Aon's Retail and Wholesale Inperspective Summer 2015

Risk. Reinsurance. Human Resources.

Retail and Wholesale InperspectiveIn this issue

p3 Reputation and competition threats dominate 2015 risk registers

p5 Intangible risks get short shrift on insurance programmes

p7 Preparing for a crisis; the art of the possible

p9 Meet the experts

Aon Risk SolutionsNational | Retail & Wholesale Practice

Issue 4 July 2015

Welcome to the latest edition of Inperspective, Aon’s review of the latest risk management trends in the retail and wholesale sectors.

Shortly before we published this issue, Chancellor of the Exchequer George Osborne gave his fi rst Budget since the General Election, with extended opening hours a key headline. With retail and wholesale markets accounting for at least 5% of gross domestic product according to 2014 UKTI statistics, this potential relaxation was met with mixed reviews from the industry and it remains to be seen if the change will encourage growth on its own.

Meanwhile, with the Grexit dominating headlines the worrying volatility in Chinese markets has now emerged as a concern for retailers. With China such an integral part of the UK retail sector’s supply chain we will be monitoring developments in this area carefully. On 9 July more than 40% of the country’s listed entities suspended their shares from trading amidst fears of a mass sell-off driven by overleveraged equity investors. Any further uncertainty from this dominant manufacturing economy will be extremely unwelcome for retailers in the UK, whose supply relationships will need to include buff er options if their networks show signs of strain.

Daniel FoxAon Regional Practice Leader, Retail

Open all hours?

aon.co.uk/retail-wholesale

Inperspective | Retail and Wholesale | July 2015 FPNAT.150 2

In this issueIn this issue, we review the top three trends in risk management with analysis of Aon’s Global Risk Management Survey 2015. Executive Director Norman Andrew and Head of Business Continuity Practice Vince West explain the implications of retail and wholesale companies’ increasing concern about brand and reputation.

Brand and reputation remain a dominant theme in our other stories too. Adam Peckman, Principal Consultant at Aon Risk Solutions reviews another piece of exclusive Aon-sponsored research, the 2015 Ponemon report into intangible risks, which shows a considerable mis-match between how well insured our physical assets are, and how underinsured our valuable but intangible assets like data are.

Finally, we consider the possibility of crisis and how companies are managing this issue. Aon Crisis Management’s Director of Business Development and Network Relations, Scott Bolton, urges retail and wholesale companies to set aside their guidebooks and manuals, to consider what impact they most fear.

We hope you find this edition of Inperspective a useful resource and invite you, as ever, to get in touch with any questions you may have.

http://aon.co.uk/retail-wholesale



Reputation and competition threats dominate 2015 risk registers Aon has uncovered increasing levels of concern amongst retail and wholesale risk managers of the threat posed by damage to their brand or reputation. Inperspective speaks to Head of Business Continuity Vince West and Executive Director Norman Andrew about the top risks facing the industry today.

According to Aon’s Global Risk Management Survey (GRMS) 2015, ‘damage to reputation or brand’, was rated second only to ‘increasing competition’ in a list of risks facing retail and wholesale companies. The report, which publishes every other year, highlighted how reputation risk rose from #7 in 2013 – the biggest riser in the top ten.

Economic slowdown also remains within the top three risks, and Norman Andrew, Executive Director at Aon, says retailers’ continued concern over this and their competitors reflects a challenging picture. “The UK’s retail industry had the best sales performance since before the recession in 20141. The sector’s sales grew by around 2.3% last year but it is still experiencing a number of high profile challenges. The results of Aon’s Global Risk Management Survey paint a very clear picture of the concerns amongst risk managers in the sector and reflect the changing environment in which they work.”

Norman adds that retailers are beginning to understand that the goodwill on their balance sheets represents the intangible value of the brand. “The indirect impact on goodwill of a product recall, a web site denial of service attack or a block in the supply chain is becoming a much more common discussion in the risk management community. The industry is advancing its understanding of those individual risks (cyber, supply chain, product contamination/malicious tamper), but the remaining part of the puzzle was always how can you recover your brand equity after a crisis situation. I think that must be why, despite the fact only 3% of retailers said that they had suffered a loss from damage to their brand or reputation in the GRMS, it has risen to such an important factor on the industry’s risk register.”

