The purposes of TRIA are to (1) protect consumers by addressing market disruptions and ensuring the continued widespread availability and affordability of commercial property/casualty insurance for terrorism risk; and (2) allow for a transitional period for the private markets to stabilize, resume pricing of such insurance, and build capacity to absorb any future losses, while preserving state insurance regulation and consumer protections. TRIA only applies to certain commercial property/casualty lines of insurance (we refer to them as TRIA-eligible lines) and excludes lines such as health and life insurance. While the law requires insurers to make terrorism risk coverage available to commercial policyholders, commercial policyholders are not required to buy it. Additionally, the law requires an insurer to make coverage for terrorism losses available that does not differ materially from the terms, amounts, and other coverage limitations applicable to losses arising from events other than acts of terrorism. For example, an insurer offering $100 million in commercial property coverage must offer $100 million in coverage that is not materially different for property damage from a certified terrorist event. Insurers may charge a separate premium to cover their terrorism risk, although some include the coverage in their base rates for all-risk policies. The majority of terrorism risk insurance is purchased as part of these embedded policies. The remainder is purchased as stand-alone coverage. Neither insurers nor the federal government charge for the federal coverage of terrorism risk under TRIA, but the government must recoup at least some of its losses following a terrorist event. For eligible commercial lines of property/casualty insurance, TRIA covers insured losses resulting from an act of terrorism, which is defined, in part, as a “violent act or an act that is dangerous” to human life, property, or infrastructure. TRIA is silent about losses from attacks with nuclear, biological, chemical, or radiological (NBCR) weapons. Although TRIA and its reauthorizations do not specifically include cyber risk insurance as a TRIA-eligible line, Treasury issued guidance about such coverage in 2016. The guidance stated that TRIA provisions apply to cyber risk insurance written under an embedded or stand-alone policy in TRIA- eligible lines. A cyberterrorism event could cause minor-to-severe business disruption and physical damage to property. In this report, we include losses resulting from cyberterrorism events with conventional terrorism events. Any catastrophic terrorist event presents both explicit and implicit fiscal exposure for the federal government. TRIA alleviates some of the implicit exposure through loss sharing. Under TRIA, the federal government is legally required to make payments (reimbursements to insurers): this represents an explicit fiscal exposure. Even without a loss-sharing program, the federal government also faces implicit fiscal exposure through a potential expectation to provide policyholders or insurers assistance to address long-term effects after a terrorist event. We have defined implicit fiscal exposures as situations that create expectations for future federal spending based on current policy, past practices, or other factors. Under TRIA, the government and insurers share losses in the event of a certified act of terrorism with insured losses above the program trigger of $200 million and below the program cap of $100 billion. According to the statute, Treasury cannot certify an event as an act of terrorism under TRIA if the aggregate property/casualty “insurance losses” resulting from the event are less than $5 million. Additionally, TRIA is not triggered unless the aggregate property/casualty “insured losses” resulting from one or more certified acts in a particular calendar year reach $200 million. Annual coverage for losses is limited (capped) so that neither the private insurers nor the federal government are responsible for paying aggregate insured losses in excess of $100 billion. Specifically: “Insured losses” are defined in statute and regulation as any losses resulting from an act of terrorism (including an act of war in the case of worker’s compensation) generally occurring in the United States that are covered by primary or excess property/casualty insurance issued by an insurer. TRIA refers to insured losses in defining the program trigger and program cap. “Insurance losses” are not defined in statute or regulation, but TRIA refers to insurance losses in defining the event certification amount. TRIA’s loss-sharing structure requires that insurers pay claims on covered terrorism losses and that Treasury reimburse individual insurers for losses that exceed a specified amount. According to the coshare provision, Treasury reimburses the insurer for a certain percentage (80 percent) of its losses above the insurer deductible, and the insurer is responsible for the remaining portion (20 percent). The policyholder also may retain losses from a terrorist event in the form of an insurance deductible or self-insurance retention. According to Treasury, losses retained by the policyholder are not considered to be “insured losses” under TRIA and do not count toward losses included in the $200 million program trigger or $100 billion program cap. However, this retention may be counted toward the $5 million event certification threshold because it is calculated based on “insurance losses.” TRIA provides for two types of recoupment—mandatory and discretionary—of the federal share of losses after a terrorism event. Figure 1 shows the claim and recoupment processes after a terrorism event resulting in losses covered by insurers and the government. Mandatory recoupment. TRIA requires recoupment of at least a portion of the federal share of losses if the aggregate sum of all insurers’ deductibles and