Terrorism Risk Insurance: Market Is Stable but Treasury Could Strengthen Communications about Its Processes

TRIA created a federal program to help ensure the availability and affordability of terrorism risk insurance. Insurers must make terrorism risk coverage available to commercial policyholders. The federal government and insurers share losses on such policies resulting from a certified act of terrorism causing at least $5 million of insurance losses. Annual coverage for losses by insurers (who have met their insurer deductible) and the government is limited to $100 billion. The program is set to expire December 31, 2027.

GAO was asked to review TRIA. This report examines (1) the current market for terrorism risk insurance and the program's role in the market, and (2) Treasury's processes to certify acts of terrorism and fulfill claims. GAO reviewed Treasury reports and related industry studies, Treasury's guidance and procedures for the program, and insurance policy language. GAO also interviewed Treasury officials and industry stakeholders, including a nongeneralizable sample of insurers of different sizes providing various types of insurance.

With the support of a program established under the Terrorism Risk Insurance Act (TRIA) in which the federal government and insurers would share losses in the event of a certified act of terrorism, terrorism risk insurance is generally available and affordable in the United States. For example, the majority of commercial policyholders generally purchased terrorism risk insurance in recent years, according to Department of the Treasury (Treasury) data. The insurance market would be significantly disrupted without a loss-sharing program such as that established under TRIA. Specifically, insurers generally would not have to offer terrorism risk coverage and likely would charge higher premiums in the absence of a loss-sharing arrangement and cap on losses, according to GAO's review of policies and interviews with industry stakeholders, including insurers and insurer associations. Without access to affordable coverage, new building ventures could be delayed and employers could struggle to find affordable workers' compensation coverage.

Treasury has processes for certifying terrorist events and fulfilling claims under the program, but a lack of communication about aspects of Treasury's certification process could pose challenges for insurers.

Some industry stakeholders, such as insurers and representatives of insurer associations, raised issues about Treasury communications on certification. They cited confusion over why the 2013 Boston Marathon bombing was not certified when they clearly viewed it as a terrorist attack. These industry stakeholders also expressed concern that Treasury never communicated whether it was reviewing the event for certification or its reasons for not certifying it. Most insurers GAO interviewed said such lack of communication by Treasury again could lead to uncertainty about whether to pay claims, putting them at risk of violating state laws and their policyholder agreements.

TRIA regulations on certifying acts of terrorism include some public notification requirements but do not require Treasury to communicate when it is considering reviewing an event for certification.

One purpose of TRIA is to stabilize the insurance market after a terrorist attack. Public communication of when Treasury is considering an event for certification would reduce uncertainty about which claims insurers should pay and lessen potential disruptions to the market after an attack.

One step in determining when to certify an event is Treasury's consultation with offices in the Department of Homeland Security (DHS) and Department of Justice (DOJ) to obtain law enforcement, intelligence, and homeland security information. However, GAO found that DHS had a different understanding of its role in this staff consultation process, and Treasury had not documented agreements with either agency. By documenting agreements between Treasury and the two consulting agencies, Treasury can better ensure a smooth and timely certification process.

Once an event is certified as an act of terrorism, Treasury has a process for fulfilling claims that uses a web-based system developed and operated by a contractor. As of February 2020, the system had not yet been used because Treasury had not certified any acts of terrorism or paid claims under the program.

GAO is making three recommendations, including that Treasury publicly communicate when it is considering reviewing an event for TRIA certification and document agreements with both DHS and DOJ on the agencies' roles in the process. Treasury agreed with the recommendations.

After the terrorist attacks of September 11, 2001, insurers realized their  potential exposure to terrorism losses and generally stopped offering  terrorism risk coverage. As a result, in November 2002 Congress enacted  the Terrorism Risk Insurance Act (TRIA) in an effort to protect  businesses, ensure widespread availability and affordability of insurance  for terrorism risk, and respond to concerns about the effect on the U.S.  economy in the absence of such coverage. Originally scheduled to  expire at the end of 2005, TRIA was amended and reauthorized in 2005,  2007, 2015, and 2019. In this report, we refer to the 2002 act and the  subsequent reauthorizations collectively as TRIA. Policymakers and  insurance industry representatives have raised questions about the  capacity of the private sector to manage terrorism risk and the role of the  federal government in supporting the market for terrorism risk insurance.

TRIA requires the Department of the Treasury (Treasury) to administer a  program that would require the federal government to share some of the  losses with private insurers in the event of a certified act of terrorism. Not  all incidents of terrorism will trigger reimbursements under TRIA: the  Secretary of the Treasury must certify that an incident meets the criteria  of an act of terrorism as specified in TRIA. After an event is certified,  Treasury reimburses insurers for the federal share of losses, after  insurers have paid statutorily mandated deductibles. To date, Treasury  has not certified any event as an act of terrorism and has not paid any  insurer claims under the program.

You asked us to review the role of TRIA in the terrorism risk insurance  market, including the potential effects of not reauthorizing it, potential  improvements to program operations, and Treasury’s guidance on cyber  risks. This report examines (1) the current market for terrorism risk  insurance and TRIA’s role in the market; and (2) Treasury’s certification  and claims processes, and industry stakeholders’ views on these  processes, including guidance on cyber risk coverage.

To address these objectives we reviewed TRIA and implementing  regulations. We also reviewed prior GAO work on this topic. We  reviewed reports and interviewed officials from Treasury, the National  Association of Insurance Commissioners (NAIC), and the Congressional  Research Service. To gather perspectives of industry stakeholders, we  interviewed an academic, representatives from insurance trade  associations, a rating agency, and selected insurers. We selected a  nongeneralizable sample of five insurers to interview because they  provided terrorism coverage to businesses and reflected a mix of sizes  and types of insurance. We also reviewed reports and public statements  from these industry stakeholders.

To describe the current market for terrorism risk insurance we reviewed  annual Treasury reports on the program from 2017, 2018, and 2019, as  well as reports from industry stakeholders. We reviewed these reports for  information on affordability and availability of terrorism risk insurance,  including data on take-up rates, premiums, geographic coverage, and  trends over time. To describe stakeholder perspectives on TRIA’s role in  the market for terrorism risk insurance, we supplemented the interviews  noted above with a review of industry stakeholder reports and a review of  language in policies that would have excluded some terrorism coverage  in the event TRIA was not reauthorized.

To assess Treasury’s certification and claims processes, we reviewed  documentation on the certification process and interviewed agency  officials and the contractor responsible for the claims process. We also  reviewed Treasury reports on cyberterrorism coverage, including data on  take-up rates and direct earned premiums for cyberterrorism risks. We  interviewed officials from the Department of Homeland Security (DHS)  and Department of Justice (DOJ) about their role consulting with the  Secretary of the Treasury on certification decisions. We reviewed  documentation and interviewed officials from the United Kingdom’s (UK)  terrorism risk insurance program because this program requires  certification by a government entity to pay claims. We compared  Treasury’s certification process against criteria in federal internal control  standards on management communication. To determine how  cyberterrorism is covered under TRIA and in commercial policies, we  reviewed Treasury guidance and met with representatives of the  Insurance Services Office, a property/casualty insurance industry  association that develops standardized policy language, and reviewed its  standard policies for cyber insurance. See appendix I for more  information on our scope and methodology.

