New Geneva Association report highlights the important role of private re/insurers, alongside governments, in boosting society’s resilience to ransomware and ensuring the full benefits of digitalisation can be realised.
The report explores the significant value add of cyber insurance beyond risk transfer, amid ongoing debate on whether to ban ransom payments or associated insurance coverage.
Governments should do more to counter ransomware attacks: disrupt cybercriminal business models, fight illicit use of cryptocurrencies and promote cyber hygiene throughout business and society.
ZURICH, 20 July 2022 – The frequency of ransomware attacks, a form of cyber extortion, is increasing, along with the size and nature of ransom demands. Cybercriminals are deploying more sophisticated approaches to target governments, businesses and individuals, with serious and costly effects. The growth of the ransomware-as-a-service (RaaS) business model has also enabled threat actors with limited technical skills to launch highly disruptive attacks.
Cyber insurance provides vital financial protection and operational support in the event of an attack, but ransomware has contributed to the recent deterioration in cyber insurers’ underwriting performance. Ransomware accounted for 75% of all cyber insurance claims in 2020 (AM Best) and is also likely to have been the costliest loss event category in 2021 (WTW).
Are there differences between risk management in the public and private sectors? As a professor who has spent time in both public administration and business administration programs, I have had several opportunities to think about both sides of the debate.
Professor Peter Young
On one side, we have those who argue that management is management and that differences in the public and private sectors are modest (“if only government were run like a business”). Opponents of the “management is management” point of view argue that the public sector is so different from the private sector that it is a distinctly separate thing and, thus, requires different knowledge and management skills.
A plea for a new search for ‘responsible-in-the-end’ leadership: stewardship
Jack Kruf | 10 March 2017
Of course, we have our democratic system, a great set of principles and values that serve as equipment for good public governance. Public leadership, concerning both public organisations and the public domain of society, is embedded in this system, at least it should be. You may expect excellent results because the democratic system traces back to the Greek δημοκρατία in 508 BC and has been tested and challenged over and over again. Over the millennia, it has developed to this point.
Jack Kruf
Considering the present state of society and of natural ecosystems, you may be surprised by the results of this period of 2525 years of development. The Global Risks Reports, published by the World Economic Forum since 2005, tell the story of how critical the state of the Earth is. Reading these reports, I had a flashback to 1972, when the Club of Rome presented facts, findings, and figures in its report, The Limits to Growth. For at least five decades (i.e., half a century!), we know what is going on and where many generations of leadership have brought us.
In his best-selling book, An Inconvenient Truth, former Vice President Al Gore argues against the climate crisis and argues that it is imperative that we solve it.
Our climate crisis may, at times, appear to be happening slowly, but it is happening very quickly and has become a true planetary emergency. The Chinese expression for crisis consists of two characters. The first is a symbol of danger; the second is a symbol of opportunity.
Since January 1977, the International Institute for Environment and Development (IIED) has been conducting a research program on the environmental policies and programs of major development aid organizations. The first of IIED’s studies in this field, a report on environmental procedures and practices in nine multilateral development agencies, was completed in 1978 and published as a book titled “Banking on the Biosphere?” (Lexington Books, New York, 1979).
This study aroused considerable interest, and, as a result, IIED decided to conduct a parallel policy review of six bilateral aid agencies. This “assessment project” began in May 1978 with the agreement and support of the aid agencies of Canada, the Federal Republic of Germany, the Netherlands, Sweden, and the United States. The study’s aim was:
To assess the extent to which policies, procedures and programs of the six bilateral agencies promote sustainable, environmentally sound development.
To examine the constraints to improved environmental performance in these agencies, that might be necessary to remove or substantially reduce these constraints.
The Common Assessment Framework (CAF) is a total quality management tool inspired by the Excellence Model of the European Foundation for Quality Management (EFQM) and the model of the German University of Administrative Sciences in Speyer.
It is based on the premise that excellent results in organisational performance, citizens/customers, people, and society are achieved through leadership driving strategy and planning, people, partnerships, resources, and processes. It simultaneously looks at the organisation from different angles, taking a holistic approach to organisational performance analysis.
Cadbury committee | 1992, London Stock Exchange, en • nl
This report is a milestone in corporate governance. It is 1992. The Cadbury Report about “Financial Aspects of Corporate Governance” has been published. This groundbreaking report – chaired by Sir Adrian Cadbury – led to improvements in governance standards. It was a reaction to the Bank of Credit and Commerce International scandal in 1991.
