told us that they use a stress test of different scenarios to measure insurers’ financial strength and notified 34 insurers their ratings could be negatively affected without a sufficient action plan as a result of failing the stress test. Insurers told us that increasing the deductible or private-sector coshare— and thus the amount of losses insurers would be responsible for paying— could adversely affect insurers’ liquidity and solvency in the event of large terrorism losses given the levels of surplus available from which to pay these losses. Industry participants consider deductible in relation to surplus as a metric to help understand how much of the company’s surplus would be at stake to pay the TRIA deductible amount in the event of a certified act of terrorism. (Insures also must have surplus available to cover unexpectedly large losses in all other lines of insurance they underwrite.) We found the TRIA deductible has generally represented an increasing portion of insurers’ surplus. Under the current program parameters, in 2012 the industry-wide TRIA deductible made up approximately 17 percent of estimated surplus of insurers potentially exposed to terrorism risk. Deductibles remained at 15 percent or higher of estimated surplus since 2005 (see fig. 8). Smaller insurers’ surplus would be affected more than larger insurers’ surplus in the event of a large terrorism loss. For example, according to our analysis of 2012 SNL Financial insurance data, on average, smaller insurers’ TRIA deductible amounts made up 23 percent of surplus compared with 12 percent for larger insurers (that is, the 10 largest commercial property and casualty insurers in TRIA-eligible lines). However, some larger insurers’ surplus also would be at heightened risk. For example, the TRIA deductible amounts represented from 7 to 19 percent of surplus of larger insurers. If the deductible was increased to 35 percent, surplus at stake (using 2012 data and holding the estimate for surplus constant) would nearly double to 30 percent, greatly increasing the possibility of insurer insolvencies due to certified terrorism losses. In contrast to insurer responses on the program deductible and coshare percentages, some insurers told us that the industry could absorb an increase to the industry aggregate retention amount. According to responses from our questionnaire, 7 out of 15 insurers said the industry aggregate retention amount should stay the same and 5 said it could be increased. Two insurers that said increasing the retention amount was reasonable because the industry has grown. For example, one insurer commented that the $27.5 billion amount was roughly based on 20 percent of industry premiums for TRIA-eligible lines in 2006. This insurer stated that because of growth in premiums, the insurance industry was capable of assuming a higher aggregate retention. Another insurer commented that surplus for the property and casualty industry has grown by approximately 20 percent since the 2007 reauthorization; therefore, the insurance industry might be able to absorb an increase in the amount based on the growth in surplus, which would be approximately $33 billion. However, 7 insurers reported that they preferred to maintain the current industry aggregate retention amount and most of those insurers cited concerns about the impact a higher retention amount would have on policyholders, due to the surcharges that would be added to policyholder premiums in the event of recoupment. One industry participant noted that according to experience in other lines of insurance, any surcharge that resulted in a premium increase of more than 2 percent might result in policyholders deciding not to purchase this coverage. Changes to program parameters not only would affect insurers but also estimates for fiscal exposure under TRIA. The legal commitment to pay a share of the losses when a certified terrorist attack occurs makes the program an explicit fiscal exposure for the U.S. government. The amount of federal spending resulting from this exposure depends on the extent of covered losses incurred as a result of a certified attack. Because the potential amounts of fiscal exposure and loss sharing would depend on the specifics of a certified act of terrorism, we developed illustrative examples to help demonstrate estimated changes in the magnitude of fiscal exposure when the deductible, coshare, or industry aggregate retention amounts were individually changed. We found that increasing the insurer deductible, coshare, or aggregate retention amount could reduce the government’s fiscal exposure in certain situations (see fig. 9). More specifically, as the deductible or coshare percentages increase, the government’s overall share of losses decreases, but only when the private sector’s share of losses exceeds $27.5 billion (because of mandatory recoupment). Increasing the industry aggregate retention amount would have a greater impact on reducing fiscal exposure than increasing either the deductible or coshare percentages by certain specified amounts (see fig. 10). The potential reduction to federal