We conducted this performance audit from April 2019 to April 2020 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Congress passed TRIA in 2002 to address some of the challenges the  insurance industry and businesses faced after the September 11 terrorist  attacks. For example, after the attacks, insurers left the market, excluded  terrorism risk coverage from policies, or steeply increased premiums. The  Real Estate Roundtable reported in 2002 that nearly $16 billion of real  estate projects in 17 states were stalled or cancelled because of the lack  of coverage for terrorism risk (because many businesses are required to  have coverage for terrorism risk as a condition for a mortgage loan).

The purpose of TRIA is to (1) protect consumers by addressing market  disruptions and ensuring the continued widespread availability and  affordability of commercial property/casualty insurance for terrorism risk;  and (2) allow for a transitional period for private markets to stabilize,  resume pricing of such insurance, and build capacity to absorb any future  losses, while preserving state insurance regulation and consumer  protections.

By law, an insurer’s coverage for terrorism losses must not differ  materially from the terms, amounts, and other coverage limitations  applicable to losses arising from other events. For example, an insurer  offering $100 million in commercial property coverage also must offer  $100 million in commercial property coverage for certified acts of  terrorism. Insurers may charge a separate premium to cover their  terrorism risk. TRIA requires insurers to make terrorism coverage on  certain lines of property/casualty insurance (such as coverage for fire,  workers compensation, and liability) available to commercial policyholders  (such as businesses), although TRIA does not require commercial  policyholders to buy it.

The federal government does not collect an up-front charge from insurers  for the government’s coverage of terrorism risk under TRIA. In a 2019  report, we noted that the federal government has multiple programs that  can provide compensation to specific third parties if they suffer certain  losses from future adverse events, and the federal government may not  always charge premiums for accepting this risk of loss. However, under  TRIA, the government must recoup at least some of its losses following a  certified act of terrorism, as discussed below. TRIA has not caused  financial liabilities to the federal government, but it could require large,  previously unbudgeted expenditures by the federal government if an  event occurred.

Certification of an Act of Terrorism for Purposes of TRIA and Claims Processing

For insurers to start submitting claims and receiving payments to cover  terrorism losses, Treasury must first certify an event as an act of terrorism  under TRIA. Certification requires the Secretary of the Treasury to  evaluate the event based on two criteria:  1.  Did the event meet the nonmonetary definition established under  TRIA? Defining an event as an act of terrorism includes determining  whether it was “committed by an individual or individuals as part of an  effort to coerce the civilian population of the United States or to  influence the policy or affect the conduct of the United States  Government by coercion.” It also includes determining whether it was  a “violent act or an act that is dangerous” to human life, property, or  infrastructure, and whether it resulted in damage within the United  States or certain areas outside the United States. As part of this  determination, the Secretary of the Treasury must consult with the  Attorney General and Secretary of the Department of Homeland  Security before certifying an event.  2.  Did the event cause at least $5 million in insurance losses in  TRIA-eligible lines? TRIA prohibits the Secretary of the Treasury  from certifying acts of terrorism unless insurance losses exceed this  threshold.

In 2004 Treasury issued regulations to implement TRIA’s procedures for  filing insurer claims for payment of the federal share of compensation for  insured losses. Within 7 days after certification of an act of terrorism, a  Treasury contractor is to activate a web-based system for receiving  claims from insurers and responding to insurers that seek assistance.

The Terrorism Risk Insurance Program provides for shared public and  private compensation for insured losses resulting from certified acts of  terrorism. Under the current program, if an event were to be certified as  an act of terrorism and insured losses exceeded $200 million, an  individual insurer that experienced losses first would have to satisfy a  deductible before receiving federal coverage. An insurer’s deductible  under TRIA is 20 percent of its previous year’s direct earned premiums in  TRIA-eligible lines. After the insurer pays its deductible, the federal government would reimburse the insurer for 80 percent of its additional  losses and the insurer would be responsible for the remaining 20 percent.  Annual coverage for losses is capped––neither private insurers nor the  federal government cover aggregate industry insured losses in excess of  $100 billion.

After an act of terrorism is certified and once claims are paid, TRIA  requires Treasury to recoup part of the federal share of losses in some  instances. Under this provision, when insurers’ uncompensated insured  losses are less than a certain amount (up to $41 billion for 2020),  Treasury must impose policyholder premium surcharges on commercial  property/casualty insurance policies until total industry payments reach  140 percent of any mandatory recoupment amount. When the amount of  federal assistance exceeds this mandatory recoupment amount, TRIA  allows for discretionary recoupment.

Prior TRIA reauthorizations decreased federal responsibility for losses  and increased private-sector responsibility for losses, but the 2019  reauthorization of TRIA made few changes to the program. For instance,  the 2015 reauthorization required incremental decreases in the federal  share of losses over 5 years (to 2020). The 2019 reauthorization  extended the program to December 31, 2027 and proportionately  adjusted the dates by which the Secretary must recoup policyholder  surcharges to the new reauthorized time frame, but it did not change the  federal share of losses.

TRIA covers insured losses in eligible lines that result from a certified act  of terrorism (see table 1). Many lines of commercial property/casualty  insurance are eligible for TRIA, such as workers’ compensation, fire, and  commercial multiple peril (multiperil) lines. States generally require that  workers’ compensation insurance covers terrorism risk and do not permit  exclusions, including for terrorism, according to Treasury. Workers’  compensation covers an employer’s liability for medical care and physical  rehabilitation of injured workers and helps to replace these workers’ lost  wages. TRIA also excludes certain lines (such as personal property and  casualty insurance and health and life insurance).

Terrorism coverage typically is embedded in all-risk property policies but  also may be available in stand-alone policies, according to Treasury:

Embedded. Most policyholders have terrorism risk insurance  coverage embedded in a policy that covers other risks. Embedded  policies are subject to TRIA’s “make available” requirements. In the  event of a certified act of terrorism, policyholders would be covered if  they have not declined terrorism coverage.

Stand-alone. Stand-alone terrorism policies provide coverage only for  terrorism risks. Insurers may provide stand-alone terrorism coverage  through “certified” policies that are subject to TRIA terms and  conditions and provide coverage only in the event of a certified act of  terrorism. Alternatively, insurers may provide terrorism coverage  through “noncertified” policies that do not meet TRIA terms and  conditions. Such noncertified policies cover terrorism-related losses  regardless of whether Treasury certifies an event, but losses paid by  insurers would not be eligible for reimbursement under TRIA.

Nonconventional terrorism risks generally include nuclear, biological,  chemical, or radiological (NBCR) weapons, as well as cyber risks.  Predicting losses associated with nonconventional risks can be  particularly challenging because of the difficulty in predicting terrorists’  intentions and the potentially catastrophic losses that could result.

