Terrorism Risk Insurance: Program Changes Have Reduced Federal Fiscal Exposure

Congress enacted TRIA to help ensure the availability and affordability of commercial property/casualty insurance for terrorism risk and to address potential effects on the economy in the absence of such coverage. Under the TRIA program, which is set to expire December 31, 2027, the government and insurers share losses following a certified act of terrorism. TRIA creates explicit fiscal exposure because the government is legally required to make payments to insurers after such an event, but there also may be some implicit exposure from an expectation of federal spending. To date, Treasury has not certified any acts of terrorism.

GAO was asked to examine federal fiscal exposure under the TRIA program. This report (1) examines changes in explicit fiscal exposure under TRIA and how insurers have adjusted to the changes, and (2) describes situations in which implicit fiscal exposures may arise and might become explicit.

To conduct this work, GAO reviewed the TRIA statute and related studies, analyzed Treasury data, and interviewed a nongeneralizable sample of insurers of different sizes providing various types of insurance.

Terrorism Risk Insurance Act (TRIA) reauthorizations through 2015 have decreased federal fiscal exposure, and insurers have adjusted by managing their increased risk. Changes in the TRIA program that the Department of the Treasury (Treasury) administers—particularly incremental changes since 2015—reduced the government's explicit fiscal exposure from a certified act of terrorism (see figure). For example, by increasing the program trigger—minimum amount of industry-insured losses needed to activate the program—Congress potentially reduced the number of events that qualify for federal payments. As explicit federal fiscal exposure has decreased, insurer exposure has increased. Nevertheless, the market for terrorism risk has remained stable. However, some insurers are uncertain how Treasury defines insured losses for the purposes of calculating whether the program's $200 million trigger or $100 billion cap have been reached. For example, some insurers interpreted insured losses to include the portion of losses policyholders retain, which was different from Treasury's interpretation. Differences in interpretations could lead to disputes between insurers and Treasury following a terrorist event. One purpose of TRIA is to stabilize the market following a terrorist event. Communicating how it would calculate losses toward these program amounts could help Treasury alleviate uncertainty in the insurance market following a terrorist event.

The government also has implicit fiscal exposure following a terrorist event, arising from expectations based on current policy or past practices that it may provide assistance, even when it is not legally required to do so. Although the government may not act on these expectations, the government's implicit exposure might become explicit if it

chooses not to recoup the full federal share of losses from property/casualty policies, as allowed under TRIA, to prevent further stresses on the insurance market after a major terrorist event;

assists companies with uninsured or underinsured losses after a terrorist event or when losses exceed the program cap;

covers uninsured losses from a nuclear, biological, chemical, or radiological terrorism event; or

assists insurers with losses that did not meet TRIA's trigger for loss sharing, or that were incurred in excluded lines of coverage, such as life and health insurance.

GAO recommends that Treasury communicate how it would calculate losses, as they relate to policyholder retention amounts, in determining the TRIA program trigger and cap. Treasury agreed with the recommendation.

After the terrorist attacks on September 11, 2001, insurers generally  stopped covering terrorism risk because they determined that the risk of  loss was unacceptably high, relative to the premiums they could charge.  In November 2002, Congress enacted the Terrorism Risk Insurance Act  of 2002 (TRIA) to help ensure the continued availability and affordability  of commercial property/casualty insurance for terrorism risk and to  address concerns that the lack of terrorism risk insurance could have  significant effects on the economy. TRIA was amended and reauthorized  in 2005, 2007, 2015, and 2019. In this report, we refer to the original act,  its amendments, and its reauthorizations collectively as TRIA.

TRIA requires the Department of the Treasury (Treasury) to administer a  program in which the federal government would share some of the losses  with private insurers in the event of a certified act of terrorism. TRIA  includes provisions for Treasury to recoup the federal share of losses  after a certified act of terrorism. The losses the federal government would  cover before such recoupment create an explicit fiscal exposure for the  government—that is, payments the federal government is legally required  to make immediately or in the future. Additionally, a certified act of  terrorism could create an implicit fiscal exposure —that is, spending the  federal government might be expected to incur based on current policies  or past practices. For example, the government might be expected to  provide assistance to policyholders or insurers to address long-term  effects after a terrorist event although it is not specifically provided for  under TRIA. To date, no acts of terrorism have been certified under TRIA.

Policymakers and insurance industry representatives have raised  questions about the role of the federal government in supporting terrorism  risk insurance. Although Congress originally intended TRIA to provide  temporary support (about 3 years), it reauthorized the program several  times, most recently in December 2019—a recognition that a federal role  in supporting this market still is needed. TRIA currently is set to expire on  December 31, 2027.

You asked us to review potential taxpayer exposure under TRIA. This  report (1) examines changes in explicit fiscal exposure under TRIA and  how insurers have adjusted to the changes; and (2) describes situations  in which implicit fiscal exposures may arise and might become explicit.

To address these objectives, we reviewed TRIA, its 2005, 2007, 2015,  and 2019 amendments and reauthorizations, and implementing  regulations. We also reviewed our prior work on TRIA and federal fiscal  exposures. We reviewed reports from Treasury, the Congressional  Budget Office, and Congressional Research Service. We also reviewed  relevant reports from academic researchers and other industry  stakeholders. We interviewed Treasury officials and representatives from  the National Association of Insurance Commissioners (NAIC) and  industry stakeholders, including selected insurers, relevant insurance  trade associations, a rating agency, risk modelers, and an insurance  broker. We selected five insurers to interview because they provide  terrorism coverage to businesses and reflect a mix of sizes and category  of insurer. In interviews, we asked industry stakeholders about aspects of  the program and the insurance market, and risks that could lead to  implicit exposure. The results of these interviews are not generalizable.