exposures was most pronounced in our scenario with a $50 billion loss and an increased retention amount. Such a scenario would approximate current-dollar losses similar to those that resulted from the September 11, 2001, terrorist attacks. Potentially, every $1 increase in the retention amount can result in an equal $1 decrease in federal exposure, when the insured losses are more than the industry aggregate retention amount of $27.5 billion. The insurers’ share of losses increases with any decrease in federal fiscal exposures. According to this $50 billion loss scenario, under the current program parameters the government’s share of losses after mandatory recoupment would be $23 billion. If the industry aggregate retention amount were increased to $35 billion, as suggested by increased surplus levels in the industry, federal exposure could decrease to $15 billion (see fig. 10). To achieve similar levels of reduction in the government’s share of losses, the deductible would have to be raised from 20 to more than 35 percent. There was no observable change to federal exposure when the coshare was increased in this $50 billion loss example because of the mandatory recoupment amount. The impact of changing the industry aggregate retention amount compared to changes to the deductible or coshare is even more evident under our $75 billion loss scenario (see fig. 11). As we have previously reported, insurers generally have attempted to limit their exposure to nuclear, biological, chemical, or radiological (NBCR) risks by excluding nearly all NBCR events from property and casualty coverage. According to industry representatives, property and casualty insurers believe they have excluded NBCR coverage by interpreting existing exclusions in their policies to apply to NBCR risks, but some of the exclusions could be challenged in courts. In 2004 Treasury issued an interpretive letter that clarified that the act’s definition of insured loss does not exclude losses resulting from NBCR attacks or preclude Treasury from certifying a terrorist attack involving NBCR weapons. According to Treasury’s interpretive letter, the program covers insured losses from NBCR events resulting from a certified act of terrorism, if the coverage for those perils is provided in the policy issued by the insurer. While Treasury has confirmed that NBCR losses would qualify for loss sharing under TRIA, we found insurers generally excluded coverage for NBCR risks. Several insurers told us that they do not underwrite NBCR risks because of the lack of data to assess frequency and severity, which makes it difficult to determine an accurate price for the coverage. One insurer told us that NBCR events are uninsurable because of the scale of losses, difficulties in modeling, and the deliberate nature of the acts. Several insurers also told us they generally exclude NBCR risk where state law permits. However, insurers are generally required to cover NBCR losses for workers’ compensation policies, and may provide NBCR coverage in other limited circumstances. For instance, two insurers we interviewed provide NBCR coverage in limited circumstances. One insurer told us that the company covers NBCR risks in its general liability policies, and another said some of its environmental policies include NBCR coverage. As stated previously, workers’ compensation insurers generally include NBCR coverage because states generally prohibit the exclusion of any peril for workers’ compensation. Also, certain states require insurers to cover fire following an event, regardless of the cause of the fire. Thus, an NBCR event that leads to a fire may activate a fire policy providing coverage to a policyholder. Other options for NBCR coverage exist. For instance, NBCR coverage can be obtained through the use of captive insurers accessing the TRIA program and we previously reported that some large businesses elected this coverage route. There also is a limited stand-alone terrorism insurance market for NBCR, but high prices have prevented most businesses from purchasing coverage. And, although reinsurance companies traditionally excluded NBCR, about two-thirds of reinsurance companies offered some coverage for NBCR events, according to a 2010 survey. Some insurers told us that expanding TRIA to require insurers to make NBCR coverage available would result in significant disruptions to the market. Some insurers said that an NBCR event could render the insurance industry insolvent. Another insurer told us that underwriting NBCR risks would decrease its capacity to underwrite other types of insurance. Several insurers did not support changing TRIA to require coverage for NBCR events because, in their opinion, NBCR was not an insurable risk. One insurer said effective underwriting and pricing of NBCR exposure was not possible and attempting to do so would be contrary to basic principles of insurance underwriting and pricing. One company told us that significant market disruptions would occur if NBCR coverage were mandatory. Additionally, one insurer told us that reinsurance capacity for NBCR risks was minimal