Tech firms wise up to new exposures

It was an industrial mishap that would have ordinarily gone unnoticed. On 4 September 2013, a fire engulfed a substantial portion of a computer memory chip production plant in Wuxi, China.

But it wasn’t just any production plan, and it didn’t go unnoticed.

Owned and operated by SK Hynix, the fire made international headlines owing to the plant producing between 10%-17% of the world’s supply of dynamic random access memory (DRAM), a memory chip used in computing electronics from laptop computers to mobile phones. The company supplied everyone from Apple and Dell to Lenovo and Sony.

So just how bad was the fire and business interruption?

The effects of the incident were instant: the price of a benchmark unit of 2-gigabit DRAM jumped some 20% to $1.90 the following day, a three-year high. One research firm estimated that the shipment of some 10 million smartphones and 11 million laptops were delayed as a result of the fire, while HP took the threat of supply-chain disruption seriously enough for senior management to clear their calendars for two days for no other reason than to make sure they had “an unfair share of the available [DRAM] commodity”.

Beyond the immediate supply chain disruption and delays, the case “totally changed the concept for fire risk in the technology, media and telecommunications (TMT) industry”, says Willis Asia head of TMT, managing director, Sirikit Oh.

SK Hynix was one of the top claims in the TMT industry, which cost insurers about $860m.

And, naturally, resulted in an increase to premiums in the semi-conductor industry.

It’s cases like these that have ensured ‘fire and explosion’ comes close to the top of almost any firm’s risk register and risk transfer programme.

But the risk priorities for TMT companies have evolved significantly in the past two years (see box out, below).

Today, the focus also prioritises cyber and technology risks.

This is because TMT companies today typically operate or depend on complex IT networks, depend heavily on web-based solutions, hold and work with a large amount of customer data and often host or manage data for their clients.

Indeed, David Ralph, senior vice president of risk management at Hong Kong-based telecommunications company PCCW Limited, insists that his IT background has been very beneficial to his risk role.

“As an IT, telecoms and media firm, these are IT-type businesses,” he says. “So not only do we rely on IT for billings and aspects like that, but the underlying infrastructure is IT-based for everything we are providing.”

Ralph says his IT knowledge has also assisted when people have tried to inform him that a certain area of technology has minimal, or no, risks.

“I have a reasonable amount of respect and authority when it comes to discussing what the risks actually are, and it enables me to work more closely with the technical teams,” he says.

Willis’s Oh explains that TMT firms are more “vulnerable to cyber and technology-related risks, including hacking, denial of service attacks, or data breaches causing potential expenses, liabilities and regulatory concerns”.

She says: “Companies in the TMT industry should take proactive measures in safeguarding their IT systems and intellectual property so as to ensure that their brand and reputation in the market place is protected.

“Besides taking physical protective measures, their risk mitigation strategy should include risk sharing and risk transfer through various insurance products.”

The cyber insurance market in Asia is still emerging, however, with both insurers and clients grappling with cover and capacity issues.

“In Asia, every country (whether developing or developed) is trying to find their footing in handling internet and cyber security issues. It is a very delicate balance between regulation and allowing cyber developments to take place at the right pace,” Oh says.

“However, we do see that regulators in Asia are coming together on a more regular basis to share regulatory issues and experiences among themselves and with the industry.”

This bodes well for Asia, Oh says, as the interactions have helped the industry to work closely with regulators to help them understand issues faced by the industry.

“In so doing, regulators are better equipped with knowledge to help the industry attract and retain talent in Asia thus helping the industry to grow at a more sustainable pace,” she says.

But Zurich Insurance Global Corporate Asia-Pacific chief executive Keith Thomas says the region needs a more coordinated response to increase its cyber resilience.

“Asia currently lacks an overarching framework to deal with cyber risk,” Thomas says.

The region has recently seen some promising steps forward in this area, however. For example, Singapore recently established a Cyber Security Agency and Hong Kong established a Cyber Crime Unit.

But Thomas is calling on regional bodies such as ASEAN and APEC to lead a unanimous response for the region.

“Companies cannot turn a blind eye to the prevailing risks of cyber-attacks,” he adds. “Besides the potential damage caused from such events, there are also serious reputational risks associated with cyber security. The topic needs to be a priority and escalated to a board-room level issue.”