Competition all under one roofThe impact of increasing competition remained firmly at number one in the survey, having taken top spot in 2013 as well. Over half (53%) of retail and wholesale companies confirmed they had experienced a loss in the past two years as a result of this factor.

Vince West, Head of Business Continuity Practice at Aon, says that while predicting the competitive landscape can be a guessing game, the ways retailers have changed their operations to compete have led more manageable risks to coalesce and create worrying exposures.

“Both online and high street retail is increasingly dominated by the single-site warehouse distribution centre, meaning the fire and theft risk for the industry has shifted from a networked exposure, perhaps with branches nationwide; to an aggregated exposure, with stock and premises risk all in one place,” says Vince. 1 http://www.retailresearch.org/retailforecast.php

Vince WestHead of Business Continuity PracticeAon Risk Solutions | Global Risk Consulting

Norman AndrewExecutive Director | Aon

http://aon.co.uk/retail-wholesale

http://www.retailresearch.org/retailforecast.php



Aon Executive Director Norman Andrew is responsible for building comprehensive insurance programmes across the retail and wholesale markets. He adds: “We are increasingly providing advice to customers as they grow and develop these pick, pack and despatch business models. When retailers are building new warehouses from scratch, they very sensibly look at where the pinch points will be from a risk point of view. This ranges from construction, through to the finished asset and business continuity in the long run.”

Norman adds that once a warehouse is up and running, a continued interrogation of the model is required to keep processes slack. “We encourage clients to ask questions like ‘when the warehouse is at full capacity, are there secondary operations or agreements with competitors to provide reciprocal support in the event of an incident?”

This concentration of risk requires substantial limits of indemnity and Norman adds that only a true partnership can work between client and broker. “Clearly when there is lots of value into a single site, this exposes a lot of capital and providing full value for a site into hundreds of millions of pounds will require us to buy a substantial primary coverage layer and lots of reinsurance as well.”

Insurance is the straightforward solution, says Norman, but the key is to dovetail a programme with your own business continuity programme. “Surviving the risk is the key issue and reinstatement can be challenging,” he says. “If a retailer loses a major asset like a warehouse at which it might take up to two years for full reinstatement; does its business continuity plan ensure that it will be back up and running in that time? “Anybody making that call must give the right guidance to ensure that the limit of indemnity is sufficient to allow the customer to get back to a pre-loss trading position; not simply just to rebuild and re-kit a site. We had a £50m claim on a food and drink manufacturing site and even with a two and a half year indemnity period, by their own admission this wasn’t long enough because they had to go to a particular machinery manufacturer in Italy who had a full order book. They had to wait their turn for the machinery to be built; this meant there was a rebuilt warehouse up and running for about eight months before they could resume production.”

For further information contact Vince West

Vince WestHead of Business Continuity [email protected]



Intangible risks get short shrift on insurance programmes Intangible assets like customer data are considerably underinsured, when compared against physical assets (11% v 49%), according to new research by Aon and the Ponemon Institute. Adam Peckman, Principal Consultant at Aon explains his concerns and solutions for the retail and wholesale industry.

The transformation of the world’s economies from historical tangible products and manual labour services, to reliance on technology and information assets is rapid and expansive. Cloud computing, mobile devices, social media, big data analytics and the explosion of the Internet of Things help facilitate this digital transformation. In the next fi ve years, the number of internet connected devices is predicted to rise from 15 bn to 50 bn2.

For the retail and wholesale industries this interconnectedness is acute with customers; supply chain and infrastructure all increasingly linked online.

In recent years, this has exposed the assets of retailers to cyber criminals, causing losses estimated in the tens and hundreds of millions in terms of forensic costs, regulatory fi nes and share price impact.