and, as a result, the ability of any insurer to offer NBCR coverage was limited. According to responses to our questionnaire, 10 of 15 insurers said that they did not favor establishing a prefunding mechanism (such as a pool) in place of the current postfunding mechanism under TRIA (recoupment). For example, a prefunding mechanism could potentially allow insurers to set aside tax-deductible reserves for terrorist events or the creation of risk-sharing pools. One insurer supported a prefunding mechanism and four other insurers did not provide comments on the advantages and disadvantages associated with a prefunding mechanism. Insurers not in favor of a mechanism to charge for federal reinsurance cited a number of obstacles that would need to be considered, such as the following: Increased administrative costs. Several insurers commented that a prefunding mechanism would require additional resources and staff to administer. For example, one insurer said that Treasury would have to expand its staff and augment their expertise to administer a prefunding mechanism. This insurer also noted that Treasury would have to collect and analyze exposure and other pricing data, utilize terrorism risk models, obtain staff with actuarial and underwriting expertise, conduct audits of insurers, and manage a billing process. Difficulties funding a reinsurance pool. Insurers noted challenges in accumulating sufficient reserves for a pool, and effectively managing the pool. For example, one insurer commented that the federal government likely would not be able to accumulate enough funds for such a pool. Insurers also cited other challenges involved in prefunding federal reinsurance, such as decreases in the purchase of terrorism insurance due to its increased cost or lack of coverage after an event depletes the fund. Challenges in estimating the frequency of terrorist attacks. The unpredictability of terrorist attacks and the inability to effectively underwrite against terrorism risk would need to be considered. One insurer commented that any prefunding mechanism would be purely speculative and contribution amounts would bear little relationship to the likely losses from an event. Additionally, because it is difficult to assess the potential frequency and severity of a terrorism event (key components in pricing or funding for risk), insurers commented that postfunding (recoupment) was the preferable approach for terrorism risk. Increased cost to policyholders. Insurers commented that if a prefunding mechanism were established, it likely would result in increased costs, such as administrative costs and increased costs to policyholders. For example, one insurer told us that as users of such a mechanism, its costs for such a mechanism would be passed to policyholders. This insurer also noted that additional costs may cause policyholders to forgo terrorism coverage; therefore, in their view a prefunding mechanism could contravene the purpose of TRIA—to encourage the availability and affordability of terrorism coverage for policyholders that want to insure against terrorism exposure. Some uncertainty exists in the market about whether TRIA covers cyber terrorism risks. According to industry participants, cyber attacks could involve a wide spectrum of potential threats that could impact property, critical communications, and utility and transportation infrastructure, among other unconventional threats. Industry participants also pointed out that cyber events have the ability to impact numerous lines of insurance coverage. While TRIA does not explicitly exclude coverage of cyber risks (or other specific perils) it also does not explicitly cover it. Program guidance and other official communications have been silent on this point—thus, allowing for confusion or uncertainties about coverage. According to our questionnaire, 8 of 15 insurers considered losses resulting from cyber terrorism as covered by TRIA as long as the insurer underwrote cyber terrorism coverage as part of the underlying policy. However, our questionnaire also revealed uncertainty about such TRIA coverage. For example, 7 other insurers said that, based on their understanding of TRIA, they did not know if losses resulting from cyber terrorism would be covered by TRIA. Insurers commented that more clarity about the treatment of cyber terrorism under the program would be helpful to eliminate any uncertainty in the insurance industry about coverage of this type of risk. Insurers also commented that because cyber terrorism is an emerging risk there was some uncertainty about what the term encompassed. For example, one insurer noted that there is no statutory definition for cyber terrorism and that depending on the definition of cyber terrorism the program may or may not be triggered; therefore, the insurer said that a consistent definition would be needed. Another insurer said it was unsure if the industry has had a consistent approach to defining and covering cyber terrorism in policies and suggested that a technical working group or clarification from Treasury could help make this clearer. Some insurers, industry