From an insurance standpoint, measuring and predicting terrorism risk is challenging. The difficulties of measuring and predicting losses associated with terrorism risks stem from factors including lack of experience with similar attacks, difficulty in predicting terrorists’ intentions, and the potentially catastrophic losses from terrorist attacks. To underwrite insurance—that is, decide whether to offer coverage and at what price—insurers consider both the likelihood of an event (frequency) and the amount of damage it would cause (severity). Although insurers increasingly have used sophisticated modeling tools to assess terrorism risk, from a statistical perspective little data exist on which to base estimates of future losses in terms of frequency or severity, or both. Reinsurers (insurers for insurers) follow an approach similar to that of insurers for pricing risk exposures and charging premiums based on that risk and, therefore, face similar challenges in pricing terrorism risks. Congress passed TRIA in 2002 to address some of the challenges the insurance industry and businesses faced after the September 11 attacks, when coverage for terrorism risk generally became unavailable. The goals of TRIA are to (1) protect consumers by addressing market disruptions and ensuring the continued widespread availability and affordability of commercial property/casualty insurance for terrorism risk; and (2) allow for a transitional period for the private markets to stabilize, resume pricing of such insurance, and build capacity to absorb any future losses, while preserving state insurance regulation and consumer protections. As required by TRIA, insurers must make terrorism coverage available to commercial policyholders, although commercial policyholders are not required to buy it. TRIA requires an insurer to make coverage for terrorism losses available that does not differ materially from the terms, amounts, and other coverage limitations applicable to losses arising from events other than acts of terrorism. For example, an insurer offering $100 million in commercial property coverage must offer $100 million in coverage for property damage from a certified terrorist event. As discussed in greater detail later in this report, insurers can charge a separate premium to cover their terrorism risk, although some include the coverage in their base rates for all-risk policies. Neither insurers nor the federal government charges for the government’s coverage of terrorism risk under TRIA, but the government may recoup at least some of its losses following a terrorism event. For eligible lines, TRIA covers insured losses resulting from an act of terrorism, which is defined, in part, as a “violent act or an act that is dangerous” to human life, property, or infrastructure. The act is silent about losses from attacks with nuclear, biological, chemical, or radiological weapons (NBCR). Initial loss sharing. In the event of a certified act of terrorism, TRIA’s loss-sharing structure requires that insurers pay claims on covered terrorism losses and that Treasury reimburse individual insurers for losses that exceed a specified amount. For federal compensation to be paid, aggregate industry insured losses from certified acts must exceed a certain amount (program trigger). For calendar year 2016, this amount was $120 million. An individual insurer with terrorism losses in excess of a deductible (20 percent of its previous year’s direct earned premiums in TRIA-eligible lines) may make a claim to Treasury for payment of the federal share of compensation for its insured losses. As shown in figure 1, Treasury would reimburse the insurer for a certain percentage of its losses (84 percent for calendar year 2016) above the deductible, and the insurer would be responsible for the remaining portion (16 percent). Annual coverage for losses is limited (capped) so that aggregate industry insured losses in excess of $100 billion are not covered by private insurers or the federal government. Recoupment. The federal share of losses may be recouped after a terrorist event through premium surcharges. As previously discussed, Treasury reimburses an insurer for a certain percentage of its losses above its deductible. And, if insurers’ aggregate losses are below a specified amount, Treasury may be required to recoup federal losses through post-event premium surcharges. Figure 2 shows the TRIA funding mechanism before and after a terrorism event. Specifically, the program includes a provision for mandatory recoupment of at least a portion of the federal share of losses if the aggregate sum of all insurers’ deductibles and co-shares are below an amount prescribed by TRIA— known as the industry aggregate retention amount. Under mandatory recoupment, the insurers must impose and remit to Treasury a premium surcharge on all policies in TRIA-eligible lines until total industry payments reach 140 percent of any mandatory recoupment amount. Treasury establishes the amount of the mandatory recoupment surcharge. The collection timeframes for mandatory recoupment range from 1 year and 9 months to about 6.5 years, depending on when the terrorism event occurs. When federal assistance exceeds the mandatory recoupment amount, TRIA allows for discretionary recoupment. Under the discretionary recoupment provision, Treasury may recoup additional amounts based on the ultimate cost to taxpayers