Case studies like Home Depot and Target Retail demonstrate how the potential for damage to intangible assets will continue to be a challenging task as retailers further transform their value chain through deploying omni-channel strategies, digital supply chains (automated via ‘Internet of Things’ technology), and big data infrastructure.

The Aon/Ponemon report raised a number of key concerns for risk managers, who it seems have yet to adequately assess their value at risk in terms of intangible assets like customer data. The report found that industry-wide, companies insured 49% of their potential loss to plant, property and equipment – physical assets – while just 11% of their information asset value was covered by insurance.

Of equal concern was the fact that a signifi cant minority of businesses still conduct ‘informal or ad hoc’ risk assessments and only 58% having conducted any form of cyber risk assessment.

Measure and valueFindings like these should encourage retailers to assess their intangible value-at-risk as an early step when developing new strategies that protect market share and ensure continued competitiveness.

If a retailer has a material incident (i.e. fi re, fl ood and explosion) that impacted on their physical assets, this could be measured and valued. It could also be insured under traditional insurance policies such as property and business interruption cover, but increasingly the insurance market has developed innovative products that go beyond this to protect intangible assets and support the insured in the event of a crisis scenario with consulting services designed to mitigate any impact on intangible asset values.

Adam PeckmanPrincipal Consultant | Aon

2 Source: Cisco



Report values up the chainIn our experience an increasing number of retailers are deploying enterprise risk management approaches to identify, assess, and manage brand exposures in the increasingly digital economy. Accordingly, this involves reporting to the board on material exposures and the effectiveness of controls and responsiveness of insurance to protect these intangible assets.

There remains a way to go before parity is achieved between how tangible assets like property are viewed alongside intangible assets like brand, reputation or customer data. The Aon/Ponemon Institute report showed that fewer risk managers will report a material loss to their information assets than they would a loss to property, plant or equipment (50% v 34%).

To return to the principal concern highlighted in the report; underinsurance, perhaps the most significant finding was the percentage of potential loss which is self-insured. Industries like retail predominantly self-insure against losses to their information assets. From the whole sample, the report found that 58% of any potential loss to information assets is currently self-insured, against an average of 28% on physical assets. Considering that Ponemon also found it was more likely respondents would suffer a loss to information assets in the next 12 months than one to their physical assets, the case for increasing coverage becomes clear.

For further information contact Adam Peckman

Adam PeckmanPrincipal [email protected]

Intangible and tangible assets have similar value, but losses have unequal expected impact, likelihood and coverage

Intangible vs. Tangible Cyber risk is frequently discussed and often experienced, but limited action is being taken

Talk vs. ActionCyber risks should be managed in a similar way to tangible risks – including assessing the potential financial statement impact

What Next?

Is your cyber risk approach ahead of the curve?Cyber risk in EMEA

But limited action

44% Lack formal cyber risk assessment

79% No Cyber insurance cover

37% No financial statement disclosure of cyber losses

Visit www.aon.co.uk to learn more or download the full 2015 EMEA Cyber Impact Report

Source: Research independently conducted by Ponemon Institute LLC and commissioned by Aon Risk Solutions. Research explored financial statement exposure of intangible vs. tangible assets.

Values are in USDm

1 Collaborate across risk, finance, IT & legal

2 Formal assessment of all potential cyber exposures

3 Risk quantification, tailored to your business

4 Strategy for risk management, mitigation or transfer

38% Rank cyber a top 5 risk

46% Expect cyber exposures to increase

A discussed priority

38% Experienced a material or significant loss

$1.1m Average loss value

And losses are occurring

Similar asset valueUSD 872mUSD 615m

$845m$638m

Total value Probable maximum loss

Intangibleassets

Tangibleassets

And larger impact & likelihoodImpact of business disruption

Likelihood of loss

$103m1.5%$168m

4.7%

But less insurance coverProportion of potential loss covered by insurance

49%

11%

Intangibleassets

Tangibleassets

Intangibleassets

Tangibleassets



Preparing for a crisis; the art of the possibleRisks that trigger potential crises are insured by retail and wholesale companies to varying degrees; product recall resulting from malicious tamper or contamination is one such example, while data breach response following cyber-attack is another. However, protection doesn’t begin and end at the point of sale. Inperspective hears from Aon experts Scott Bolton and Kary Yates about the growing importance of crisis management consulting in the prevention and response to watershed events.