associations, and brokers also noted that because cyber terrorism risk is a new and evolving risk that recently has come into focus, some clarification about how this risk would be covered under TRIA would be helpful and could help increase capacity in the market. For example, in its comments to PWG, Aon noted a lack of cyber insurance capacity in certain industries, such as large energy, utility, gas, and water entities. In addition, in their 2013 statement to PWG, the American Academy of Actuaries stated that cyber terrorism is a significant risk, and that clarification is important because of the nation’s ever-increasing dependence on technology, including for commerce and business administration. As discussed earlier in this report, Treasury issued an interpretive letter in 2004 that clarified whether losses from an NBCR event would be covered under TRIA. In addition, our work on fiscal exposures demonstrates the importance of complete information about fiscal exposures. Specifically, a more complete understanding of the sources of fiscal exposure and the way they change can provide enhanced control and oversight over federal resources. Treasury acknowledged that there has been growth in the cyber insurance market. Treasury officials said that they have not issued any clarifications because clarification was unnecessary and explicitly listing TRIA-covered events may create unnecessary coverage disputes. While TRIA does not explicitly prohibit coverage of cyber terrorism risk, neither does it explicitly allow it. However, without clarification of the coverage of cyber risks, some insurers may not offer cyber coverage or may not explicitly exclude coverage. As a result, coverage may not be as available. Additionally, inclusion of cyber risks affects the government’s fiscal exposure under TRIA, and without gathering information from the industry to help provide clarity surrounding the definition and coverage of this risk, the federal government would not have an understanding of the potential impact of losses from a cyber attack. Congress enacted TRIA and its reauthorizations to help ensure the availability and affordability of insurance for terrorism risk and provide a transitional period in which the private insurance market could determine how to model and price terrorism risk. However, Treasury has not collected comprehensive data directly from insurers. Federal internal control standards state that agencies should identify and obtain relevant and needed data to be able to meet program goals. Obtaining comprehensive data is necessary to thoroughly analyze the market. While Treasury stated that the information available from other sources has been sufficient for purposes of responding to TRIA’s reporting requirements, more data and periodic assessments of the market would help Treasury assess whether the program goals of ensuring the continued widespread availability and affordability of terrorism risk insurance and addressing market disruptions are being met, and advance decision making about any potential program changes and the impact of those program changes on the market. Moreover, Treasury has performed limited analyses of the potential amount of fiscal exposure the program represents. While no terrorist attacks have triggered TRIA, the program still creates an explicit fiscal exposure for the government because the government is legally required to make payments for certified terrorist events. According to industry best practices, analysis of exposures is important for understanding the financial risks of a potential terrorist attack. In addition, federal internal control standards state the importance of analyzing risks to programs, and our prior work on fiscal exposures highlights how estimates could be developed to better understand fiscal exposures. By enhancing its data analyses, Treasury would be in a better position to estimate the amount of fiscal exposure under various scenarios of potential terrorist attacks and to inform Congress of the potential fiscal implications of any program changes. By better understanding fiscal exposure, Treasury can aid Congress in monitoring the financial condition of the program and its potential impact on the federal budget over the longer term. In the last few years, demand for terrorism insurance may have leveled off, as indicated by available data. However, insurers are concerned about how a new type of terrorist threat, cyber attacks, would be treated under the program and some industry sectors have experienced difficulty obtaining coverage. Some terrorism risk insurers told us they do not know whether losses resulting from cyber terrorism would qualify for coverage under TRIA, which may impact their decision to cover it. In the past, Treasury issued an interpretive letter to clarify the treatment of NBCR risks under the program. TRIA is silent on cyber threats. Clarification of the coverage of cyber risks could spur additional capacity in the market for this type of risk. Additionally, clarification of cyber risks could help estimates of the government’s fiscal exposure more