• Dit rapport is een mijlpaal in het corporate besturing. Het is 1992. Het Cadbury Report over “Financial Aspects of Corporate Governance” wordt gepubliceerd. Baanbrekend – voorgezeten door Sir Adrian Cadbury – en het leidde tot verbeteringen in de normen voor deugdelijk bestuur. Het was een reactie op het schandaal in 1991 bij de Bank of Credit and Commerce International.
The report made specific recommendations on good corporate governance, which it described as ”best practice” or ”code of conduct.”It was highly influential in developing organisational codes regarding external shareholders’ accountability. It is the start of a new line of thinking about good governance, also in the public context. • Het rapport deed specifieke aanbevelingen voor goed ondernemingsbestuur, die het omschreef als “best practice” of “gedragscode”. Het rapport was zeer invloedrijk bij het ontwikkelen van organisatiecodes met betrekking tot de verantwoordingsplicht van externe aandeelhouders. Het is het begin van een nieuwe manier van denken over goed bestuur, ook in de publieke context.
This interview with Sir Adrian Cadbury gives the precise focus and the intention to look further into the essence of corporate governance. • Dit interview met Sir Adrian Cadbury geeft de precieze focus en de intentie om verder te kijken naar de essentie van corporate governance.
The report stipulated “the continuing concern about standards of financial reporting and accountability, … which has kept corporate governance in the public eye.” Some findings and recommendations (a personal selection) tell the story of the search for codes, checks and balances [quote]:
By adhering to the Code, listed companies will strengthen their control over their businesses and public accountability. In so doing, they will be striking the right balance between meeting the standards of corporate governance now expected of them and retaining the essential spirit of enterprise.
Every public company should be headed by an effective board that can lead and control the business.
However, the framework in which auditors operate is not well designed in certain respects to provide the objectivity that shareholders and the public expect of auditors in carrying out their function.
The new system has only recently been established, and its full impact has yet to be felt. In the following paragraphs, we endorse the steps being taken and recommend additional action to strengthen public confidence in the audit approach.
We believe that there should be an extension of the audit, which will add to users of accounts and bring it closer into line with public expectations.
So far as reporting fraud is concerned, the present legal position is that confidentiality is an implied term of an auditor’s contract, and there is a public interest in maintaining confidential client relationships. Normally, therefore, it is the auditor’s duty to report fraud to senior management. However, there is also a public interest in fraud being dealt with expeditiously and this may entail disclosing matters to a proper authority. [unquote]
• Het rapport vermeldde “de voortdurende bezorgdheid over normen voor financiële verslaggeving en verantwoording, … die corporate governance in de publieke belangstelling heeft gehouden.” Enkele bevindingen en aanbevelingen (een persoonlijke selectie) vertellen het verhaal van de zoektocht naar codes, checks and balances [citaat]:
Door de Code na te leven zullen beursgenoteerde ondernemingen hun controle over hun bedrijf en hun publieke verantwoording versterken. Op die manier vinden ze het juiste evenwicht tussen het voldoen aan de normen van corporate governance die nu van hen worden verwacht en het behouden van de essentiële ondernemingsgeest.
Elke beursgenoteerde onderneming moet worden geleid door een effectieve raad van bestuur die de onderneming kan leiden en controleren.
Het kader waarbinnen auditors werken is in bepaalde opzichten echter niet goed ontworpen om de objectiviteit te bieden die aandeelhouders en het publiek verwachten van auditors bij het uitvoeren van hun functie.
Het nieuwe systeem is pas onlangs ingevoerd en de volledige impact ervan moet nog merkbaar worden. In de volgende paragrafen onderschrijven we de stappen die worden genomen en bevelen we aanvullende maatregelen aan om het vertrouwen van het publiek in de controleaanpak te versterken.
Wij zijn van mening dat de controle moet worden uitgebreid, wat de gebruikers van de rekeningen ten goede zal komen en de controle meer in overeenstemming zal brengen met de verwachtingen van het publiek.
Wat het melden van fraude betreft, is de huidige rechtspositie dat vertrouwelijkheid een impliciete voorwaarde is van het contract van een auditor en dat er een algemeen belang is bij het onderhouden van vertrouwelijke relaties met cliënten. Normaal gesproken is het daarom de plicht van de auditor om fraude te melden aan het senior management. Het is echter ook in het algemeen belang dat fraude snel wordt aangepakt en dit kan betekenen dat zaken moeten worden gemeld aan een bevoegde autoriteit. [unquote]