As a common feature of the insurance programmes on off er to retail and wholesale companies today, Aon Team Leader for Product Recall and Crisis Management, Kary Yates, says Crisis management consulting is growing in popularity. “With a 5% standard bursary (of net premium) available for clients to spend with their insurer’s crisis consultant, clients can take some comfort by having that expertise available to assist them in the review of their supply chain management, business continuity and recall management plans.”

Appointed directly by insurers, these third party consultants typically help by deploying a range of assets in the aftermath of an incident to manage companies’ response and recovery. “They send responders to work alongside the client and to advise them on how to solve a problem when it arises,” says Kary. “They are an extremely useful resource but one that is best relied upon when you have a thorough understanding of your organisation’s own ability to recognise and respond to a crisis event.

“Aon also works with retail and wholesale companies to prepare for crisis,” she says. “We can then ensure we build the customer’s capability and train their team to understand the challenges of crisis prevention and response.”

Crisis management consulting is a term with considerable scope and meaning. Aon Crisis Management is led by Director of Business Development and Network Relations, Scott Bolton, who says the term ‘Crisis Management’ itself needs a more specifi c application. “A crisis is an incident of a strategic nature that has the potential to overwhelm an organisation. Lots of food manufacturers could manage a limited product recall without any fuss. Where there is often scope to enhance crisis management capabilities is where the scope of the event is larger, or where the event isn’t necessarily related to their core business. What we advise companies about is the need to understand what ‘impacts’ a potential crisis could have so we can help them build a team capable of reducing the duration and severity of those impacts,” he says.

“Both Knight and Pretty in 1996 and the Aon/Oxford Metrica Reputation Review of 2012, support the opinion that articulate, prepared, strategic crisis management can have a positive impact that translates into improvements in share price, market share or brand equity.”

Kary YatesTeam Leader | Product Recall and ContaminationAon Global Broking Centre

Scott BoltonDirector of Business Development and Network Relations Aon Crisis Management



The wood for the treesThe problem for many risk managers, says Scott, is that too much emphasis is placed in imagining incidents or scenarios and prescribing a response to each one. “If you try and imagine every type of crisis out there, the numbers are legion and you would end up with a crisis management plan the size of an encyclopaedia. Instead, why not consider the potential impact rather than the scenario which generates it; then you can filter these down into a sensible number of effects that you want to manage. Perhaps you are most concerned about the impact on your brand or reputation, or a regulatory intervention; it could be the impact of an injury or a loss of life, and so on.”

Supply chain risk is continually on the industry’s agenda but again, Scott says crisis management need only concern itself with a focus on this risk beyond a particular threshold. “A single day’s disruption in your supply chain could have a relatively short-term impact.”

‘Crisis’, not ‘incident’ managementThis illustrates the fundamental difference between crisis management and incident management, he says. “In the latter you rely on a procedure and you resolve the incident. In crisis management, you are relying on the people in your team to understand the organisation and the external influences in play and with the right training and flexibility, enabling them to ‘innovate’ a solution.

One example of a crisis which stepped aside from formal procedure is now widely regarded as a model for public relations crisis management today. “For anyone looking for a practical example, it’s worth considering the Maple Leaf Foods case study,” says Scott, “an incident in 2008 that helped redefine how companies handle crisis communications. This organisation acted perhaps against the legal advice at the time by admitting culpability but took a very candid approach to their communications and ultimately benefited from their strategy.”