coshares are below an amount prescribed by TRIA—known as the industry aggregate retention amount. Under mandatory recoupment, the insurers must impose and remit to Treasury a premium surcharge on all policies in TRIA-eligible lines until total industry payments reach 140 percent of any mandatory recoupment amount. TRIA specifies the collection time frame (from 1 year and 9 months to about 6.5 years, based on the date of the event). Treasury considers the collection time frame when establishing the amount of the mandatory recoupment surcharge. Discretionary recoupment. TRIA permits discretionary recoupment when the federal share of losses exceeds the mandatory recoupment amount. Under the discretionary recoupment provision, Treasury may consider a number of factors, such as economic conditions in the commercial marketplace, in determining the amount to recoup. To help in its decision-making, Treasury may issue a data call for insurer deductible and insured loss information. Treasury also sets the surcharge for discretionary recoupment, but the increase to TRIA- eligible premiums must not exceed 3 percent per calendar year. TRIA does not specify a collection time frame for discretionary recoupment. Since the 2015 reauthorization, insurers have been required to submit information to Treasury about their coverage of terrorism risk, including the lines of insurance with exposure to such risk, the premiums earned on such coverage, and the participation rate for such coverage. Treasury’s 2017–2019 data calls included loss scenarios in which insurers estimate and report expected losses given a defined terrorist attack at a specified location, date, and time. Treasury’s defined loss scenarios were located in New York City in 2016, Chicago in 2017, and San Francisco in 2018. Treasury’s reporting requirements for insurers vary, based on the following categories: Small insurers. Insurance companies that had both policyholder surplus and prior year TRIA-eligible direct-earned premium of less than five times the program trigger. For example, TRIA’s program trigger in 2020 is $200 million. Thus, Treasury would categorize insurers with less than $1 billion in 2019 direct-earned premiums and less than $1 billion in policyholder surplus as small. Treasury does not require small insurers to report on a number of items, including the loss scenarios. Nonsmall insurers. Insurance companies with either policyholder surplus or prior year TRIA-eligible direct-earned premium greater than the small insurer thresholds. Captive insurers. Special-purpose insurance companies set up by commercial businesses to self-insure risks arising from the owners’ business activities. Alien surplus lines insurers. Insurance companies headquartered in a foreign country that have been qualified to do business in the United States through an NAIC-administered process, which assesses the financial stability and trustworthiness of the insurer. Each reauthorization of TRIA through 2015 reduced the magnitude of the government’s explicit fiscal exposure. Since 2003, changes to TRIA provisions have increased insurers’ share of losses and thus decreased explicit federal fiscal exposure in the event of certified acts of terrorism (see fig. 2). For example, the program trigger rose over time, from $5 million in 2003 to $200 million in 2020. These changes reduced explicit fiscal exposure because they increased the amount of insured losses required before the government would share in the losses. The insurer deductible increased from 7 percent in 2003 to 20 percent for 2020, also reducing the federal share of payments. The 2015 reauthorization required incremental reductions in the federal share of losses over 5 years. The 2019 reauthorization extended the program until 2027, but did not make any changes to the program parameters. See appendix II for more details of the changes in the reauthorizations. Currently, following a certified act of terrorism Treasury pays insurer claims for 80 percent of insurers’ losses above their individual deductibles once losses in a calendar year exceed the program trigger of $200 million (see fig. 3). For example, based on the scenario from Treasury’s 2019 data call, the federal government could have an explicit exposure of about $4.4 billion in reimbursements to insurers. Specifically, insurers estimated that a hypothetical 2018 terrorist event in San Francisco could generate $39.7 billion dollars in overall losses, of which insurers could pay about $17 billion in claims to policyholders and the government could pay about $4.4 billion in reimbursements to insurers after a policyholder retention amount. According to our analysis of Treasury data on insurer direct-earned premiums, federal losses following a terrorist event under the loss-sharing provision in effect in 2020 would be smaller than they would have been for a similar event under the loss-sharing provision in effect in 2015, across all event sizes and subsets of insurers. In addition, more of the federal losses would be recovered through mandatory recoupment (see fig. 4). As we found in 2017, the amount of federal losses depends on event size and how many and which insurers were affected. Additionally, the government share depends on the aggregate TRIA- eligible direct-earned premium of the insurers with losses. Specifically, the federal share of losses is smaller when losses are shared among insurers with larger aggregate premium bases. As the share of losses for which insurers are responsible has increased under TRIA, the ability of insurers to absorb the extra exposure also has increased. Insurers use risk-mitigation strategies to reduce or offset their exposures. These can include purchasing reinsurance—insurance for insurers—to cover their deductibles or coshare payments, or diversifying their portfolios (for instance, reducing concentrations of risk in certain locations or