accurately reflect the potential risks. We recommend that the Secretary of the Treasury take the following three actions: Collect the data needed to analyze the terrorism insurance market. Types of data may include terrorism coverage by line of insurance and terrorism insurance premiums earned. In taking this action, Treasury should determine whether any additional authority is needed and, if so, work with Congress to ensure it has the authority needed to carry out this action. Periodically assess data collected related to terrorism insurance, including analyzing differences in terrorism insurance by company size, geography, or industry sector; conducting hypothetical illustrative examples to help estimate the potential magnitude of fiscal exposure; and analyzing how changing program parameters may impact the market and fiscal exposure. Gather additional information needed from the insurance industry related to how cyber terrorism is defined and used in policies, and clarify whether losses that may result from cyber terrorism are covered under TRIA––clarification could be made through an interpretative letter or revisions to program regulations, some combination or any other vehicle that Treasury deems appropriate. We provided a draft of this report for review and comment to the Department of the Treasury (Treasury), including the Federal Insurance Office, and National Association of Insurance Commissioners (NAIC). We received written comments from Treasury, which are presented in appendix II. NAIC did not provide written comments. Treasury and NAIC also provided technical comments, which we incorporated as appropriate. In its written comments, Treasury agreed with our recommendations on collecting and assessing data to analyze the terrorism insurance market, but with respect to our recommendation about clarifying guidance on coverage of cyber terrorism, said that it did not believe advance determination of such an event would be helpful or appropriate. Treasury agreed to collect the data needed to analyze the terrorism insurance market and to periodically assess these data for certain purposes, such as for differences in terrorism insurance by company size, geography, or industry sector and effects on the market for terrorism risk insurance of changing program parameters. Treasury also noted that collecting and analyzing market data would not provide a basis to meaningfully estimate the fiscal exposure of the government under the program and that the amount of federal payments to insurers resulting from acts of terrorism hinges on multiple variables that cannot be predicted with precision. As discussed in the report, limitations of modeling the probability of this type of risk exist, but we maintain that estimating the potential magnitude of fiscal exposure under various hypothetical scenarios of terrorist attacks could help inform Congress of the potential fiscal implications of any program changes, including changes that could limit federal fiscal exposure. Further, accounting for insurers’ deductibles and recoupment in these estimates could aid Treasury in monitoring the potential impact of the program on the federal budget over the longer term. In light of Treasury’s response, we have revised our draft recommendation to clarify what types of analyses to conduct and to specify that illustrative examples of different terrorist attack scenarios could be used for the analysis of the potential magnitude of fiscal exposure. Regarding our third recommendation that Treasury should clarify whether losses that may result from cyber terrorism are covered under TRIA, Treasury stated that TRIA does not preclude federal payments for a cyber terrorism event if it meets the statutory criteria for an act of terrorism. Treasury also stated that while the agency will continue to monitor this issue as it develops and collect applicable market data as necessary, it does not believe that providing an advance determination of when a cyber event is an act of terrorism would be helpful or appropriate. As discussed in the report, clarification of whether losses from a cyber terrorism event could be eligible for coverage under TRIA is needed because of existing uncertainties regarding this coverage. Such clarification would not necessarily require an advance determination of what types of cyber events would qualify as acts of terrorism under the statute. As we discussed in the report, 7 of the 15 insurers responding to our questionnaire did not know if losses resulting from cyber terrorism would be covered by TRIA. In addition, a large broker noted a lack of cyber insurance capacity in certain industries. Due to the uncertainties that exist about what this emerging risk encompasses and whether losses resulting from a cyber terrorism event would qualify for coverage under TRIA, clarification would be helpful to spur additional market capacity for this risk, consistent with the program’s goals of ensuring availability and affordability of terrorism risk insurance. In light of Treasury’s response, we revised our draft recommendation to specify the type of information to be gathered from the industry to help inform Treasury’s decision regarding guidance on cyber terrorism. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to Treasury, NAIC, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-8678 or garciadiazd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix III. The objectives of our report were to (1) evaluate the extent of available data and the U.S. Department of the Treasury’s (Treasury) efforts in determining the government’s exposure for the terrorism risk insurance program, (2) describe changes in the terrorism insurance market since 2002, and (3) evaluate potential impacts of selected changes to the Terrorism Risk Insurance Act (TRIA). For each of our objectives, we reviewed relevant laws, particularly the Terrorism Risk Insurance Act of 2002, its amendments, and implementing regulations. We also reviewed relevant literature and past reports on terrorism risk, including the Congressional Research Service’s reports on the current program and recent legislation. Additionally, we reviewed reports our previous reports on TRIA and updated our work accordingly. We reviewed reports to Congress from the President’s Working Group on Financial Markets (PWG). We also reviewed comments submitted from the public to PWG for their most recent TRIA report. We interviewed federal officials and staff from Treasury, the National Association of Insurance Commissioners, and the Congressional Budget Office. We also interviewed several industry participants (such as representatives from insurance trade associations, terrorism risk modeling firms, rating agencies, and insurance brokers) to obtain information for all our objectives. Because detailed information on terrorism insurance was not publicly available, we developed a questionnaire to solicit information applicable to all our objectives from 15 insurers from which businesses had purchased terrorism coverage in 2012. The 15 companies—10 of the largest U.S. commercial property and casualty insurers in lines subject to TRIA (by premium volume) and 5 additional insurers recommended to us by an insurance broker, trade association, or both—represented roughly 40 percent of the commercial property and casualty market (by direct earned premium volume for 2012), according to SNL Financial data. We included questions about coverage, premium volume, and underwriting decisions. We also obtained views on potential modifications to TRIA and how they might affect the market, which we took into account when developing questions. We worked with a GAO specialist to draft questions. To minimize errors arising from differences in how questions might be interpreted and reduce variability in responses, we conducted pretests with two different organizations in January 2014. On the basis of feedback, we revised the questionnaire to improve organization and clarity. We then sent the questionnaire to the 15 insurers in January 2014. Some questions required close-ended responses, such as providing a specific percentage or checking boxes. Other questions were open- ended, allowing the insurers to provide more in-depth responses on how changes to TRIA might affect them. Since the 15 insurers we contacted were selected on a nonprobability basis, the findings are only applicable to the 15 companies that we interviewed and do not generalize to even the commercial property and casualty insurers that sold terrorism coverage in 2012. They do offer insight into how some private market insurers currently view parameters and topics under consideration related to government-backed terrorism insurance. We took steps to verify the information gathered in the questionnaire and analyzed the results. We initially reviewed returned questionnaires to ensure company representatives had provided complete and consistent responses. After we received the completed, written responses, we held teleconferences with representatives from each insurer to discuss, clarify, or amend responses, as appropriate. We aggregated the responses and presented summary information in this report. We used standard descriptive statistics to analyze quantitative responses and performed content analysis on the open-ended responses to identify common themes. Where possible, we corroborated insurers’ responses with information or analysis from other sources. On the basis of our questionnaire design and these follow-up procedures, we determined that the data used in this report were sufficiently reliable for our purposes. Finally, GAO data analysts independently verified all data analysis programs and calculations for accuracy. To evaluate the extent of comprehensive data, we obtained and reviewed information on the availability of data on the terrorism insurance market and Treasury’s efforts to help estimate federal exposure under TRIA. We reviewed previous reports to Congress from PWG and Treasury on TRIA. In addition, we interviewed and obtained information from officials and staff at Treasury’s Federal Insurance Office and Terrorism Risk Insurance Program Office. To obtain information on Treasury’s efforts in determining