TRIA is silent on NBCR and cyber risks, but Treasury has clarified how  these nonconventional risks are covered under TRIA. In 2004, Treasury  issued an interpretive letter clarifying that the act’s definition of insured  loss does not exclude losses resulting from nuclear, biological, or  chemical attacks, and does not preclude Treasury from certifying a  terrorist attack involving such weapons. According to Treasury’s  interpretive letter, the program covers insured losses from NBCR events  resulting from a certified act of terrorism. However, for TRIA provisions to  apply, insurers must provide coverage for those perils. Most insurers are  not required to provide NBCR coverage and generally have attempted to  limit their exposure to NBCR risks by largely excluding NBCR events from  property and casualty coverage.

In December 2016, Treasury issued guidance clarifying that, to the extent  that insurers write cyber insurance in TRIA-eligible lines, the TRIA  provisions apply. We further discuss Treasury’s guidance on cyber risk  later in this report.

Program Administration and Reporting Requirements

TRIA authorizes Treasury to administer the Terrorism Risk Insurance  Program. The Secretary of the Treasury administers the program with the  assistance of Treasury’s Federal Insurance Office, according to Treasury  officials.

TRIA requires Treasury to conduct a biennial study of the effectiveness of  the program. The 2015 TRIA reauthorization added a requirement that  insurers submit information to Treasury about the coverage they write for  terrorism risk, including the lines of insurance with exposure to such risk,  the premiums earned on such coverage, and the participation rate for  such coverage. The 2019 reauthorization added a requirement that  Treasury report on the availability and affordability of terrorism risk  insurance, including an analysis specifically for places of worship. Since  2016, Treasury has completed annual assessments of the program,  including a report on the effectiveness of the program in June 2018.  Treasury’s reports focused specifically on small insurers in June 2017  and June 2019.

Treasury conducts an annual data call to collect information for the  required studies and for purposes of analysis and program administration.  Participation in the data call is mandatory for all insurers that write  commercial property and casualty policies in lines of insurance subject to  TRIA, subject to two exceptions. Treasury collects data separately for  the following four groups of insurers:

Small insurers have both a policyholder surplus and prior-year TRIA- eligible direct earned premium of less than five times the program  trigger.

Nonsmall insurers have policyholder surplus or the specified  premiums above the small threshold and are not classified as captive  or alien surplus line insurers.

Captive insurers are special-purpose insurance companies set up by  commercial businesses to self-insure risks arising from the owners’  business activities.

Alien surplus lines insurers are foreign insurers that are qualified to  do business in the United States through a process administered by  NAIC.

The Market for Terrorism Risk Insurance Is Currently Stable with the Support of TRIA

The market for terrorism risk insurance has been stable in recent years,  with coverage both available and generally affordable. According to our  reviews of policy language, reports from and interviews with Treasury,  researchers, insurers, and other industry stakeholders, the expiration of  TRIA and the absence of an alternative backstop to terrorism risk  insurance would cause disruptions to the market.

Terrorism Insurance Generally Is Available and Affordable in the United States

Reports from Treasury and an industry risk-management firm generally  suggest there has been a stable market for terrorism risk insurance in  recent years, with the coverage available and generally affordable in the  United States. According to Treasury’s reports analyzing industry data,  the majority of commercial policyholders in the United States purchase  terrorism risk insurance, and at a relatively small percentage of total  premiums. The market for terrorism risk insurance in the United States  continues to remain competitive for most buyers according to 2018 and  2019 reports by Marsh, an insurance risk-management firm. Marsh  attributed the competitive market for buyers to a steady decline in the  frequency of global terrorist incidents and minimal insurance claims.

Since all insurers must offer terrorism risk insurance, the availability of  such coverage can be measured in terms of take-up rates—the rates at  which policyholders select terrorism risk insurance. These rates have  remained stable in recent years, according to Treasury. However, take-up  rates vary by line of insurance, industry sector of the policyholder,  geographic location, and type of insurer writing the policies. Terrorism risk  coverage is considered available when insurers offer coverage for losses  resulting from a terrorism event, and take-up rates are an indication of how insurers are complying with TRIA’s “make available” requirement,  according to Treasury. Treasury found take-up rates by insurer category  ranged from 62 to 78 percent in its 2018 report, depending on how the  rates were measured. According to Marsh’s 2019 report, the take-up  rate for terrorism coverage embedded in policies that cover other risks  has been around 60 percent for the past several years.

Lines of insurance. According to Treasury’s 2018 report, take-up rates  across lines of insurance ranged from 43 percent in the products liability  line to 83 percent in the boiler and machinery line in 2017, as measured  by direct earned premium (see fig. 1).

The take-up rate for cyber insurance coverage is in the middle of the  range, relative to other lines of coverage. Specifically, the take-up rate in  2018 for terrorism risk insurance under cyber policies (by TRIA-eligible  direct earned premium) was 69 percent for stand-alone policies, up from  50 percent in 2017, as reported by Treasury. For coverage that is part of  an embedded policy, the 2018 rate was 63 percent, up from 54 percent in  the prior year.

Industry sectors. Take-up rates across the industry sectors of the  policyholders varied widely and ranged from 7 percent in the information  sector to 76 percent in the finance and insurance sector in 2017,  according to Treasury’s 2018 report (see fig. 2). Marsh found in its 2019  report that commercial policyholders in the education, media, financial,  and real estate sectors were the most frequent buyers of terrorism risk  insurance in 2018.

Geographic location. Take-up rates varied by location, with the highest  rates in the Northeast. In Treasury’s 2018 report, the rates ranged from  50 to 75 percent by state (see fig. 3). In its 2018 report, Marsh noted that  the Northeast had both the highest rate of purchase and the most  expensive coverage, and said that these trends were because of the  presence of major metropolitan areas (such as New York and Boston)  that have high-value targets for terrorism.

According to Treasury’s 2018 report, premiums associated with terrorism  coverage have remained relatively consistent in recent years and are a  small part of overall premiums for embedded policies. According to that  report, about 80 percent of the market (as measured by terrorism risk  direct earned premium) comprises embedded policies and 20 percent  stand-alone policies, and the price for each varies. Premiums for  terrorism risk insurance embedded in a property/casualty policy are  priced at a relatively small percentage of the total premium charged for  the policy and typically range from 2.5 to 3.0 percent when a charge is  made. In about 30 percent of policies, insurers do not charge for providing  terrorism risk coverage. Stand-alone policies vary significantly in terms of  cost because of differences in the relative size or nature of exposures  covered under each policy, whether the policy was certified, and the type  of insurer providing the coverage, according to Treasury’s data.

Premiums also varied across lines covered and insurer types, with the  most premium collected for workers’ compensation. According to  Treasury’s 2018 report, about 36 percent of the total premium collected in  TRIA-eligible insurance lines was for workers’ compensation. In stand- alone cyber policies an average 6.2 percent of the total premium was  allocated to terrorism risk. See table 2 for more information on how  premiums vary across lines of coverage.

Trends for small and captive insurers in many instances are different from  trends for nonsmall insurers.

Small insurers. Total market share for small insurers within TRIA-eligible  lines of coverage declined, relative to nonsmall insurers, over the past  decade. The small insurer market share, as measured by direct earned  premium, fell from 18.6 percent in 2009 to 12.6 percent in 2018. (Despite  that overall decline, there was an increase from 2016 to 2018 as more  insurers were defined as small because of the increased dollar amount of  the program trigger). In addition, take-up rates tended to be lower for  policies written by small insurers, compared to nonsmall insurers, both  within most individual lines and across the overall market.