To determine the change in the explicit fiscal exposure from 2015 to 2020  and how insurers have adjusted to these changes, assess the change in  market participation by insurer type, and illustrate loss sharing following a  terrorist event, we analyzed Treasury’s aggregated terrorism risk  insurance data. We analyzed loss scenarios using data and informed  assumptions about TRIA-related premiums and deductibles. By  performing electronic tests and interviewing staff from Treasury, its data  contractor, and industry stakeholders, we determined that the Treasury  data used in this report were sufficiently reliable for providing illustrative  examples of changes in market participation and loss sharing from 2015  to 2020.

The external communication component of internal control—that  management should externally communicate the necessary quality  information to achieve the entity’s objectives—was significant to this  objective, along with the related principle that management communicate  quality information externally through reporting lines so that external  parties can help the entity achieve its objectives and address related  risks. We assessed the content of Treasury’s external communications,  including about TRIA statutory language and Treasury’s program  regulations and guidance against this principle. We also obtained views  from Treasury officials and industry stakeholders.

To identify situations in which implicit fiscal exposure may arise and might  become explicit, we analyzed TRIA’s program design and reviewed our  prior work for sources of implicit fiscal exposures faced by other disaster  insurance programs. To ensure the reasonableness and completeness of  our list of sources, we consulted with industry stakeholders and made  modifications as appropriate. To describe these situations, we reviewed  reports on industry effects that could lead to an expectation of assistance  by the government and conducted a literature review on the effects of  TRIA changes on insurers. Finally, to obtain insight into the commercial  property/casualty market, we interviewed industry stakeholders as noted  above on implicit fiscal exposures. For more detailed information on our  scope and methodology, see appendix I.

We conducted this performance audit from July 2019 to April 2020, in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

The purposes of TRIA are to (1) protect consumers by addressing market  disruptions and ensuring the continued widespread availability and  affordability of commercial property/casualty insurance for terrorism risk;  and (2) allow for a transitional period for the private markets to stabilize,  resume pricing of such insurance, and build capacity to absorb any future  losses, while preserving state insurance regulation and consumer  protections.

TRIA only applies to certain commercial property/casualty lines of  insurance (we refer to them as TRIA-eligible lines) and excludes lines  such as health and life insurance. While the law requires insurers to  make terrorism risk coverage available to commercial policyholders,  commercial policyholders are not required to buy it. Additionally, the law  requires an insurer to make coverage for terrorism losses available that  does not differ materially from the terms, amounts, and other coverage  limitations applicable to losses arising from events other than acts of  terrorism. For example, an insurer offering $100 million in commercial  property coverage must offer $100 million in coverage that is not  materially different for property damage from a certified terrorist event.

Insurers may charge a separate premium to cover their terrorism risk,  although some include the coverage in their base rates for all-risk  policies. The majority of terrorism risk insurance is purchased as part of  these embedded policies. The remainder is purchased as stand-alone  coverage. Neither insurers nor the federal government charge for the  federal coverage of terrorism risk under TRIA, but the government must  recoup at least some of its losses following a terrorist event.

For eligible commercial lines of property/casualty insurance, TRIA covers  insured losses resulting from an act of terrorism, which is defined, in part,  as a “violent act or an act that is dangerous” to human life, property, or  infrastructure. TRIA is silent about losses from attacks with nuclear,  biological, chemical, or radiological (NBCR) weapons. Although TRIA  and its reauthorizations do not specifically include cyber risk insurance as  a TRIA-eligible line, Treasury issued guidance about such coverage in  2016. The guidance stated that TRIA provisions apply to cyber risk  insurance written under an embedded or stand-alone policy in TRIA- eligible lines. A cyberterrorism event could cause minor-to-severe  business disruption and physical damage to property. In this report, we  include losses resulting from cyberterrorism events with conventional  terrorism events.

Any catastrophic terrorist event presents both explicit and implicit fiscal  exposure for the federal government. TRIA alleviates some of the implicit  exposure through loss sharing. Under TRIA, the federal government is  legally required to make payments (reimbursements to insurers): this  represents an explicit fiscal exposure. Even without a loss-sharing  program, the federal government also faces implicit fiscal exposure  through a potential expectation to provide policyholders or insurers  assistance to address long-term effects after a terrorist event. We have  defined implicit fiscal exposures as situations that create expectations for  future federal spending based on current policy, past practices, or other  factors.

Under TRIA, the government and insurers share losses in the event of a  certified act of terrorism with insured losses above the program trigger of  $200 million and below the program cap of $100 billion. According to the  statute, Treasury cannot certify an event as an act of terrorism under  TRIA if the aggregate property/casualty “insurance losses” resulting from  the event are less than $5 million. Additionally, TRIA is not triggered  unless the aggregate property/casualty “insured losses” resulting from  one or more certified acts in a particular calendar year reach $200 million.  Annual coverage for losses is limited (capped) so that neither the private  insurers nor the federal government are responsible for paying aggregate  insured losses in excess of $100 billion. Specifically:  “Insured losses” are defined in statute and regulation as any losses  resulting from an act of terrorism (including an act of war in the case  of worker’s compensation) generally occurring in the United States  that are covered by primary or excess property/casualty insurance  issued by an insurer. TRIA refers to insured losses in defining the  program trigger and program cap.  “Insurance losses” are not defined in statute or regulation, but TRIA  refers to insurance losses in defining the event certification amount.