lines of insurance). Insurers told us that they considered the potential effect of program changes in each reauthorization and modified risk-mitigation strategies, as needed. Furthermore, other industry stakeholders, including a broker and an industry association, told us that because program changes have been gradual and expected, insurance companies have been able to adjust their coverage accordingly. Available evidence indicates that TRIA has been largely effective in meeting its statutory objectives of stabilizing the terrorism risk insurance market. First, terrorism risk insurance is available in the market for a relatively low cost and is purchased by the majority of commercial policyholders in the United States, according to industry reports. Second, private reinsurance capacity for terrorism risk insurance increased since the creation of the program, according to Treasury. Third, our analysis of Treasury data suggests there is market stability. Insurers in all of Treasury’s reporting categories largely remained in the market. Furthermore, the market share and number of insurers in the reporting categories generally remained stable. For example, using data on direct- earned premiums of insurers from 2016 to 2018, nonsmall insurers (92 insurers in 2018) held about 80 percent of the TRIA-eligible insurance market. Small insurers (186 insurers in 2018) held about 10 percent. Captive and alien surplus lines insurers (598 and 98 insurers, respectively, in 2018) each held 4 or 5 percent (see fig. 5). Our interviews indicate that some insurers’ interpretation of whether policyholder retention amounts count toward the program threshold, trigger, and cap may differ from Treasury’s. Some large policyholders may retain large amounts of loss in the form of a deductible or self- insurance retention following a terrorist event. Treasury officials said policyholder retention amounts are not counted toward the program’s $200 million trigger or its $100 billion cap, but could be counted toward the $5 million threshold for event certification. They stated that the law utilizes “insured losses” when referring to the program trigger and cap, and “insurance losses” when referring to the certification threshold. If Treasury counted policyholder retention amounts toward the program trigger, the program would be triggered and capped with a smaller amount of overall losses. For example: To illustrate, we use a hypothetical terrorist event resulting in $290 million in overall losses, of which $100 million would be retained by policyholders. Using Treasury’s interpretation that excludes policyholder retention amounts, “insured losses” would be $190 million, which is below the program trigger of $200 million. As a result, the government would not be required to pay insurers a coshare. In contrast, if Treasury included policyholder retention amounts, “insured losses” would be $290 million, which exceeds the program trigger. In this case, the government would pay $112 million to insurers in coshares. In either case, losses would not reach the program cap of $100 billion. We asked 12 industry stakeholders about their understanding of how Treasury would use policyholder retention amounts to calculate the program threshold, trigger, and cap. The distinction between “insured losses” and “insurance losses” in Treasury’s explanation was clear to one insurer. However, some aspect of this distinction was unclear to six industry stakeholders, including an insurer association and three insurers, potentially resulting in uncertainty about how Treasury would calculate losses in the aftermath of a terrorist event. For example, representatives of an insurer association and two insurers told us they interpreted insured losses as including the policyholder retention amounts because insurers could be responsible for paying this amount. This is because some insurers pay the entire claim, including all or a portion of the policyholder retention, up front and then seek reimbursement from the policyholder. In addition, if a policyholder cannot pay its retention, the insurance company is responsible for it. Differences in interpretation could lead to disputes between insurers and Treasury following a terrorist event. We previously found that insurers are concerned about the long-term consequences of disputes related to terrorist events. One purpose of TRIA is to stabilize the market following a terrorist event. Furthermore, federal internal control standards state that management should externally communicate the necessary quality information so that external parties can help the entity achieve its objectives and address related risks. Treasury’s program regulations define “insured losses” and do not define “insurance losses.” Furthermore, the regulations do not explain how such losses are calculated and therefore how the policyholder retention amount does or does not count toward the program threshold, trigger, or cap, as applicable. Treasury uses different methods to communicate program information and clarify program details to stakeholders, such as program regulations and interpretive letters, but has not clarified this issue using these or other methods because officials believe the distinction is understood in the industry. By closing the information gap of how it would calculate losses for the program threshold, trigger, and cap, Treasury would create a common understanding of a critical feature of the program. Furthermore, Treasury may prevent uncertainty in the insurance market and potential litigation following a terrorist event that could delay insurance payments and economic recovery. TRIA explicitly limits federal exposure following a terrorist event, but the federal government could be expected to provide assistance beyond what is explicitly outlined in TRIA. Expectations for the government to provide assistance through its recoupment decisions and