federal exposure, we reviewed a study from the Insurance Services Office, Inc. that provided an estimate of average annual losses under TRIA in any given year. We also reviewed documents from Treasury, and information on exposure analyses from risk modeling companies, such as RMS and AIR Worldwide. We spoke to insurers, brokers, and terrorism risk modeling firms to better understand how they analyze information about terrorism exposures and obtain information about the industry’s best practices. Finally, we reviewed our work on fiscal exposures to help determine any explicit exposures created by TRIA. For example, a certified terrorism attack would represent an explicit exposure because some payment by the federal government would be legally required. To describe changes in the terrorism risk insurance market, we obtained and analyzed available information on premiums, capacity, pricing, and take-up rates (the percentage of businesses buying terrorism coverage). We obtained information on terrorism insurance premiums from 2004 through 2012 from A.M. Best, an insurance rating agency, which had collected this information as part of its annual Supplemental Rating Questionnaire. A.M. Best provided aggregated data to us. To compare terrorism premiums with premiums collected for other insurance lines, we obtained data from SNL Financial on premiums earned for commercial property and casualty insurers for all commercial lines and for lines subject to TRIA. Additionally, we obtained capacity, pricing, and take-up rate information from 2003 through 2013 from two insurance brokers— Marsh and McLennan (Marsh) and Aon—as available. Marsh provided nationwide pricing and take-up rate data, while Aon had information on capacity. Marsh and Aon are the largest business insurance brokers in the United States. We interviewed representatives from Marsh and Aon to ensure we had a clear understanding of which insurers the data represented and how the brokers obtain information from their data systems. All data presented in this report from Marsh and Aon solely represent their clients, cannot be generalized to the entire market, and are attributed accordingly. Based on this, we determined that the data used in this report from the insurance brokers were sufficiently reliable for our purposes. To obtain information on the reinsurance market and insurance-linked securities, we interviewed representatives from the Reinsurance Association of America and Fermat Capital Management. We also reviewed reports from industry participants, such as Swiss Re, Munich Re, and Aon Benfield on the status of the reinsurance and insurance-linked securities markets. Finally, as part of our questionnaire, we asked insurers whether they purchased reinsurance for terrorism risk and how reinsurance purchasing patterns have changed over the last decade. To evaluate the potential impact of selected changes to TRIA, we identified certain changes to the program’s parameters based on our analysis of the program’s structure, review of relevant literature, testimonies from congressional hearings, and prior changes made in the TRIA reauthorizations. On the basis of these, we asked the 15 insurers who received our questionnaire for their input on how selected changes would affect the insurance market for terrorism risk. For example, we asked insurers to categorize the greatest changes to program parameters and how such changes could affect each company’s capacity, pricing, and take-up rates. We asked insurers to categorize the greatest change to the aggregate industry retention amount (currently, $27.5 billion) that, in their opinion, the industry could handle. We also asked insurers if their companies underwrote nuclear, biological, chemical, or radiological risks or cyber risks and what metrics or factors Congress would need to consider if changes were made to TRIA related to losses as a result of these types of risks. Finally, we asked insurers to indicate what metrics and factors Congress would need to consider if the federal government were to establish a prefunding mechanism (in place of the current postfunding mechanism—recoupment). We obtained information from A.M. Best on estimated policyholder surplus of insurers potentially exposed to terrorism from 2003 through 2012, to compare, industry-wide, the TRIA deductible amounts with estimates of policyholder surplus. We also compared the average TRIA deductible as a percentage of estimated policyholder surplus, for the 10 largest commercial property and casualty insurers (in insurance lines subject to TRIA), with all other insurers, as well as the range for the 10 largest insurers. We performed this analysis to help determine whether any differences existed for large versus small insurers in terms of their TRIA deductible amounts as a percentage of surplus. We also developed examples to illustrate the impact of certain changes to the current program on the federal government’s fiscal exposure. To develop the examples, we consulted with experts from terrorism risk modeling firms and reviewed relevant literature. Additionally, to develop