TRIA’s loss-sharing structure requires that insurers pay claims on  covered terrorism losses and that Treasury reimburse individual insurers  for losses that exceed a specified amount. According to the coshare  provision, Treasury reimburses the insurer for a certain percentage (80  percent) of its losses above the insurer deductible, and the insurer is  responsible for the remaining portion (20 percent). The policyholder also  may retain losses from a terrorist event in the form of an insurance  deductible or self-insurance retention. According to Treasury, losses  retained by the policyholder are not considered to be “insured losses”  under TRIA and do not count toward losses included in the $200 million  program trigger or $100 billion program cap. However, this retention may  be counted toward the $5 million event certification threshold because it is  calculated based on “insurance losses.”

TRIA provides for two types of recoupment—mandatory and  discretionary—of the federal share of losses after a terrorism event.  Figure 1 shows the claim and recoupment processes after a terrorism  event resulting in losses covered by insurers and the government.

Mandatory recoupment. TRIA requires recoupment of at least a  portion of the federal share of losses if the aggregate sum of all  insurers’ deductibles and coshares are below an amount prescribed  by TRIA—known as the industry aggregate retention amount. Under  mandatory recoupment, the insurers must impose and remit to  Treasury a premium surcharge on all policies in TRIA-eligible lines  until total industry payments reach 140 percent of any mandatory  recoupment amount. TRIA specifies the collection time frame (from  1 year and 9 months to about 6.5 years, based on the date of the  event). Treasury considers the collection time frame when  establishing the amount of the mandatory recoupment surcharge.

Discretionary recoupment. TRIA permits discretionary recoupment  when the federal share of losses exceeds the mandatory recoupment  amount. Under the discretionary recoupment provision, Treasury  may consider a number of factors, such as economic conditions in the  commercial marketplace, in determining the amount to recoup. To  help in its decision-making, Treasury may issue a data call for insurer  deductible and insured loss information. Treasury also sets the  surcharge for discretionary recoupment, but the increase to TRIA- eligible premiums must not exceed 3 percent per calendar year. TRIA  does not specify a collection time frame for discretionary recoupment.

Since the 2015 reauthorization, insurers have been required to submit  information to Treasury about their coverage of terrorism risk, including  the lines of insurance with exposure to such risk, the premiums earned on  such coverage, and the participation rate for such coverage. Treasury’s  2017–2019 data calls included loss scenarios in which insurers estimate  and report expected losses given a defined terrorist attack at a specified  location, date, and time. Treasury’s defined loss scenarios were located  in New York City in 2016, Chicago in 2017, and San Francisco in 2018.

Treasury’s reporting requirements for insurers vary, based on the  following categories:

Small insurers. Insurance companies that had both policyholder  surplus and prior year TRIA-eligible direct-earned premium of less  than five times the program trigger. For example, TRIA’s program  trigger in 2020 is $200 million. Thus, Treasury would categorize  insurers with less than $1 billion in 2019 direct-earned premiums and  less than $1 billion in policyholder surplus as small. Treasury does  not require small insurers to report on a number of items, including the  loss scenarios.

Nonsmall insurers. Insurance companies with either policyholder  surplus or prior year TRIA-eligible direct-earned premium greater than  the small insurer thresholds.

Captive insurers. Special-purpose insurance companies set up by  commercial businesses to self-insure risks arising from the owners’  business activities.

Alien surplus lines insurers. Insurance companies headquartered in  a foreign country that have been qualified to do business in the United  States through an NAIC-administered process, which assesses the  financial stability and trustworthiness of the insurer.

TRIA Reauthorizations Reduced Explicit Fiscal Exposure, but Treasury and Some Insurers Have Different Interpretations of Key Definitions Explicit Fiscal Exposure Decreased under TRIA Reauthorizations

Each reauthorization of TRIA through 2015 reduced the magnitude of the  government’s explicit fiscal exposure. Since 2003, changes to TRIA  provisions have increased insurers’ share of losses and thus decreased  explicit federal fiscal exposure in the event of certified acts of terrorism  (see fig. 2). For example, the program trigger rose over time, from $5  million in 2003 to $200 million in 2020. These changes reduced explicit  fiscal exposure because they increased the amount of insured losses  required before the government would share in the losses. The insurer  deductible increased from 7 percent in 2003 to 20 percent for 2020, also  reducing the federal share of payments. The 2015 reauthorization  required incremental reductions in the federal share of losses over 5  years. The 2019 reauthorization extended the program until 2027, but did  not make any changes to the program parameters. See appendix II for  more details of the changes in the reauthorizations.

Currently, following a certified act of terrorism Treasury pays insurer  claims for 80 percent of insurers’ losses above their individual deductibles  once losses in a calendar year exceed the program trigger of $200 million  (see fig. 3). For example, based on the scenario from Treasury’s 2019  data call, the federal government could have an explicit exposure of about  $4.4 billion in reimbursements to insurers. Specifically, insurers estimated  that a hypothetical 2018 terrorist event in San Francisco could generate  $39.7 billion dollars in overall losses, of which insurers could pay about  $17 billion in claims to policyholders and the government could pay about  $4.4 billion in reimbursements to insurers after a policyholder retention  amount.