Small insurers generally charged less premium for terrorism risk  insurance overall than nonsmall insurers, although they may charge  proportionally higher premiums in some lines of insurance, such as  commercial multiple peril (liability). According to Treasury’s 2019 report,  small insurers allocated a lower percentage of direct earned premium for  terrorism risk than nonsmall insurers. Furthermore, small insurers also  were more likely to offer terrorism risk insurance for free. In addition,  small insurers earned a higher percentage of their total program direct  earned premium in commercial multiple peril and workers’ compensation  lines than did nonsmall insurers. The workers’ compensation market is  subject to very high loss amounts with no defined limits of liability and  significant potential aggregation risks.

Captive insurers. Like small insurers, captive insurers often have  premiums that are small, relative to other insurer categories. However,  captive insurers generally can offer broader coverage than commercial  policies, according to Marsh’s 2019 report. The report states that a  captive insurer often offers policies that cost less than policies from  commercial insurers, which also often restrict coverage for NBCR or  cyber events. In addition, according to Treasury a highly concentrated  event affecting only captive insurers (or small insurers) carries a higher  likelihood that the affected insurers’ losses would not meet the program  trigger, and therefore would not be reimbursed under the program. In this  case, captive insurers could incur significant losses.

Absence of Federal Program Could Disrupt Markets Based on Analysis of Policies and Selected Stakeholder Perspectives

There could be significant disruptions to the insurance market if no  federal terrorism risk insurance program existed, according to our reviews  of policy language, reports from and interviews with Treasury,  researchers, insurers, and other industry stakeholders. As Marsh noted  in its 2019 report, TRIA’s federal backstop remains crucial to the  continued stability of the terrorism risk insurance market. In its 2018  report, Treasury concluded that TRIA had made the coverage available  and affordable, supporting a relatively stable market over the past  decade. According to NAIC, TRIA helps foster the existence of a broader  market for risks that otherwise would be either largely uninsured or borne  by taxpayers.

In the absence of a loss-sharing program, insurers likely would limit  coverage, exit certain markets, or attempt to increase capacity, according  to our review of reports from the federal government, researchers,  industry entities, and interviews with industry stakeholders. For example:  Limiting coverage. Most insurers begin the process to limit their  coverage more than a year before any TRIA expiration by filing  conditional exclusions, which, in effect, limits terrorism risk coverage in  the event TRIA expired. According to one industry association, insurers  have filed conditional exclusions before each of TRIA’s reauthorizations,  although they are not commonly used for policies more than a year away  from a potential expiration of the law.

Our analysis of several policy endorsements filed with conditional  exclusions suggests that, in the event of TRIA’s expiration, insurers likely  would limit the total losses associated with an attack, and exclude certain  types of terrorist attacks. We reviewed a nongeneralizable sample of  conditional exclusions provided by the Insurance Services Office, which  representatives say are widely used in the industry, and several selected  conditional exclusions from individual insurers. These policies suggest  that insurers filing conditional exclusions cap coverage for losses  associated with an attack at $25 million, and entirely exclude losses  caused by NBCR weapons. One policyholder association said that TRIA’s  potential expiration and the need to file conditional exclusions results in a  chaotic process, with insurers needing to file exclusions in each state in  which they operated.

Exiting markets. In the absence of a loss-sharing program, some  insurers likely would exit certain markets, no longer offering terrorism  coverage in specific geographic locations or lines of insurance, according  to federal and industry reports and interviews with stakeholders. Small  and midsize insurers in particular may withdraw from providing terrorism  risk coverage entirely, according to one industry association.

Furthermore, insurers providing NBCR or workers’ compensation  coverage may decide to limit the policy terms or stop providing coverage,  because of the risk of increased losses and potential exposures,  according to Treasury. In addition, workers’ compensation risks are  greater in large, metropolitan, more densely populated areas, and there  are higher aggregation risks for insurers in large metropolitan areas,  particularly for events involving NBCR weapons. Small insurers tend to  operate on a regional basis in a smaller number of states than nonsmall  insurers, and thus have a significant presence in individual local markets,  according to Treasury.

Options for increasing capacity. Insurers told us that they also likely  would increase their premiums and purchase additional reinsurance for  terrorism coverage in the absence of a program, although their ability to  do so may be limited. One insurer said that premiums likely would go up  significantly, although rate increases are subject to state limits. According  to another insurer, reinsurance coverage for terrorism risk likely would  become more limited, and be provided at notably higher rates. Insurers  that are public companies may be able to increase capital through the  stock market to build loss-absorbing capacity to help mitigate their  increased loss exposures if TRIA expired. However, mutual insurers are  not owned by shareholders and therefore cannot raise capital through the  sale of shares; instead, they would have to rely on other ways of building  capital.

Several industry stakeholders pointed to particular challenges for certain  insurers and lines of coverage if TRIA expired and Congress did not  establish another loss-sharing program.

Small insurers. Small insurers may be particularly vulnerable, facing  ratings downgrades or otherwise being forced to exit the market for  terrorism risk coverage, according to industry stakeholders. In May  2019, AM Best, a credit rating agency that focuses on the insurance  industry, said insurers that did not limit exposure to terrorism risk  losses before TRIA’s potential expiration in 2020 could face negative  ratings pressure. AM Best identified 30 insurers (of about 230 with  significant terrorism risk exposure) that failed stress tests, but said in  October 2019 that implementation of plans established by these  insurers would mitigate concerns about insolvency in the event TRIA  expired and a terrorist attack occurred. The 30 insurers generally  were small or midsize insurers.

Captive insurers. Captives (entities that businesses set up to self- insure) generally require private reinsurance to insure against  terrorism risk, and it is unclear if there would be sufficient capacity in  the reinsurance market to obtain this coverage without TRIA. Captives  tend to insure against a broader range of risks, including NBCR and  cyber risks, when that coverage is unavailable or unaffordable in the  market. One industry association representing captive insurers noted  that captive insurance likely would become a more common way to  insure against terrorism risk without a federal loss-sharing program.  However, it warned that captive insurers may lack the capacity to  ramp up operations quickly enough or secure the necessary  reinsurance to fully absorb the risk of increased losses.

NBCR coverage. Coverage for terrorism attacks involving NBCR  weapons, which is already limited, would be further limited without a  federal loss-sharing program, according to industry stakeholders. One  industry association of insurance agents said that insurers’ capacity to  absorb losses from such an attack would be a challenge without a  backstop, as it was during the aftermath of the September 11 attacks,  when there was very little capital devoted to coverage for terrorism  risk. The representatives said this capacity would be even more  limited for an NBCR attack, as losses could be significantly greater  and few insurers offer NBCR coverage.