An intangible investmentThe tale above illustrates how the perception of good management in a crisis translated into stakeholders increasing their confidence in your management. “This means having a crisis management team that is trained and can operate on behalf of the board and yet still connect into the tactical elements of the organisation to deliver a response. The nature of those individual tactical responses are immaterial, it’s about getting to the point where you can trust your team to add value in a crisis; influencing public, regulatory and government perception that you can be trusted to ride out the storm.”

For further information contact:

Kary YatesTeam Leader for Product Recall and Crisis [email protected]

Scott BoltonDirector of Business Development and Network Relations, Aon Crisis [email protected]

http://www.ft.com/cms/s/0/8c8d3668-adb5-11e2-82b8-00144feabdc0.html



Meet the experts

Daniel FoxRegional Practice Leader | RetailAon

Vince WestHead of Business Continuity PracticeAon Risk Solutions | Global Risk Consulting

Daniel Fox has over 20 years’ experience working for leading national and global brokers in client management roles. In this time, he has lead client service teams, delivered strategy and developed international and captive programmes. In his last position, Dan was a specialist in the retail sector and was accountable for a number of existing flagship accounts together with success in new business development.

Vince West has considerable experience formulating and advising clients on their respective business continuity strategies and has been engaged on business continuity projects with many leading organisations. His extensive experience of business continuity management has been deployed across sectors including retail, petro-chemical, telecommunications, banking, finance and insurance, defence, IT, publishing, food manufacturing, regional development and other government agencies.

Scott BoltonDirector Business Development and Network Relations Aon Crisis Management

Scott Bolton provides specialist consulting to support clients purchasing terrorism insurance; delivering a more articulate approach to managing a terrorism program. He supports clients in understanding their exposure to unfamiliar, high impact risks (terrorism, security) and provides guidance in managing those risks on the ground.

Scott has extensive industry experience covering retail development, banking, property development and logistics and distribution and specialises in areas of expertise including kidnap, ransom and extortion, terrorism threat assessment, global safe travel programs and country entry and exit planning.

Prior to his commercial experience, Scott spent 6 years in the Royal Engineers, specialising in bomb disposal and counter terrorism.



Kary YatesTeam Leader | Crisis ManagementAon Risk Solutions | Global Broking Centre

Kary Yates has 29 years’ experience in producing and placing property and casualty business with emphasis on product recall and contamination since 2002. Kary has 14 years broking experience in the London market, including Lloyd’s of London and the London company market. Kary has a number of qualifi cations in food and drink including a Level 2 and 3 in Food Safety Supervision for Manufacturing.

Adam PeckmanPrincipal ConsultantAon Global Risk Consulting

Adam Peckman is a senior enterprise risk management consultant in Aon Global Risk Consulting. He is primarily engaged with delivering solutions to support the corporate risk management requirements of multinational clients. He is currently advising a British multinational retailer and the largest Finnish retail chain on cyber risk to support their respective risk management and insurance strategies.

His extensive retail sector experience has involved numerous risk advisory projects that include conducting enterprise wide risk assessments and applying advanced quantitative simulations to model fi nancial exposures.

These projects are aimed at optimising investment decisions in risk management and designing more fi t-for-purpose risk fi nancing and transfer arrangement.Adam holds degrees from the University of Sydney in Economics and Psychology and is a member of workgroup for ISO 31000 and ISO 28000.

Risk. Reinsurance. Human Resources.

About AonAon plc (NYSE:AON) is a leading global provider of risk management, insurance brokerage and reinsurance brokerage, and human resources solutions and outsourcing services. Through its more than 69,000 colleagues worldwide, Aon unites to empower results for clients in over 120 countries via innovative risk and people solutions. For further information on our capabilities and to learn how we empower results for clients, please visit: http://aon.mediaroom.com/ Aon UK Limited is authorised and regulated by the Financial Conduct Authority. Aon UK Limited Registered Office: The Aon Centre, The Leadenhall Building, 122 Leadenhall Street, London, EC3V 4AN. Registered No. 210725. VAT Registration No. 480 8401 48. Aon is not responsible for this content. Telephone calls are recorded and may be monitored. © 2015 Aon UK Limited. FP number: FPNAT.150