According to our analysis of Treasury data on insurer direct-earned  premiums, federal losses following a terrorist event under the loss-sharing  provision in effect in 2020 would be smaller than they would have been  for a similar event under the loss-sharing provision in effect in 2015,  across all event sizes and subsets of insurers. In addition, more of the  federal losses would be recovered through mandatory recoupment (see  fig. 4). As we found in 2017, the amount of federal losses depends on  event size and how many and which insurers were affected.  Additionally, the government share depends on the aggregate TRIA- eligible direct-earned premium of the insurers with losses. Specifically,  the federal share of losses is smaller when losses are shared among  insurers with larger aggregate premium bases.

Insurers Adjusted to Program Changes but Some Were Unclear about How Treasury Would Calculate the Program Certification Threshold, Trigger, and Cap

As the share of losses for which insurers are responsible has increased  under TRIA, the ability of insurers to absorb the extra exposure also has  increased. Insurers use risk-mitigation strategies to reduce or offset their  exposures. These can include purchasing reinsurance—insurance for  insurers—to cover their deductibles or coshare payments, or diversifying  their portfolios (for instance, reducing concentrations of risk in certain  locations or lines of insurance). Insurers told us that they considered the  potential effect of program changes in each reauthorization and modified  risk-mitigation strategies, as needed. Furthermore, other industry  stakeholders, including a broker and an industry association, told us that  because program changes have been gradual and expected, insurance  companies have been able to adjust their coverage accordingly.

Available evidence indicates that TRIA has been largely effective in  meeting its statutory objectives of stabilizing the terrorism risk insurance  market. First, terrorism risk insurance is available in the market for a  relatively low cost and is purchased by the majority of commercial  policyholders in the United States, according to industry reports. Second,  private reinsurance capacity for terrorism risk insurance increased since  the creation of the program, according to Treasury. Third, our analysis of  Treasury data suggests there is market stability. Insurers in all of  Treasury’s reporting categories largely remained in the market.  Furthermore, the market share and number of insurers in the reporting  categories generally remained stable. For example, using data on direct- earned premiums of insurers from 2016 to 2018, nonsmall insurers (92  insurers in 2018) held about 80 percent of the TRIA-eligible insurance  market. Small insurers (186 insurers in 2018) held about 10 percent.  Captive and alien surplus lines insurers (598 and 98 insurers,  respectively, in 2018) each held 4 or 5 percent (see fig. 5).

Our interviews indicate that some insurers’ interpretation of whether  policyholder retention amounts count toward the program threshold,  trigger, and cap may differ from Treasury’s. Some large policyholders  may retain large amounts of loss in the form of a deductible or self- insurance retention following a terrorist event. Treasury officials said  policyholder retention amounts are not counted toward the program’s  $200 million trigger or its $100 billion cap, but could be counted toward  the $5 million threshold for event certification. They stated that the law  utilizes “insured losses” when referring to the program trigger and cap,  and “insurance losses” when referring to the certification threshold.

If Treasury counted policyholder retention amounts toward the program  trigger, the program would be triggered and capped with a smaller  amount of overall losses. For example:

To illustrate, we use a hypothetical terrorist event resulting in $290  million in overall losses, of which $100 million would be retained by  policyholders.

Using Treasury’s interpretation that excludes policyholder retention  amounts, “insured losses” would be $190 million, which is below the  program trigger of $200 million. As a result, the government would not  be required to pay insurers a coshare.

In contrast, if Treasury included policyholder retention amounts,  “insured losses” would be $290 million, which exceeds the program  trigger. In this case, the government would pay $112 million to  insurers in coshares.

In either case, losses would not reach the program cap of $100 billion.

We asked 12 industry stakeholders about their understanding of how  Treasury would use policyholder retention amounts to calculate the  program threshold, trigger, and cap. The distinction between “insured  losses” and “insurance losses” in Treasury’s explanation was clear to one  insurer. However, some aspect of this distinction was unclear to six  industry stakeholders, including an insurer association and three insurers,  potentially resulting in uncertainty about how Treasury would calculate  losses in the aftermath of a terrorist event. For example, representatives  of an insurer association and two insurers told us they interpreted insured  losses as including the policyholder retention amounts because insurers  could be responsible for paying this amount. This is because some  insurers pay the entire claim, including all or a portion of the policyholder  retention, up front and then seek reimbursement from the policyholder. In  addition, if a policyholder cannot pay its retention, the insurance company  is responsible for it. Differences in interpretation could lead to disputes  between insurers and Treasury following a terrorist event. We previously  found that insurers are concerned about the long-term consequences of  disputes related to terrorist events.

One purpose of TRIA is to stabilize the market following a terrorist event.  Furthermore, federal internal control standards state that management  should externally communicate the necessary quality information so that  external parties can help the entity achieve its objectives and address  related risks. Treasury’s program regulations define “insured losses”  and do not define “insurance losses.” Furthermore, the regulations do not  explain how such losses are calculated and therefore how the  policyholder retention amount does or does not count toward the program  threshold, trigger, or cap, as applicable. Treasury uses different methods  to communicate program information and clarify program details to  stakeholders, such as program regulations and interpretive letters, but  has not clarified this issue using these or other methods because officials  believe the distinction is understood in the industry.

By closing the information gap of how it would calculate losses for the  program threshold, trigger, and cap, Treasury would create a common  understanding of a critical feature of the program. Furthermore, Treasury  may prevent uncertainty in the insurance market and potential litigation  following a terrorist event that could delay insurance payments and  economic recovery.

Implicit Fiscal Exposure Exists and in Some Situations Could Become Explicit

TRIA explicitly limits federal exposure following a terrorist event, but the  federal government could be expected to provide assistance beyond what  is explicitly outlined in TRIA. Expectations for the government to provide  assistance through its recoupment decisions and to policyholders and  insurers, as described below, represent implicit fiscal exposures.  Although the government may not act on these expectations, to the extent  that it does, the implicit exposure would become an explicit exposure.