Workers’ compensation coverage. The cost of coverage for  workers’ compensation likely would increase significantly and  availability likely would decrease without a federal loss-sharing  program, according to researchers. Insurers have less flexibility to  control terrorism exposure in workers’ compensation coverage,  relative to other TRIA-eligible lines, according to Treasury. As noted  earlier, state laws require employers to have the coverage and  prohibit insurers from excluding terrorism risk, including NBCR risks,  from workers’ compensation policies, according to Treasury. Insurers  might respond to the absence of a federal loss-sharing program by  not providing workers’ compensation coverage to employers,  particularly those near high-risk targets in major metropolitan areas,  according to a 2014 RAND Corporation policy brief issued before  TRIA’s 2014 expiration. The brief added that this would force high-risk  employers in these areas to obtain the required coverage from the  residual market (state-run insurers or mechanisms of last resort), in  which premiums are higher.

In addition, the absence of a loss-sharing program could disrupt  policyholders and the greater economy by stalling new building projects.  Some stakeholders noted concerns that new building projects might be  stalled if the law expired, similar to concerns in the weeks and months  following the September 11 terrorist attacks. At that time, policymakers  were concerned that the reduction in coverage by insurers uncertain of  future losses would render commercial developers in high-risk areas  unable to finance their projects, according to a report by the  Congressional Budget Office. An insurance industry association told us  businesses might find it difficult to obtain terrorism risk insurance,  particularly for high-value projects in cities considered high-risk, such as  New York and Washington, D.C.

Treasury Has Certification and Claims Processes but Communication on Certification Is Limited

Treasury has a process to certify acts of terrorism. However, industry  stakeholders said Treasury does not publicly communicate information  about the process and the lack of timely information might negatively  affect the speed with which insurers respond to policyholder claims.  Additionally, Treasury is to consult with DOJ and DHS but DHS’s  understanding of its role during the certification process appears  inconsistent with Treasury’s purpose, and no agreements document  these roles. Treasury also has a process to pay insurer claims and has  issued guidance concerning how cyber insurance is treated under TRIA.

Treasury Incorporated Flexibility into Its Certification Process

Treasury has established a process for certifying an event as an act of  terrorism that provides the Secretary a flexible time period for gathering  information after an event. Before insurers may submit claims under  TRIA, the Secretary must certify an event as an act of terrorism.  Congress directed Treasury to study the certification process in the 2015  reauthorization of TRIA, including the establishment of a “reasonable  timeline” for a certification determination. In response, Treasury sought  and received public comments on the process. Treasury issued its  conclusions in an October 2015 report. According to this report, seven of  the nine comments received recommended Treasury adopt a timeline  governing the certification decision. But Treasury concluded the  certification process must provide the Secretary with flexibility to gather  information after an event, and thus a “rigid” timeline for certification  would not be appropriate. Instead, Treasury concluded that “enhanced  public communication” about the status of the Secretary’s assessment of  an act may address commenters’ concerns. Treasury established an  interim final rule for the certification process in December 2016.

Treasury’s process for certification decisions includes an internal review  phase and a public review phase before Treasury can make a  determination (see fig. 4).

Internal review phase. During this phase, Treasury establishes and  convenes a certification management team and prepares a brief for  the Secretary, according to interviews with agency officials and our  review of Treasury documents. Treasury may conclude the internal  review of an event without progressing to the public review phase.

Public review phase. The public phase of the certification process  includes communication requirements set by Treasury’s certification  regulations. TRIA regulations direct that within 30 days of the  Secretary commencing review of an event, Treasury must publish a  notice in the Federal Register informing the public that an act is under  review for certification. Treasury also may publish a notice that it is not  reviewing an act for certification. The regulation does not establish a  timeline by which the Secretary must begin reviewing an event, which  leaves the timeline for certification flexible. Treasury’s public  announcement that an event is under review begins a series of  requirements for public notification and consultation with other  agencies, according to TRIA regulations. As of March 2020, Treasury  has not conducted the public review phase of its certification process.

When the Secretary of the Treasury’s review concludes that an act  satisfies the elements of certification, the Secretary then is to consult with  the Attorney General and the Secretary of Homeland Security within 30  days, or as soon as practicable. According to our review of Treasury  documents, this Secretary-level consultation is to occur immediately  before Treasury issues a certification decision. According to interviews  with officials and Treasury documents, Treasury engages with staff in  specific offices in DHS and DOJ much earlier in the process, during the  internal review phase. Coordination with officials in these offices  continues throughout both phases of the certification process. For  example, Treasury documents state it may hold conferences with DHS  and DOJ to discuss factors relevant to making a recommendation to  certify an event.

No later than 5 business days after the certification determination,  Treasury must publish a statement in the Federal Register notifying the  public.

By contrast, the UK’s terrorism risk insurance program publicly  communicates clear timelines by which government entities must certify  potential events. The UK Treasury has 21 days to certify an event once  the program administrator requests a formal review. This deadline was  extended from 10 days in 2015 to allow the police enough time to  determine if an event met the definition of terrorism, according to UK  Treasury officials. This timeline was chosen to balance providing time for  certification with ensuring that businesses would see claims paid quickly.  Regular communication with industry stakeholders after an event  maintains confidence in the certification process, they said.

Treasury’s Internal Review Phase Generally Not Publicly Communicated

Treasury’s procedures for certifying an event do not include public  communication of its internal review phase. Steps Treasury is to take  during this internal review stage include establishing and convening a  certification management team and preparing a brief for the Secretary,  according to interviews with agency officials and our review of Treasury  documents.

To date, Treasury has not communicated to industry stakeholders  whether it was reviewing events as possible acts of terrorism. Treasury  officials told us that after events have occurred, they have looked into the  circumstances and the amount of insurance losses caused. These  considerations did not progress past the internal review phase of the  certification process, which meant Treasury did not publicly communicate  that it was reviewing these events for certification. For example, Treasury  conducted internal reviews after the Boston Marathon bombing in 2013,  but Treasury did not publicly communicate that it was looking into the  event or that it had decided not to formally review the event for  certification. Treasury ultimately did not certify the event because insured  losses from the bombing on TRIA-eligible lines of insurance totaled $2.1  million, which was under the $5 million certification threshold, according  to Massachusetts state insurance officials.

In interviews and formal public comments on Treasury’s proposed  certification rule, some industry stakeholders said the Boston Marathon  bombing raised questions about the certification process because they  viewed the event as a clear terrorist attack. It was unclear to some  industry stakeholders if the event was not certified because it did not  reach the monetary loss threshold for certification, which was unknown at  the time, or because it did not meet TRIA’s nonmonetary requirement for  establishing intent. Insurers and industry stakeholders told us they were  uncertain about the length of time Treasury would take after future events  to communicate that it was considering certification. All five insurers we  interviewed said they would like improved communication from Treasury  after an event like the Boston Marathon bombing.

Treasury officials said that in response to the Boston Marathon bombing,  they documented procedures for certification. However, these procedures  do not include steps to communicate publicly during the internal review  phase, according to our review of Treasury documents. If a future event  analogous to the Boston Marathon bombing were to occur, under  Treasury’s current procedures it would not communicate the status of its  internal review publicly, and public communication would not occur if it  chose to conclude its review before the public review phase began.