to policyholders and insurers, as described below, represent implicit fiscal exposures. Although the government may not act on these expectations, to the extent that it does, the implicit exposure would become an explicit exposure. In certain circumstances under mandatory and discretionary recoupment, such as potential effects on market stability, public expectation may lead the federal government to cancel recoupment or reduce the amount of funds recouped. Any portion of the federal coshare not recouped represents an implicit fiscal exposure. Some mandatory recoupment scenarios may or may not be perceived as burdensome to policyholders, prompting an expectation of federal assistance to ease the burden. Treasury determines mandatory recoupment surcharges based on the statutory deadlines for collecting mandatory recoupment. If a large terrorism act occurs in a year in which the statute requires the collection of mandatory recoupment in a short time frame, Treasury may need to set a high surcharge percentage on premiums for policies with TRIA-eligible lines. In this case, some policyholders may find it difficult to pay the surcharge, making collection of the mandatory recoupment amount burdensome. Large recoupment amounts or surcharges could prompt public expectation, and political will, for reducing or cancelling recoupment to alleviate this burden. Because mandatory recoupment time frames are based in statute, reducing or canceling this recoupment would require congressional action. One insurer told us that they are skeptical that Congress would allow Treasury to collect mandatory recoupment after a large event. Under current program provisions, the maximum mandatory recoupment amount will increase if the TRIA-eligible direct-earned premium increases. Industry stakeholders told us that, with this change, eventually all recoupment could be mandatory. While the amount to be recouped may increase, the recoupment time frame remains unchanged. Therefore, over time, surcharge amounts could increase, which may increase burden on policyholders and increase the expectation for Congress to cancel recoupment. If Congress were to cancel the collection of mandatory recoupment, the explicit fiscal exposure would include both the federal share of losses paid to insurers and the decreased corporate tax receipts from deductions for the recoupment charges policyholders may claim (such deductions otherwise were intended to be offset by the 140 percent recoupment). Changes in legislation following premium rate increases in the National Flood Insurance Program (NFIP) provide an example of Congress changing a law to ease policyholder burden. Congress enacted the Biggert-Waters Flood Insurance Reform Act of 2012, which was intended to strengthen the future financial solvency and administrative efficiency of NFIP by implementing provisions to reduce and eventually eliminate most subsidized premium rates. However, after public outcry claiming negative effects on home values, Congress enacted the Homeowner Flood Insurance Affordability Act of 2014, which repealed some of the premium rate increases in the 2012 act. Discretionary recoupment presents an implicit fiscal exposure because Treasury may decide not to collect the full discretionary recoupment amount. Under TRIA, Treasury decides whether and how much of the discretionary portion of the federal share of losses to recoup. Treasury may recoup some or all nonmandatory funds, or cancel discretionary recoupment. For any amount that Treasury chose not to collect, the fiscal exposure would be the dollar-for-dollar amount of the federal share of losses paid to insurers. As defined in statute, Treasury may consider several factors when determining whether to collect discretionary recoupment, in full or partially, or cancel recoupment. These factors include ultimate cost to taxpayers of no additional recoupment; the economic conditions of the commercial marketplace; the affordability of commercial insurance for small and medium-sized businesses; and other factors Treasury deems appropriate. According to agency officials, decisions regarding discretionary recoupment would be based on the parameters of the specific terrorism act, such as the size of the federal share of losses, location of the event, and length of the collection period. In our analysis of explicit exposure, we found that under some scenarios, the discretionary recoupment amount resulting from a terrorist event could exceed $50 billion. Depending on Treasury’s analysis of these factors, some or all of the discretionary recoupment amount may not be collected. For example, currently, much of the recoupment amount resulting from the most catastrophic losses would be considered discretionary under TRIA’s provisions. Because TRIA mandates an annual 3 percent cap on the increase of premium rates in TRIA-eligible lines for discretionary recoupment, in extreme cases Treasury might need to collect a premium surcharge for a protracted period of time to fully recoup the discretionary portion of losses. The effects of a protracted period of premium surcharges could be a factor in Treasury’s determination to cancel discretionary recoupment. Based on previous federal action following natural disasters or financial market crises, there may be an expectation that the government would provide financial assistance to businesses for uninsured or underinsured losses related to a terrorist event, regardless of whether a loss-sharing program existed. For example, the federal government uses the Disaster Relief Fund to provide compensation for property damage or financial losses to victims of Presidentially declared major disasters and emergencies. In fiscal years 2005–2018, the federal government designated $138 billion in supplemental appropriations to this fund for extreme weather events. And following the financial crisis of 2007– 2009, the federal