Less-Than-Full Recoupment of All Funds Following a Terrorist Event

In certain circumstances under mandatory and discretionary recoupment,  such as potential effects on market stability, public expectation may lead  the federal government to cancel recoupment or reduce the amount of  funds recouped. Any portion of the federal coshare not recouped  represents an implicit fiscal exposure.

Some mandatory recoupment scenarios may or may not be perceived as  burdensome to policyholders, prompting an expectation of federal  assistance to ease the burden. Treasury determines mandatory  recoupment surcharges based on the statutory deadlines for collecting  mandatory recoupment. If a large terrorism act occurs in a year in which  the statute requires the collection of mandatory recoupment in a short  time frame, Treasury may need to set a high surcharge percentage on  premiums for policies with TRIA-eligible lines. In this case, some  policyholders may find it difficult to pay the surcharge, making collection  of the mandatory recoupment amount burdensome.

Large recoupment amounts or surcharges could prompt public  expectation, and political will, for reducing or cancelling recoupment to  alleviate this burden. Because mandatory recoupment time frames are  based in statute, reducing or canceling this recoupment would require  congressional action. One insurer told us that they are skeptical that  Congress would allow Treasury to collect mandatory recoupment after a  large event. Under current program provisions, the maximum mandatory  recoupment amount will increase if the TRIA-eligible direct-earned  premium increases. Industry stakeholders told us that, with this change,  eventually all recoupment could be mandatory. While the amount to be  recouped may increase, the recoupment time frame remains unchanged.  Therefore, over time, surcharge amounts could increase, which may  increase burden on policyholders and increase the expectation for  Congress to cancel recoupment. If Congress were to cancel the collection  of mandatory recoupment, the explicit fiscal exposure would include both  the federal share of losses paid to insurers and the decreased corporate  tax receipts from deductions for the recoupment charges policyholders  may claim (such deductions otherwise were intended to be offset by the  140 percent recoupment).

Changes in legislation following premium rate increases in the National  Flood Insurance Program (NFIP) provide an example of Congress  changing a law to ease policyholder burden. Congress enacted the  Biggert-Waters Flood Insurance Reform Act of 2012, which was intended  to strengthen the future financial solvency and administrative efficiency of  NFIP by implementing provisions to reduce and eventually eliminate most  subsidized premium rates. However, after public outcry claiming negative  effects on home values, Congress enacted the Homeowner Flood  Insurance Affordability Act of 2014, which repealed some of the premium  rate increases in the 2012 act.

Discretionary recoupment presents an implicit fiscal exposure because  Treasury may decide not to collect the full discretionary recoupment  amount. Under TRIA, Treasury decides whether and how much of the  discretionary portion of the federal share of losses to recoup. Treasury  may recoup some or all nonmandatory funds, or cancel discretionary  recoupment. For any amount that Treasury chose not to collect, the fiscal  exposure would be the dollar-for-dollar amount of the federal share of  losses paid to insurers.

As defined in statute, Treasury may consider several factors when  determining whether to collect discretionary recoupment, in full or  partially, or cancel recoupment. These factors include ultimate cost to  taxpayers of no additional recoupment; the economic conditions of the  commercial marketplace; the affordability of commercial insurance for  small and medium-sized businesses; and other factors Treasury deems  appropriate. According to agency officials, decisions regarding  discretionary recoupment would be based on the parameters of the  specific terrorism act, such as the size of the federal share of losses,  location of the event, and length of the collection period. In our analysis of  explicit exposure, we found that under some scenarios, the discretionary  recoupment amount resulting from a terrorist event could exceed $50  billion.

Depending on Treasury’s analysis of these factors, some or all of the  discretionary recoupment amount may not be collected. For example,  currently, much of the recoupment amount resulting from the most  catastrophic losses would be considered discretionary under TRIA’s  provisions. Because TRIA mandates an annual 3 percent cap on the  increase of premium rates in TRIA-eligible lines for discretionary  recoupment, in extreme cases Treasury might need to collect a premium  surcharge for a protracted period of time to fully recoup the discretionary  portion of losses. The effects of a protracted period of premium  surcharges could be a factor in Treasury’s determination to cancel  discretionary recoupment.

Assistance for Uninsured or Underinsured Losses Following a Terrorist Event

Based on previous federal action following natural disasters or financial  market crises, there may be an expectation that the government would  provide financial assistance to businesses for uninsured or underinsured  losses related to a terrorist event, regardless of whether a loss-sharing  program existed. For example, the federal government uses the Disaster  Relief Fund to provide compensation for property damage or financial  losses to victims of Presidentially declared major disasters and  emergencies. In fiscal years 2005–2018, the federal government  designated $138 billion in supplemental appropriations to this fund for  extreme weather events. And following the financial crisis of 2007– 2009, the federal government provided financial assistance directly to  General Motors Company and Chrysler Holdings to help stabilize the U.S.  automobile industry and to avoid economic disruptions. Treasury  officials and industry stakeholders described several terrorist event  scenarios that could produce a large amount of uninsured or  underinsured losses that affected businesses might not be able to absorb  and that might lead to the expectation of federal assistance.