the examples, we made assumptions for the number of insurers affected, and their direct earned premiums, market share, insurance lines, and total loss amount. We used SNL Financial insurance data and information from A.M. Best to help develop these assumptions. We compared what federal losses would be under the current program parameters (status quo) with those after making changes to the current program. For example, we compared changing the deductible from 20 to 35 percent and changing the insurers’ coshare from 15 to 30 percent, in intervals of 2 to 3 percent. We analyzed the federal share of losses for variously sized terrorist attacks ($25 billion, $50 billion, $75 billion, and $100 billion) before and after recoupment, using the current law’s aggregate industry retention amount ($27.5 billion). To help assess the reliability of our analysis, we verified that our results were consistent with a model developed by the Reinsurance Association of America. We conducted this performance audit from July 2013 through May 2014, in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the contact named above, Jill Naamane (Assistant Director); William Chatlos; Robert Dacey; Rachel DeMarcus; Patrick Dynes; Beth Ann Faraguna; Isidro Gomez; DuEwa Kamara; Shamiah Kerney; May Lee; Marc Molino; Erika Navarro; Susan Offutt; Barbara Roesmann; Jessica Sandler; Melvin Thomas; and Frank Todisco made key contributions to this report.

Summary: Congress passed TRIA in 2002 to help ensure the availability and affordability of terrorism insurance for commercial property and casualty policyholders after the September 11, 2001, terrorist attacks. TRIA was amended and extended twice and currently will expire at the end of 2014. Under TRIA, Treasury administers a program in which the federal government and private sector share losses on commercial property and casualty policies resulting from a terrorist attack. Because the federal government will cover a portion of insured losses, the program creates fiscal exposures for the government. GAO was asked to review TRIA. This report evaluates (1) the extent of available data on terrorism insurance and Treasury's efforts in determining federal exposure, (2) changes in the terrorism insurance market since 2002, and (3) potential impacts of selected changes to TRIA. To address these objectives, GAO analyzed insurance data, information from 15 insurers selected primarily based on size of insurer, interviewed Treasury staff and industry participants, updated prior work, and developed examples to illustrate potential fiscal exposure under TRIA. Comprehensive data on the terrorism insurance market are not readily available and Department of the Treasury (Treasury) analysis to better understand federal fiscal exposure under various scenarios of terrorist attacks has been limited. Treasury compiled some market data from industry sources, but the data are not comprehensive. Federal internal control standards state that agencies should obtain needed data and analyze risks, and industry best practices indicate that analysis of the location and amount of coverage helps understand financial risks. However, without more data and analysis, Treasury lacks the information needed to help ensure the goals of the Terrorism Risk Insurance Act (TRIA) of ensuring the availability and affordability of terrorism risk insurance and addressing market disruptions are being met and to better understand potential federal spending under different scenarios. Available data show that terrorism insurance premiums and other market indicators are stable. For example, estimated terrorism insurance premiums have been relatively constant since 2010 (see figure). Insurers told GAO that, in 2012, terrorism insurance premiums made up on average less than 2 percent of commercial property and casualty premiums. According to industry participants, prices for terrorism coverage have declined, the percentage of businesses buying coverage seems to have leveled recently, and insurers' ability to provide it has remained constant. Insurers and other industry participants cited concerns about the availability and price of terrorism coverage if TRIA expired or was changed substantially, but some changes could reduce federal fiscal exposure. Some insurers GAO contacted said they would stop covering terrorism if TRIA expired. Changes such as increasing the deductible or threshold for required recoupment of the government's share of losses through surcharges on all commercial policyholders could reduce federal fiscal exposure. Most insurers GAO contacted expressed concerns about solvency and ability to provide coverage if their deductible or share of losses increased. Insurers were less concerned about increases to the thresholds for government coverage to begin or to the required recoupment of the government's share of losses. Treasury should collect and analyze data on the terrorism insurance market to assess the market, estimate fiscal exposure under different scenarios, and analyze the impacts of changing program parameters. Treasury agreed with these recommendations.