Implication of Certification of an Act of  Terrorism for Terrorism Risk Insurance Act  (TRIA) Coverage   TRIA is designed to share losses from a  certified act of terrorism between insurers and  the government. For insurers to receive  support from this federal backstop, they must  offer insurance for “acts of terrorism” defined  in a manner consistent with the law, which  requires certification by the Secretary of the  Treasury. A certification determination affects  policyholders differently, depending on if they  purchased or declined terrorism coverage.  Specifically, insurers would pay claims from  policyholders that purchased terrorism  coverage in the event of a certified act of  terrorism, whereas insurers would not pay  claims from policyholders that declined  terrorism coverage. Insurers could face  uncertainty about whether to pay claims on  both policy types, however, if the Secretary of  the Treasury does not make a certification  determination. This is because the definition  of an act of terrorism in insurance policies for  both policy types is often linked to  certification.

Industry stakeholders and insurers we interviewed said they need to know  whether Treasury is considering certifying an event to help provide  certainty in paying policyholder claims and receiving reinsurance  payments (see sidebar).

Policyholder claims. Industry stakeholders and four of five insurers  we interviewed said Treasury’s lack of communication about an  event’s potential certification can lead to uncertainty about whether to  pay claims on policies—both those that include and exclude terrorism  coverage. Delays in paying claims while waiting for communication  about certification put them at risk of violating their agreements with  policyholders and state laws, they said. Insurance policies typically  have timeline requirements for the insurer to investigate and pay  claims, and some state laws require insurers to pay claims by a  certain date, according to NAIC. Treasury officials said state  requirements to pay claims by a certain date may receive extensions  under state regulation when uncertainty requires that a claim  investigation continue. One insurer with which we met said that a  statement from Treasury when it was considering an event would help  them determine whether to pay claims or not.

Reinsurance. Industry stakeholders said uncertainty would delay  reinsurance coverage. If insurers delayed paying policyholder claims  because of uncertainty about certification of a terrorist attack,  reinsurers also might delay payments to insurers. Reinsurance  payments are often triggered by the insurer’s payment of a claim to  the policyholder. Additionally, some reinsurance contracts may define  terrorism specifically as a Treasury-certified act of terrorism, and may  be contingent on Treasury making a certification determination.

The goals of TRIA are to foster market stability and to protect consumers  by addressing market disruptions. In addition, according to federal  standards for internal control, management should externally  communicate the necessary quality information to achieve the entity’s  objectives, including communicating with external parties.

Treasury officials said they have not chosen to set a deadline for public  communication after a potential terrorist event because they need  flexibility to collect accurate information about events whose  circumstances can vary widely. In the preamble to its interim final rule on  certification, Treasury concluded that public communication about the  certification process provides the public with necessary information while  avoiding the problems Treasury raised with establishing a strict timeline.

However, Treasury’s internal review phase includes no public  communication. Additionally, Treasury may conclude its review of an  event without progressing to the public review phase and therefore may  not issue any public communications on the event. Without public  communication about when it is considering certification, Treasury risks  contributing to market uncertainty rather than stability after an attack.

Treasury Consults with DOJ and DHS, but No Agreements Document the Agencies’ Roles

TRIA requires cabinet-level consultation with DOJ and DHS in the public  review phase of the certification process, but Treasury officials also  conduct staff-level consultations. Treasury officials consult with DOJ’s  National Security Division and DHS’s Support Anti-terrorism by Fostering  Effective Technologies (SAFETY) Act office during the internal review  phase of the certification process and have identified a single point of  contact in each office (see sidebar).

Consultation Agencies  The Department of the Treasury consults with  two other federal offices in the Department of  Homeland Security (DHS) and the  Department of Justice (DOJ), respectively,  that have the following responsibilities:   The Support Anti-terrorism by Fostering  Effective Technologies (SAFETY) Act  Office in DHS provides liability  protections to manufacturers and sellers  of specified anti-terrorism technologies.  The Office of SAFETY Act  Implementation reviews if an attack  meets the SAFETY Act definition of an  act of terrorism and if terrorists use such  technology in the course of an attack,  according to DHS officials. The  Secretary of Homeland Security then  determines whether an act has met the  size and intent definitions of the SAFETY  Act.

DOJ’s National Security Division also  makes recommendations for the  International Terrorism Victim Expense  Reimbursement Program, which  provides funds to compensate victims of  international terrorism occurring outside  the United States. The Assistant  Attorney General for National Security, in  consultation with the National  Counterterrorism Center, then  determines whether to certify an event  for the program, according to DOJ  officials. determine whether an event meets TRIA’s definition of an act of  terrorism. Such information might include things like who claimed  responsibility for the event or evidence of the motivation for the attack.  Officials said they provide this information upon request within 24  hours after an event. DOJ officials said the process they use to review  events for TRIA purposes is similar to that used for DOJ’s  International Terrorism Victim Expense Reimbursement Program.

In contrast, DHS officials said their office does not provide information  about an event to Treasury for purposes of certification, and that they  believed DOJ would have the majority of this information. They said  DHS informs Treasury about whether the event is being reviewed for  the purposes of the SAFETY Act and whether terrorists used SAFETY  Act-qualified technology (see sidebar). DHS officials said this is the  information Treasury has requested from them and they consult with  Treasury because many applicants for SAFETY Act designations  have insurance policies backed by TRIA.

Treasury officials stated that that they expect these two DHS and DOJ  offices to serve as a single point of contact and coordinate with other  relevant offices in their agencies as needed. DOJ officials confirmed  they see this as their role, and said they would work with other offices  in DOJ, including the Federal Bureau of Investigation, to consult with  Treasury on certifying an act of terrorism. However, DHS officials said  they do not see this as their role.

The Secretary of the Treasury must consider, along with monetary  requirements, the nature and motivation behind a potential terrorist attack  to determine if it meets TRIA’s definition of an act of terrorism, according  to TRIA regulations. Coordination among Treasury, DOJ, and DHS allows  the Secretary access to critical and timely information relevant to  certification, according to Treasury. In addition, according to federal  internal control standards, management should use quality information to  achieve the entity’s objectives, which includes identifying information  requirements and obtaining relevant data from reliable sources in a timely  manner. The standards also state that agencies should use methods  such as written documentation to internally and externally communicate  the information needed to achieve their objectives.

In addition, our 2009 report on disaster planning provides an example of  the benefits of clearly defined roles among federal agencies. We reported  that defining the roles and responsibilities of stakeholders prior to a  disaster could help foster collaboration, and that effective recovery plans  should identify specific roles and responsibilities among various  stakeholders.

However, Treasury has not documented DOJ’s and DHS’s roles in  certification consultations and instead relies on informal relationships with  agency staff. This may contribute to the different perspectives DHS  officials had on their role in the process. Treasury officials said although  they do not have a written agreement, each agency understands its  obligation to consult with Treasury in light of TRIA’s provisions requiring it.  Although each agency told us it understood the certification process, DHS  officials and Treasury differed in their understanding of DHS’s role in  certification.