NBCR events present an implicit exposure. Historically, insurance  coverage for losses related to a NBCR terrorist event has been limited or  unavailable. Stakeholders told us that there likely would be an  expectation of federal financial assistance for businesses with uninsured  losses related to such an event. Treasury officials and stakeholders we  interviewed agreed that primary and reinsurance coverage for NBCR  events is limited, resulting in many businesses having limited or no  coverage. Stakeholders also told us that, without TRIA, insurers would  no longer offer the limited amount of NBCR coverage currently available.  Stakeholders attribute the limitations to the potentially catastrophic losses  associated with NBCR events and the difficulty in modeling and  underwriting such events. Representatives of a policyholder association  whose members purchase NBCR coverage stated that available  coverage likely was insufficient to cover expected losses. Furthermore,  they said some policyholders forgo NBCR coverage because of its limited  availability, high cost, and the low perceived risk of a NBCR event. As a  result, many businesses may be exposed to high loss.

Treasury officials and industry stakeholders described possible NBCR  terrorism events in which a significant amount of losses could be  uninsured or underinsured. Treasury’s 2019 Small Insurers Report found  that a NBCR terrorism event likely posed the greatest risk of total  catastrophic terrorism losses, far outpacing a conventional attack.  Although modeling these types of losses is difficult, NAIC’s Center for  Insurance Policy and Research estimated, taking into account the  program cap, that a NBCR event in New York City could generate nearly  $60 billion of uninsured loss, 38 percent of the total loss. It also found  that a larger NBCR event could create $850 billion in uninsured loss, or  90 percent of total losses. Furthermore, this research estimated large  uninsured losses in other cities, such as Houston, where a large nuclear  event was estimated to generate $67 billion in uninsured losses, or 40  percent of total losses. Such catastrophic losses could create a strong  public expectation of federal financial assistance for uninsured losses.

The expectation of financial assistance to policyholders if insured losses  exceeded the program cap also creates implicit fiscal exposure. By law,  insurers that have met their individual deductible and the federal  government are not responsible for losses exceeding the TRIA program  cap. However, industry stakeholders we interviewed expected that, in the  event the program cap were exceeded, the federal government would  provide some form of assistance to those who experienced loss. For  example, losses from a NBCR event could be over $1 trillion, with TRIA- insured losses exceeding the $100 billion program cap. While a single  conventional attack would be unlikely to exceed the program cap,  according to stakeholders, a series of conventional attacks could.  Although determining the frequency of terrorist events is difficult, one  modeling firm with which we spoke estimates losses great enough to  exceed the program cap in a conventional attack to have a 0.0005  percent (or 1/2,000) chance of occurring in a single year. This is less  likely than severe natural catastrophes, such as Hurricanes Sandy and  Harvey.

As we found in a 2019 report on fiscal exposures, Congress  demonstrated its willingness to fund the implicit exposure of policyholder  claims that exceeded the amount NFIP was authorized to borrow from  Treasury. In October 2017, when NFIP was about to exhaust its  borrowing authority, Congress passed a supplemental appropriation,  which the President signed into law, that cancelled $16 billion of NFIP  debt to Treasury.

Implicit fiscal exposure also exists in the expectation that the federal  government would assist policyholders unable to pay their retained  losses. Policyholders with very large retained losses may face financial  insolvency after a terrorist attack, which may create an expectation of  government assistance. Stakeholders told us that policyholders may  choose larger retention amounts to reduce premiums or because  insurance for high-risk, high-value properties is unavailable. Insurers we  interviewed said that most businesses have small deductibles, but some  large businesses may choose higher retention amounts to reduce the  high insurance cost in locations considered to be higher-risk and for high- profile properties. For example as shown in figure 6, Treasury’s 2017– 2019 data call scenarios explored estimated losses in locations with high- profile properties such as Rockefeller Center in New York City (2017),  Willis Tower and O’Hare International Airport in Chicago (2018), and  Embarcadero Center and Union Square in San Francisco (2019).  Although the actual amounts may be lower than the estimates insurers  reported, the aggregated policyholder retention could exceed losses paid  through the program. This demonstrates the potential for large losses that  could create an expectation of government assistance if policyholders  with large retention amounts were unable to absorb the losses.

Assistance to Insurers with Losses That Do Not Result in Program Loss Sharing

An implicit fiscal exposure exists from the potential expectation that the  government might help stabilize markets by assisting insurers with (1)  losses that do not trigger the program’s loss sharing, or (2) losses from  lines ineligible for TRIA. While these risks exist, the current market has  some protections in place and stakeholders viewed this exposure as  unlikely.

Loss sharing not triggered. If the total losses from a certified act of  terrorism were below the program trigger (currently $200 million), insurers  with deductibles below the program trigger could sustain losses larger  than their deductible without receiving any federal coshare. Because the  amount of the program trigger has increased over time, more insurers  potentially face this scenario. Stakeholders told us that small insurers and  those that offer workers’ compensation insurance are most affected by  changes to the program trigger.

Our analysis of Treasury data shows about 97 percent of insurers have  deductibles lower than the $200 million program trigger and thus could  receive no coshare following a certified act of terrorism. This includes all  small, captive, and alien surplus lines insurers, and more than half of the  nonsmall insurers. Furthermore, our analysis of 2016–2018 Treasury data  shows that these insurers are sometimes concentrated in certain  insurance lines. For example, small insurers may be concentrated in  commercial multiple peril lines. Additionally, market shares of small  insurers and captive insurers increased in the aircraft (all perils) line.  Such concentrations could destabilize specific insurance lines following a  terrorist event.