government provided financial assistance directly to General Motors Company and Chrysler Holdings to help stabilize the U.S. automobile industry and to avoid economic disruptions. Treasury officials and industry stakeholders described several terrorist event scenarios that could produce a large amount of uninsured or underinsured losses that affected businesses might not be able to absorb and that might lead to the expectation of federal assistance. NBCR events present an implicit exposure. Historically, insurance coverage for losses related to a NBCR terrorist event has been limited or unavailable. Stakeholders told us that there likely would be an expectation of federal financial assistance for businesses with uninsured losses related to such an event. Treasury officials and stakeholders we interviewed agreed that primary and reinsurance coverage for NBCR events is limited, resulting in many businesses having limited or no coverage. Stakeholders also told us that, without TRIA, insurers would no longer offer the limited amount of NBCR coverage currently available. Stakeholders attribute the limitations to the potentially catastrophic losses associated with NBCR events and the difficulty in modeling and underwriting such events. Representatives of a policyholder association whose members purchase NBCR coverage stated that available coverage likely was insufficient to cover expected losses. Furthermore, they said some policyholders forgo NBCR coverage because of its limited availability, high cost, and the low perceived risk of a NBCR event. As a result, many businesses may be exposed to high loss. Treasury officials and industry stakeholders described possible NBCR terrorism events in which a significant amount of losses could be uninsured or underinsured. Treasury’s 2019 Small Insurers Report found that a NBCR terrorism event likely posed the greatest risk of total catastrophic terrorism losses, far outpacing a conventional attack. Although modeling these types of losses is difficult, NAIC’s Center for Insurance Policy and Research estimated, taking into account the program cap, that a NBCR event in New York City could generate nearly $60 billion of uninsured loss, 38 percent of the total loss. It also found that a larger NBCR event could create $850 billion in uninsured loss, or 90 percent of total losses. Furthermore, this research estimated large uninsured losses in other cities, such as Houston, where a large nuclear event was estimated to generate $67 billion in uninsured losses, or 40 percent of total losses. Such catastrophic losses could create a strong public expectation of federal financial assistance for uninsured losses. The expectation of financial assistance to policyholders if insured losses exceeded the program cap also creates implicit fiscal exposure. By law, insurers that have met their individual deductible and the federal government are not responsible for losses exceeding the TRIA program cap. However, industry stakeholders we interviewed expected that, in the event the program cap were exceeded, the federal government would provide some form of assistance to those who experienced loss. For example, losses from a NBCR event could be over $1 trillion, with TRIA- insured losses exceeding the $100 billion program cap. While a single conventional attack would be unlikely to exceed the program cap, according to stakeholders, a series of conventional attacks could. Although determining the frequency of terrorist events is difficult, one modeling firm with which we spoke estimates losses great enough to exceed the program cap in a conventional attack to have a 0.0005 percent (or 1/2,000) chance of occurring in a single year. This is less likely than severe natural catastrophes, such as Hurricanes Sandy and Harvey. As we found in a 2019 report on fiscal exposures, Congress demonstrated its willingness to fund the implicit exposure of policyholder claims that exceeded the amount NFIP was authorized to borrow from Treasury. In October 2017, when NFIP was about to exhaust its borrowing authority, Congress passed a supplemental appropriation, which the President signed into law, that cancelled $16 billion of NFIP debt to Treasury. Implicit fiscal exposure also exists in the expectation that the federal government would assist policyholders unable to pay their retained losses. Policyholders with very large retained losses may face financial insolvency after a terrorist attack, which may create an expectation of government assistance. Stakeholders told us that policyholders may choose larger retention amounts to reduce premiums or because insurance for high-risk, high-value properties is unavailable. Insurers we interviewed said that most businesses have small deductibles, but some large businesses may choose higher retention amounts to reduce the high insurance cost in locations considered to be higher-risk and for high- profile properties. For example as shown in figure 6, Treasury’s 2017– 2019 data call scenarios explored estimated losses in locations with high- profile properties such as Rockefeller Center in New York City (2017), Willis Tower and O’Hare International Airport in Chicago (2018), and Embarcadero Center and Union Square in San Francisco (2019). Although the actual amounts may be lower than the estimates insurers reported, the aggregated policyholder retention could exceed losses paid through the program. This demonstrates the potential for large losses that could create an expectation of government assistance if policyholders with large retention amounts were unable to absorb the losses. An implicit fiscal exposure exists from the potential expectation that the government might help stabilize markets by assisting insurers with (1) losses that do not trigger the program’s loss sharing, or (2) losses from lines ineligible for TRIA. While these risks exist, the current market has some