of no additional recoupment, economic conditions in the marketplace, the affordability of commercial insurance for small and medium-sized businesses, and other factors Treasury considers appropriate. Treasury also sets the surcharge for discretionary recoupment, but the increase to TRIA-eligible premiums must not exceed 3 percent per calendar year. Changes in TRIA reauthorizations. As shown in table 1, the TRIA reauthorizations have changed several loss-sharing provisions of the program. Over time, the reauthorizations have reduced federal responsibility for losses and increased private-sector responsibility for losses. The 2015 reauthorization requires further incremental decreases in the federal share of losses over 5 years. In addition, the 2015 reauthorization requires insurers in the program to submit information to Treasury about the coverage they write for terrorism risk, including the lines of insurance with exposure to such risk, the premiums earned on such coverage, and the participation rate for such coverage. Insurance in the United States is primarily regulated at the state level. State regulators license agents, review insurance products and premium rates, and examine insurers’ financial solvency and market conduct. In addition, through the NAIC, state insurance regulators (of the 50 states, the District of Columbia, and the U.S. territories) establish standards and best practices, conduct peer reviews, and coordinate their regulatory oversight. For issues that involve a national standard or require uniformity among all the states, the NAIC develops and distributes model insurance laws and regulations for consideration among its member states. Generally, state law requires insurers to file rates (and to file insurance forms) with state regulators who review the rates to ensure they are not excessive, inadequate, or unfairly discriminatory. States vary with regard to the timing and depth of reviews of insurers’ rates and contractual language. Many state laws have filing or review exemptions (or both) that apply to large commercial policyholders. State insurance regulators do not perform rate or form reviews for these entities because it is presumed that large businesses have a better understanding of insurance contracts and pricing than the average personal-lines consumer and as such are able to effectively negotiate price and contract terms with insurers. Capital requirements, accounting standards, and other tools help state regulators, insurers, and other entities monitor and mitigate potential risks and assess insurers’ financial strength. Risk-based capital requirements: State regulators require insurance companies to maintain specific levels of capital to continue to conduct business. Regulators determine the minimum amount of capital appropriate for an insurer to support its overall business operations, taking into consideration its size and risk profile. Most U.S. jurisdictions have adopted statutes, regulations, or bulletins that are substantially similar to NAIC’s Risk-Based Capital for Insurers Model Act, according to NAIC, and also use formulas that NAIC has developed to establish a minimum capital requirement based on the types of risks to which a company is exposed. NAIC has separate models for different lines of insurance. Own risk and solvency assessments: Starting in 2015, state regulators began requiring large- and medium-size U.S. insurance groups to begin regularly conducting own risk and solvency assessments and submitting an annual written report to either the insurer group’s lead state or state of domicile, depending upon if the assessment is prepared on a group or legal entity basis. The assessments are internal processes undertaken by insurers or insurance groups to assess the adequacy of their risk management and current and prospective solvency positions under normal and severe stress scenarios. Enterprise risk-management practices: Insurance companies use these practices to obtain an enterprise-wide view of their risks and help management engage in risk-based decision making. Enterprise risk management generally has two goals: (1) to identify, evaluate, and quantify risks; and (2) to ensure that the organization actively implements risk-treatment strategies and manages appropriate risk levels. Examples of specific enterprise risk-management practices include identifying and categorizing risks, establishing well-defined risk tolerances, assessing risk mitigation with cost-benefit analyses, and conducting stress tests and other risk-modeling analyses. Insurance companies must report much of this information annually in their summary reports for own risk and solvency assessments. Accounting standards and financial reporting: Insurers must report their financial holdings on an individual legal entity basis to the regulator in their state of domicile, using statutory accounting principles (SAP). According to documentation from NAIC, SAP are designed to assist state insurance departments in the regulation of the solvency of insurance companies. The ultimate objective of solvency regulation is to ensure that policyholder, contract holder, and other legal obligations are met when they come due and that companies maintain capital and surplus at all times and in such forms as required by statute to provide a margin of safety. SAP stress the measurement of ability to pay claims in the future.