Although the market is currently stable, some insurers may leave the  market to mitigate their risks if their losses are unlikely to trigger the  program’s loss sharing, which could reduce the availability of insurance in  certain markets. A reduction in the availability of insurance could lead to  more uninsured losses in the event of a subsequent terrorist event and  could result in an increased expectation for losses to be covered through  federal assistance. In its 2019 report, Treasury recognized the potential  for small insurers to not provide insurance in certain markets. Additionally,  the report cautions that if the program trigger increased, the number of  insurers that would face the possibility of a gap between their deductible  and the program trigger also would increase. However, analysis of  Treasury data indicate that, to date, insurers in this situation largely have  not left the market. As previously noted, because the changes to program  parameters were gradual, insurers have had time to adjust to the  changes.

Insurers facing this scenario also can mitigate their risk by purchasing  reinsurance to cover the difference between their deductible and the  program trigger. However, it is not clear that the reinsurance market can  absorb all of this risk. For example, industry stakeholders told us that  reinsurers are sensitive to accumulation of exposure and reinsurance is limited in perceived high-risk areas such as New York City, Washington  D.C., Los Angeles, and Philadelphia where there are large concentrations  of people and high-value properties.

In addition, reinsurance premiums may be too costly for some insurers.  According to state insurance commissioners, high reinsurance costs may  not qualify as a reason for insurers to increase premiums in some states.  As a result, insurers would be unable to pass reinsurance costs on to  policyholders. Furthermore, limited availability and affordability of  reinsurance for high-risk areas and NBCR could be exacerbated following  a terrorist event. Alternative forms of reinsurance, such as catastrophe  bonds, are not widely used for terrorism risk.

Treasury officials said that widespread market instability and an  expectation for federal assistance may be unlikely in the case of a  certified act of terrorism that produces significant losses for insurers that  do not reach the program trigger. They said any market effects would be  localized because a smaller terrorist event likely would affect a small  number of insurers with a gap between their deductibles and the program  trigger. Industry stakeholders said that it is possible that such an event  could cause insurers to reduce coverage offered, but other stakeholders  said that small insurers were well aware of the risk and their reactions  would not create market instability. Additionally, state guarantee funds  may provide support to policyholders in case of insurer insolvency before  expectations for federal financial assistance arose.

Insurance lines not eligible for TRIA. Federal assistance may be  expected for insurers if large terrorism losses occur in insurance lines— such as life or health insurance—that are not eligible for TRIA, according  to industry stakeholders. A 2019 Insurance Information Institute report  found life insurance losses resulting from the attacks of September 11,  2001, were $1.4 billion (about 3 percent of total insurance losses from the  attacks), an amount that far exceeds the TRIA program trigger. The  report notes that standard homeowner, condo or co-op, standard renters,  automobile insurance, and travel insurance policies also could be affected  by terrorism and are not covered under TRIA.

Adding group life insurance coverage under TRIA has been proposed, but  never passed into law. According to some perspectives in congressional  debate, other insurance lines were not viewed as needing explicit federal  assistance.

Insurers have adjusted to changing TRIA program parameters that  increased the share of the losses for which they would be responsible.  However, some insurers may not clearly understand whether Treasury  would include policyholder retention amounts in calculating losses to  certify a terrorist event, trigger loss sharing, or determine when the  program cap has been reached. External communication to develop a  clear understanding of how Treasury calculates “insured losses” and  “insurance losses,” specifically as they relate to policyholder retention  amounts, would help insurers understand when the program would be  activated or capped ahead of any terrorist event. Furthermore,  communicating this explanation could help Treasury alleviate uncertainty  in the insurance market following a terrorist event.

The Director of the Federal Insurance Office should communicate to  insurers in writing how it would utilize policyholder retention amounts in  calculating “insurance losses” and “insured losses” in determining the  program certification threshold, trigger, and cap, as applicable.  (Recommendation 1)

We provided a draft of this report to Treasury and NAIC for review and  comment. Treasury provided written comments through the Federal  Insurance Office, which are reproduced in appendix III. Additionally,  Treasury provided technical comments, which we have incorporated, as  appropriate.  NAIC did not provide technical comments.

In Treasury’s written response, the Federal Insurance Office agreed that  limiting uncertainty in the insurance market following a certified act of  terrorism was an important goal. The office accepted the recommendation  and stated that it would work to implement it in the coming months.

We are sending copies of this report to the appropriate congressional  committees, the Secretary of the Treasury, the Chief Executive Officer of  NAIC, and other interested parties. In addition, the report is available at  no charge on the GAO website at https://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-8678 or garciadiazd@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

The objectives of our report were to (1) examine the changes in explicit  fiscal exposure under the Terrorism Risk Insurance Act (TRIA) and how  insurers have adjusted to the changes; and (2) describe situations in  which implicit fiscal exposures may arise and might become explicit.

To address these objectives, we reviewed the Terrorism Risk Insurance  Act of 2002, Terrorism Risk Insurance Extension Act of 2005, Terrorism  Risk Insurance Program Reauthorization Acts of 2007, 2015, and 2019,  implementing regulations, and congressional records. We also reviewed  prior GAO work on TRIA and federal fiscal exposures. We reviewed  reports from the Department of the Treasury (Treasury), the  Congressional Budget Office, and Congressional Research Service. We  also reviewed relevant reports from academic researchers and industry  stakeholders.