protections in place and stakeholders viewed this exposure as unlikely. Loss sharing not triggered. If the total losses from a certified act of terrorism were below the program trigger (currently $200 million), insurers with deductibles below the program trigger could sustain losses larger than their deductible without receiving any federal coshare. Because the amount of the program trigger has increased over time, more insurers potentially face this scenario. Stakeholders told us that small insurers and those that offer workers’ compensation insurance are most affected by changes to the program trigger. Our analysis of Treasury data shows about 97 percent of insurers have deductibles lower than the $200 million program trigger and thus could receive no coshare following a certified act of terrorism. This includes all small, captive, and alien surplus lines insurers, and more than half of the nonsmall insurers. Furthermore, our analysis of 2016–2018 Treasury data shows that these insurers are sometimes concentrated in certain insurance lines. For example, small insurers may be concentrated in commercial multiple peril lines. Additionally, market shares of small insurers and captive insurers increased in the aircraft (all perils) line. Such concentrations could destabilize specific insurance lines following a terrorist event. Although the market is currently stable, some insurers may leave the market to mitigate their risks if their losses are unlikely to trigger the program’s loss sharing, which could reduce the availability of insurance in certain markets. A reduction in the availability of insurance could lead to more uninsured losses in the event of a subsequent terrorist event and could result in an increased expectation for losses to be covered through federal assistance. In its 2019 report, Treasury recognized the potential for small insurers to not provide insurance in certain markets. Additionally, the report cautions that if the program trigger increased, the number of insurers that would face the possibility of a gap between their deductible and the program trigger also would increase. However, analysis of Treasury data indicate that, to date, insurers in this situation largely have not left the market. As previously noted, because the changes to program parameters were gradual, insurers have had time to adjust to the changes. Insurers facing this scenario also can mitigate their risk by purchasing reinsurance to cover the difference between their deductible and the program trigger. However, it is not clear that the reinsurance market can absorb all of this risk. For example, industry stakeholders told us that reinsurers are sensitive to accumulation of exposure and reinsurance is limited in perceived high-risk areas such as New York City, Washington D.C., Los Angeles, and Philadelphia where there are large concentrations of people and high-value properties. In addition, reinsurance premiums may be too costly for some insurers. According to state insurance commissioners, high reinsurance costs may not qualify as a reason for insurers to increase premiums in some states. As a result, insurers would be unable to pass reinsurance costs on to policyholders. Furthermore, limited availability and affordability of reinsurance for high-risk areas and NBCR could be exacerbated following a terrorist event. Alternative forms of reinsurance, such as catastrophe bonds, are not widely used for terrorism risk. Treasury officials said that widespread market instability and an expectation for federal assistance may be unlikely in the case of a certified act of terrorism that produces significant losses for insurers that do not reach the program trigger. They said any market effects would be localized because a smaller terrorist event likely would affect a small number of insurers with a gap between their deductibles and the program trigger. Industry stakeholders said that it is possible that such an event could cause insurers to reduce coverage offered, but other stakeholders said that small insurers were well aware of the risk and their reactions would not create market instability. Additionally, state guarantee funds may provide support to policyholders in case of insurer insolvency before expectations for federal financial assistance arose. Insurance lines not eligible for TRIA. Federal assistance may be expected for insurers if large terrorism losses occur in insurance lines— such as life or health insurance—that are not eligible for TRIA, according to industry stakeholders. A 2019 Insurance Information Institute report found life insurance losses resulting from the attacks of September 11, 2001, were $1.4 billion (about 3 percent of total insurance losses from the attacks), an amount that far exceeds the TRIA program trigger. The report notes that standard homeowner, condo or co-op, standard renters, automobile insurance, and travel insurance policies also could be affected by terrorism and are not covered under TRIA. Adding group life insurance coverage under TRIA has been proposed, but never passed into law. According to some perspectives in congressional debate, other insurance lines were not viewed as needing explicit federal assistance. Insurers have adjusted to changing TRIA program parameters that increased the share of the losses for which they would be responsible. However, some insurers may not clearly understand whether Treasury would include policyholder retention amounts in calculating losses to certify a terrorist event, trigger loss sharing, or determine when the program cap has been reached. External communication to develop a clear understanding of how Treasury calculates “insured losses” and “insurance losses,” specifically as they relate to policyholder retention amounts, would help insurers understand when the program would be activated or capped ahead of any terrorist event. Furthermore, communicating