A documented agreement among the agencies would provide procedures  on roles and information sharing to which to refer during the potentially  chaotic aftermath of a terrorist attack. As agency staff change over time,  documenting these roles and information sharing among Treasury, DOJ,  and DHS could help ensure continuity of operations if future events  occurred. Furthermore, a written agreement would help Treasury access  quality information and help ensure a smooth and timely process for  certifying events under TRIA.

Treasury Has Developed and Tested a Process for Fulfilling Insurer Claims for the Federal Share of Losses

Treasury has a process for fulfilling claims that uses a web-based system  developed and operated by a contractor. Once the Secretary certifies an  act of terrorism, Treasury is to issue a task order to the contractor, which  is to make the claims website operational within 7 business days,  according to its contract. The claims process begins for insurers when  their total insured losses exceed 50 percent of their deductible within a  calendar year, at which point insurers must submit a form notifying  Treasury. An insurer may claim the federal share of compensation when  its total insured losses exceed its deductible for a calendar year,  according to TRIA regulations.

The responsibilities of Treasury’s contractor include  reviewing and testing the web-based claims system; activating and providing ongoing operation of the claims system;  receiving and reviewing insurers’ required documents for  completeness and accuracy; obtaining information from insurers as needed and answering  questions by email and telephone; and  recommending Treasury pay claims.

Treasury’s contractor has developed operating guidelines that detail work  flows and controls for how it will begin processing claims. The operating  guidelines include a plan to transfer existing staff from other  responsibilities to operate the claims process, as needed. According to  the contractor, staff responsible for processing claims in the event of a  certified terrorist attack participate in an annual training session.  Treasury’s contractor also built quality checks within its web-based  system to automatically review submissions.

Moreover, Treasury’s contractor has tested the web-based claims  system. The contractor said it completed more than 40 rounds of  readiness testing since 2004. The contractor must conduct readiness  testing at least three times a year and test contingency plans and disaster  recovery procedures at least annually, according to the contract.

In addition, Treasury’s contractor developed a demonstration website that  is publicly available (see fig. 5). Of the five insurers GAO interviewed, one said it used the demonstration website, two said they had not, and two  were unsure if anyone in the company had used the website. The  contractor said they previously have invited insurers to participate in  testing. The website outlines the general claims process and includes the  forms insurers would submit in the event of a certified terrorist attack.

Most industry stakeholders who were familiar with the claims process told  us they found it to be clear. Those stakeholders who were unfamiliar with  the process said they had no concerns about it at present. Of the five  insurers we interviewed, three said the only concern they had regarding  the claims process is how quickly Treasury would certify an event and  pay insurers’ claims. One insurer said the claims process was clear, and  one said it was unable to comment because it had not tested the process.

Guidance on Cyber Coverage under TRIA Is Clear to Selected Industry Stakeholders

In December 2016 Treasury issued guidance clarifying that, to the extent  that insurers write cyber insurance under an embedded or stand-alone  policy in TRIA-eligible lines, the TRIA provisions apply. In our May 2014  report, we found insurers were uncertain about whether TRIA covered  risks from a cyberterrorism attack, and recommended that Treasury  clarify whether losses that may result from cyberterrorism were covered  under TRIA. Treasury’s 2016 guidance included three elements:  1.  Treasury considers cyber policies that are reported under the “cyber  liability” line for state regulatory purposes to be “property and  casualty” insurance under TRIA, and therefore eligible for payment of  the federal share of compensation in the event of a certified terrorist  attack.  2.  Policies only would be eligible if insurers made the same required  disclosures to policyholders about the program as other TRIA-eligible  lines.  3.  Treasury requires insurers to provide disclosures and offers that  comply with TRIA and the program regulations on any new or renewal  policies reported under the cyber line.

Industry stakeholders said that Treasury’s guidance about cyber  insurance coverage under TRIA was clear. Some industry stakeholders  said that there was some initial confusion about the guidance because it  indicated the NAIC created a new line for cyber liability on the property/casualty annual statement, although this was not the case.  According to NAIC representatives, changes were made to how  insurance products were coded for rate-filing purposes, and these  changes did not affect the lines of business reported on the  property/casualty annual statement state page. Treasury officials said  there may have been some ambiguity in how they communicated the  2016 guidance. NAIC representatives said despite this initial confusion,  the industry understood the guidance.

Industry stakeholders said that questions remain about what type of  cyberattack Treasury would certify as an act of terrorism. TRIA’s definition  of an act of terrorism requires an act “to have been committed by an  individual or individuals as part of an effort to coerce the civilian  population of the United States or to influence the policy or affect the  conduct of the United States government by coercion.” However,  according to industry stakeholders and industry analysts, the nature of a  cyberattack means that tracing and attributing the event to an individual is  difficult. Additionally, generally the Secretary of the Treasury may not  certify an act if it is committed as part of a war declared by Congress. The  Advisory Committee on Risk-Sharing Mechanisms, which provides  recommendations to the Federal Insurance Office about risk sharing for  terrorism losses, has been researching issues related to cyberterrorism  insurance. According to this advisory committee, this group will provide  Treasury with recommendations regarding this and other issues in spring  2020.

Since shortly after the attacks of September 11, 2001, the Terrorism Risk  Insurance Program has helped to ensure stability in the market for  terrorism risk insurance, with the coverage generally available and  affordable. However, insurers and policyholders are not aware of  whether, and through what process, Treasury considers certifying an  event as a terrorism event. Without public communication about when it is  considering certification, Treasury risks contributing to market uncertainty  rather than stability after an attack.

The purpose of Treasury’s required consultation with DHS and DOJ in  certifying an event is to provide Treasury the necessary law enforcement,  intelligence, and homeland security information within the two agencies’  authorities and jurisdictions. However, DHS’s understanding of its role in  the internal review phase of the certification process appears to differ  from this stated purpose. Treasury has established and maintained  informal connections with both agencies, but it has not documented these  roles. By documenting agreements between Treasury and the two  consulting agencies, Treasury can obtain quality information to help  ensure a smooth and timely certification process.

We are making the following three recommendations to Treasury:  The Director of the Federal Insurance Office should publicly communicate  information about when it is considering certifying an event as an act of  terrorism under TRIA. (Recommendation 1)

The Director of the Federal Insurance Office should document an  agreement with DHS about DHS’s role, and how the agencies share  information, during the process of certifying an event as an act of  terrorism under TRIA. (Recommendation 2)

The Director of the Federal Insurance Office should document an  agreement with DOJ about DOJ’s role, and how the agencies share  information, during the process of certifying an event as an act of  terrorism under TRIA. (Recommendation 3)

We provided a draft of this report to Treasury, DOJ, DHS, and NAIC for  review and comment. DOJ and NAIC did not have any comments.  Treasury provided written comments through the Federal Insurance  Office, which are reproduced in appendix II and discussed below.  Treasury and DHS provided technical comments, which we incorporated  as appropriate and discuss below. We also solicited and received  technical comments from the UK Treasury and incorporated them as  appropriate.

In its written comments, Treasury agreed with our three recommendations  and described how it would address them. In response to our first  recommendation, Treasury stated that it will consider potential changes to  the certification process in conjunction with the results of the review by  the Advisory Committee on Risk-Sharing Mechanisms of certification  procedures (due in spring 2020). In response to our second and third  recommendations, Treasury said that it will further coordinate with DOJ  and DHS on their respective roles and evaluate any additional steps to  clarify their roles in investigating potential events.

In technical comments, DHS questioned our characterization of its role  during the certification process. DHS reiterated that it would provide  Treasury with information on how DHS handles an incident in relation to  the DHS SAFETY Act process, and not information regarding any  possible investigation of a terrorist event. DHS stated that this is the  information Treasury requested from the office for potential events in the  past. However, we found that Treasury has not documented the type of  information it expects from each agency during its internal review phase  and maintain that information related to the DHS SAFETY Act process is  inconsistent with Treasury’s purpose for consultation—to obtain law  enforcement and intelligence information. We maintain that documenting  the information Treasury expects from each agency would ensure that  Treasury obtains the information it needs to make a certification decision.

We are sending copies of this report to the Secretary of the Treasury, the  Acting Secretary of Homeland Security, the Attorney General, and other  interested parties. In addition, the report is available at no charge on the  GAO website at https://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-8678 or garciadiazd@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix III.

In this report, we use “TRIA” to refer to the Terrorism Risk Insurance Act  of 2002 and its subsequent reauthorizations. The objectives of our report  were to examine (1) the current market for terrorism risk insurance and  TRIA’s role in the market; and (2) the Department of the Treasury’s  (Treasury) certification and claims processes, and industry stakeholders’  views on these processes, including guidance on cyber risk coverage.

To address these objectives, we reviewed the Terrorism Risk Insurance  Act of 2002; Terrorism Risk Insurance Extension Act of 2005; the  Terrorism Risk Insurance Program Reauthorization Acts of 2007, 2015,  and 2019; and implementing regulations, and congressional records. We  also reviewed prior GAO work on this topic. We interviewed officials from  the Treasury, National Association of Insurance Commissioners (NAIC),  and Congressional Research Service and reviewed relevant reports from  these entities. We also interviewed and reviewed reports from an  academic researcher and several industry participants to obtain  information for all our objectives, including insurers, representatives from  insurance trade associations (representing insurers, reinsurers, mutual  insurers, and captive insurers), risk modeling firms, and a rating agency.

Specifically, we obtained information from five insurers. In all interviews,  we asked participants about the potential effects of TRIA’s expiration on  terrorism risk coverage, the effect of changes to the program from 2015 to  2020, and their views on Treasury’s certification and claims process, and  guidance on coverage for cyberterrorism. We initially contacted eight  insurers—four from among the largest U.S. commercial property and  casualty insurers in TRIA-eligible lines of business (according to SNL  Financial) and four smaller insurers previously recommended by  insurance brokers and trade associations during prior GAO work. Five of  these eight insurers, all of whom provided terrorism coverage to  businesses, responded to our request and agreed to meet with us.  Among these five insurers, two were large, two were small, and one was  a captive insurer; two provided workers’ compensation and one provided  cyber risk coverage. We determined that the information we obtained  from these five insurers was sufficient for the purposes of obtaining a  range of views of the market, but it is not generalizable to the practices of  other insurers not included.

To describe the current status of the market for terrorism risk insurance  and how the market might be affected if TRIA were to expire, we  reviewed annual Treasury reports on the program from 2017, 2018, and  2019, as well as reports from Marsh, an insurance risk-management firm,  and other industry stakeholders. We reviewed these reports for  information on affordability and availability of terrorism risk insurance,  including data on take-up rates, premiums, geographic coverage, and  trends over time. We also reviewed language in insurance policies that  excluded some terrorism coverage in the event that TRIA was not  reauthorized.

To assess Treasury’s certification and claims processes, we reviewed  documentation on the certification process, including Treasury’s internal  policies and websites. We interviewed agency officials and the contractor  responsible for operating the claims process after a certified terrorist  attack, and we reviewed Treasury’s contract with this operator and the  contractor’s internal policies. We also interviewed officials from the  Departments of Homeland Security and Justice regarding their role in  consulting with the Secretary of the Treasury on certification decisions.  We reviewed relevant documents from the Organisation for Economic Co- operation and Development and relevant industry reports from four  foreign countries with terrorism risk insurance programs: Australia,  Belgium, Israel, and the United Kingdom (UK). We selected these  countries because their terrorism risk insurance programs require  certification by a government entity to pay claims. We interviewed the  terrorism risk insurance pool operator and the certification entity for the  UK because this program includes a short (21-day) timeline for certifying  terrorist events. Additionally, we interviewed and reviewed documentation  from a U.S. company that provides loss estimates, primarily to the  insurance-linked securities market, which investors use to determine if a  catastrophe bond has been triggered by an event. We compared  Treasury’s certification and consultation process against criteria in federal  internal control standards on management communication.

To determine how cyber terrorism is covered under TRIA and in  commercial policies, we reviewed Treasury guidance. We also met with  Treasury officials and representatives of the Insurance Services Office, a  property/casualty insurance industry association that develops  standardized policy language, and reviewed its standard policies for cyber  insurance. We also reviewed Treasury reports on cyberterrorism  coverage, including data on take-up rates and direct earned premiums for  cyberterrorism risks.

We conducted this performance audit from April 2019 to April 2020 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Appendix II: Comments from the Department of the Treasury

Appendix III: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Jill Naamane (Assistant Director),  Nathan Gottfried (Analyst in Charge), Anna Blasco, William R. Chatlos,  Giselle Cubillos-Moraga, Kaitlan Doying, Karen Jarzynka-Hernandez,  May Lee, Barbara Roesmann, Jessica Sandler, Jena Sinkfield, and  Rachel Whitaker made significant contributions to this report.

Terrorism Risk Insurance: Market Challenges May Exist for Current  Structure and Alternative Approaches. GAO-17-62. Washington, D.C.:  January 12, 2017.

Terrorism Risk Insurance: Comparison of Selected Programs in the  United States and Foreign Countries. GAO-16-316. Washington, D.C.:  April 12, 2016.

Terrorism Insurance: Treasury Needs to Collect and Analyze Data to  Better Understand Fiscal Exposure and Clarify Guidance. GAO-14-445.  Washington, D.C.: May 22, 2014.

Terrorism Insurance: Status of Coverage Availability for Attacks Involving  Nuclear, Biological, Chemical, or Radiological Weapons. GAO-09-39.  Washington, D.C.: December 12, 2008.

Terrorism Insurance: Status of Efforts by Policyholders to Obtain  Coverage. GAO-08-1057. Washington, D.C.: September 15, 2008.

Terrorism Insurance: Implementation of the Terrorism Risk Insurance Act  of 2002. GAO-04-307. Washington, D.C.: April 23, 2004.

Terrorism risk insurance can help businesses rebuild after damage from a terrorist attack. If coverage is expensive or hard to get, new building ventures and other business can be delayed.

A federal program was created after 9/11 to make this insurance available and affordable—with the government and insurers sharing losses from certified acts of terrorism. Now, the terrorism insurance market is stable. But there’s some uncertainty about when the Treasury Department considers certifying events as terrorism for insurance purposes.

Our 3 recommendations include communicating better with the public when Treasury considers certifying events.