this explanation could help Treasury alleviate uncertainty in the insurance market following a terrorist event. The Director of the Federal Insurance Office should communicate to insurers in writing how it would utilize policyholder retention amounts in calculating “insurance losses” and “insured losses” in determining the program certification threshold, trigger, and cap, as applicable. (Recommendation 1) We provided a draft of this report to Treasury and NAIC for review and comment. Treasury provided written comments through the Federal Insurance Office, which are reproduced in appendix III. Additionally, Treasury provided technical comments, which we have incorporated, as appropriate. NAIC did not provide technical comments. In Treasury’s written response, the Federal Insurance Office agreed that limiting uncertainty in the insurance market following a certified act of terrorism was an important goal. The office accepted the recommendation and stated that it would work to implement it in the coming months. We are sending copies of this report to the appropriate congressional committees, the Secretary of the Treasury, the Chief Executive Officer of NAIC, and other interested parties. In addition, the report is available at no charge on the GAO website at https://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-8678 or garciadiazd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. The objectives of our report were to (1) examine the changes in explicit fiscal exposure under the Terrorism Risk Insurance Act (TRIA) and how insurers have adjusted to the changes; and (2) describe situations in which implicit fiscal exposures may arise and might become explicit. To address these objectives, we reviewed the Terrorism Risk Insurance Act of 2002, Terrorism Risk Insurance Extension Act of 2005, Terrorism Risk Insurance Program Reauthorization Acts of 2007, 2015, and 2019, implementing regulations, and congressional records. We also reviewed prior GAO work on TRIA and federal fiscal exposures. We reviewed reports from the Department of the Treasury (Treasury), the Congressional Budget Office, and Congressional Research Service. We also reviewed relevant reports from academic researchers and industry stakeholders. We used Treasury’s data calls from 2017 to 2019 for aggregated direct- earned premiums, numbers of insurers, and hypothetical loss scenarios throughout this report. We evaluated the reliability of the data by performing electronic tests and interviewing staff from Treasury and its data contractor, and industry stakeholders. We found the data sufficiently reliable for the purposes described below. We interviewed Treasury officials and representatives from the National Association of Insurance Commissioners (NAIC) and industry stakeholders, including insurers, insurance trade associations, a rating agency, risk modelers, and an insurance broker. We selected a nongeneralizable sample of five insurers to interview. These insurers were selected because they provide terrorism coverage to businesses and reflect a mix of sizes and types of insurance. In interviews, we asked about aspects of the program and the insurance market, and risks that could lead to implicit exposure. To describe the potential explicit fiscal exposure to the federal government, we reviewed the relevant laws and analyzed the changes made in each reauthorization. To quantify and compare the federal explicit exposure from potential terrorist events in 2015 and 2020, we estimated the TRIA-eligible direct-earned premiums for those years and used simulated loss scenarios similar to those we previously developed. To estimate the TRIA-eligible direct-earned premiums for 2015 and 2020, we used aggregated direct-earned premiums for 2016–2018 from Treasury’s data calls. Specifically, first we calculated the annual percentage change in direct-earned premiums for 2016–2017 and 2017–2018. Second, we found the average change to be an increase of about 0.4 percent. This estimate was smaller than the percentage change we used in the 2017 report, but we found the estimate reasonable because our current estimate was based on Treasury’s data, specific to TRIA-eligible lines of insurance. Our 2017 estimate was based on annual estimates of terrorism risk revenue. Third, we estimated the 2015 and 2020 direct-earned premiums using the 0.4 percent average annual change and the reported 2016 and 2018 direct-earned premiums, respectively. To check for reliability, we used the same method to estimate direct-earned premiums for 2014. Our 2014 estimate matched the 2014 data used in our 2017 report. We calculated the change in both nominal and real dollars and decided to use nominal dollars, which is consistent with how Treasury reports direct-earned premiums. We found the data to be sufficiently reliable for estimating the TRIA-eligible direct-earned premiums for 2015 and 2020. To compare events occurring under the program provisions in effect in 2015 and 2020, we analyzed how losses would be shared between the government and insurers by modeling terrorist events with insured losses of $5 billion, $25 billion, $50 billion, $75 billion, and the maximum terrorism event size ($100 billion in insured losses) in 2015 and 2020. In each case, we modeled the affected insurers to have an aggregate direct-earned premium base of 25, 35, 55, and 100 percent of all TRIA-eligible premiums. To demonstrate how the program trigger may affect insurers, we also modeled a smaller terrorist event with $290 million in losses and assumed that the affected insurers had an aggregate direct-earned premium base of $750 million. In all cases, we estimated the portion of federal losses that would be subject to mandatory and discretionary recoupment. To determine how insurers have adjusted to changes in TRIA and measure market stability, we reviewed Treasury and past GAO reports and relevant literature, analyzed Treasury data, and interviewed industry stakeholders. We conducted a literature search to determine how changes in the TRIA program parameters affected insurers and we summarized relevant findings from our review of the literature we identified. Additionally, we summarized Treasury and industry stakeholders’ views on insurers’ ability to cover their share of losses following an event and their willingness and ability to continue providing coverage after a large event without access to the federal share of losses to cover claims from the event. We also analyzed Treasury data to determine whether insurance lines have experienced changes in premiums or coverage availability since 2016. Specifically, we computed market shares by insurer category for calendar years 2016–2018, using direct-earned premiums from Treasury’s data calls. Using Treasury’s insurer categories (alien surplus lines, captive, nonsmall, and small), we computed market shares overall, and for TRIA-eligible lines of coverage in the U.S. terrorism risk insurance market, which includes all the states, the District of Columbia, U.S. territories, and other areas. We did not use number of policies because number of policies was not available in Treasury’s data for all insurer categories for all years. In the course of assessing data reliability for Treasury’s scenario data, we found some lack of clarity regarding two key terms under TRIA: “insured losses” and “insurance losses.” The external communication component of internal control—that management should externally communicate the necessary quality information to achieve the entity’s objectives—was significant to this objective, along with the related principle that management communicate quality information externally through reporting lines so that external parties can help the entity achieve its objectives and address related risks. We assessed Treasury’s external communications about these terms. Specifically, we reviewed the content of TRIA statutory language and program regulations and guidance. We obtained an interpretation of the terms from Treasury officials and also obtained industry stakeholders’ views on them. We determined Treasury’s scenario data to be reliable for the purpose of reporting the loss sharing as it was reported and for illustrating loss sharing examples. To identify potential situations in which implicit federal fiscal exposure may arise, we analyzed TRIA’s program design and reviewed our prior work for sources of implicit fiscal exposures, such as those faced by other disaster insurance programs. To ensure the reasonableness and completeness of our list of identified sources, we consulted with industry stakeholders and made modifications as appropriate. We grouped the sources of implicit fiscal exposures into three broad categories: (1) any unrecouped program expenditures; (2) federal assistance for uninsured or underinsured terrorism losses (including uninsured losses in a nuclear, biological, chemical, or radiological event, losses in excess of the $100 billion program cap, and policyholders’ retained losses); and (3) federal assistance to stabilize the insurance market for insurers that may be unable to access the loss-sharing feature of the program or for lines of insurance not included under TRIA. To describe the potential exposure resulting from not executing the recoupment of program expenditures, we summarized prior GAO reports and industry stakeholder views on the risks and challenges of collecting mandatory and discretionary recoupment funds, including the associated collection time frames. To describe the potential exposure resulting from federal assistance for uninsured or underinsured losses, we reviewed and summarized findings in prior GAO reports on past instances in which the federal government provided disaster assistance (such as following the September 11 terrorist attacks, the financial crisis, and large natural disasters). We summarized Treasury, NAIC, and industry stakeholder views on the likelihood of terrorist events reaching the program cap, their expectations for federal intervention in that case, and the importance of the cap to the terrorism risk insurance market. To describe the potential exposure resulting from federal assistance to stabilize the insurance market following a terrorist event, we interviewed industry stakeholders about scenarios that could produce an expectation for government assistance (implicit exposure), the stability of the terrorism insurance industry, how program details could affect different insurer groups, and insurers’ options for covering their share of losses. We used Treasury’s data to quantify the number and share of insurers that might not be able to access TRIA’s loss-sharing provision and to illustrate estimated loss sharing in Treasury’s scenarios of losses that would have occurred in three hypothetical events: New York City (2016), Chicago (2017), and San Francisco (2018). We also interviewed various insurer associations. We conducted this performance audit from July 2019 to April 2020, in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. As shown in table 1, Terrorism Risk Insurance Act (TRIA) reauthorizations through 2015 changed several loss-sharing provisions, which decreased the federal share and increased the insurer share of losses. The 2015 reauthorization required incremental decreases in the federal share of losses over 5 years. The 2019 reauthorization extended the program until the year 2027, but did not make any changes to the program parameters discussed below. In addition to the contact named above, Jill Naamane (Assistant Director), Karen Jarzynka-Hernandez (Analyst in Charge), Rudy Chatlos, Giselle Cubillos-Moraga, Kaitlan Doying, Lijia Guo, John Karikari, Barbara Roesmann, Jessica Sandler, Jena Sinkfield, Frank Todisco, and Rachel Whitaker made key contributions to this report.