We used Treasury’s data calls from 2017 to 2019 for aggregated direct- earned premiums, numbers of insurers, and hypothetical loss scenarios  throughout this report. We evaluated the reliability of the data by  performing electronic tests and interviewing staff from Treasury and its  data contractor, and industry stakeholders. We found the data sufficiently  reliable for the purposes described below. We interviewed Treasury  officials and representatives from the National Association of Insurance  Commissioners (NAIC) and industry stakeholders, including insurers,  insurance trade associations, a rating agency, risk modelers, and an  insurance broker. We selected a nongeneralizable sample of five insurers  to interview. These insurers were selected because they provide terrorism  coverage to businesses and reflect a mix of sizes and types of insurance.  In interviews, we asked about aspects of the program and the insurance  market, and risks that could lead to implicit exposure.

To describe the potential explicit fiscal exposure to the federal  government, we reviewed the relevant laws and analyzed the changes  made in each reauthorization. To quantify and compare the federal  explicit exposure from potential terrorist events in 2015 and 2020, we  estimated the TRIA-eligible direct-earned premiums for those years and  used simulated loss scenarios similar to those we previously developed.

To estimate the TRIA-eligible direct-earned premiums for 2015 and  2020, we used aggregated direct-earned premiums for 2016–2018  from Treasury’s data calls. Specifically, first we calculated the annual  percentage change in direct-earned premiums for 2016–2017 and  2017–2018. Second, we found the average change to be an increase  of about 0.4 percent. This estimate was smaller than the percentage  change we used in the 2017 report, but we found the estimate  reasonable because our current estimate was based on Treasury’s  data, specific to TRIA-eligible lines of insurance. Our 2017 estimate  was based on annual estimates of terrorism risk revenue. Third, we  estimated the 2015 and 2020 direct-earned premiums using the 0.4  percent average annual change and the reported 2016 and 2018  direct-earned premiums, respectively. To check for reliability, we used  the same method to estimate direct-earned premiums for 2014. Our  2014 estimate matched the 2014 data used in our 2017 report. We  calculated the change in both nominal and real dollars and decided to  use nominal dollars, which is consistent with how Treasury reports  direct-earned premiums. We found the data to be sufficiently reliable  for estimating the TRIA-eligible direct-earned premiums for 2015 and  2020.

To compare events occurring under the program provisions in effect in  2015 and 2020, we analyzed how losses would be shared between  the government and insurers by modeling terrorist events with insured  losses of $5 billion, $25 billion, $50 billion, $75 billion, and the  maximum terrorism event size ($100 billion in insured losses) in 2015  and 2020. In each case, we modeled the affected insurers to have an  aggregate direct-earned premium base of 25, 35, 55, and 100 percent  of all TRIA-eligible premiums. To demonstrate how the program  trigger may affect insurers, we also modeled a smaller terrorist event  with $290 million in losses and assumed that the affected insurers had  an aggregate direct-earned premium base of $750 million. In all  cases, we estimated the portion of federal losses that would be  subject to mandatory and discretionary recoupment.

To determine how insurers have adjusted to changes in TRIA and  measure market stability, we reviewed Treasury and past GAO reports  and relevant literature, analyzed Treasury data, and interviewed industry  stakeholders. We conducted a literature search to determine how  changes in the TRIA program parameters affected insurers and we  summarized relevant findings from our review of the literature we  identified. Additionally, we summarized Treasury and industry  stakeholders’ views on insurers’ ability to cover their share of losses  following an event and their willingness and ability to continue providing  coverage after a large event without access to the federal share of losses  to cover claims from the event.

We also analyzed Treasury data to determine whether insurance lines  have experienced changes in premiums or coverage availability since  2016. Specifically, we computed market shares by insurer category for  calendar years 2016–2018, using direct-earned premiums from  Treasury’s data calls. Using Treasury’s insurer categories (alien surplus  lines, captive, nonsmall, and small), we computed market shares overall,  and for TRIA-eligible lines of coverage in the U.S. terrorism risk insurance  market, which includes all the states, the District of Columbia, U.S.  territories, and other areas. We did not use number of policies because  number of policies was not available in Treasury’s data for all insurer  categories for all years.

In the course of assessing data reliability for Treasury’s scenario data, we  found some lack of clarity regarding two key terms under TRIA: “insured  losses” and “insurance losses.” The external communication component  of internal control—that management should externally communicate the  necessary quality information to achieve the entity’s objectives—was  significant to this objective, along with the related principle that  management communicate quality information externally through  reporting lines so that external parties can help the entity achieve its  objectives and address related risks. We assessed Treasury’s external  communications about these terms. Specifically, we reviewed the content  of TRIA statutory language and program regulations and guidance. We  obtained an interpretation of the terms from Treasury officials and also  obtained industry stakeholders’ views on them. We determined  Treasury’s scenario data to be reliable for the purpose of reporting the  loss sharing as it was reported and for illustrating loss sharing examples.

To identify potential situations in which implicit federal fiscal exposure  may arise, we analyzed TRIA’s program design and reviewed our prior  work for sources of implicit fiscal exposures, such as those faced by other  disaster insurance programs. To ensure the reasonableness and  completeness of our list of identified sources, we consulted with industry  stakeholders and made modifications as appropriate. We grouped the  sources of implicit fiscal exposures into three broad categories: (1) any  unrecouped program expenditures; (2) federal assistance for uninsured or  underinsured terrorism losses (including uninsured losses in a nuclear,  biological, chemical, or radiological event, losses in excess of the $100  billion program cap, and policyholders’ retained losses); and (3) federal  assistance to stabilize the insurance market for insurers that may be  unable to access the loss-sharing feature of the program or for lines of  insurance not included under TRIA.

To describe the potential exposure resulting from not executing the  recoupment of program expenditures, we summarized prior GAO reports  and industry stakeholder views on the risks and challenges of collecting  mandatory and discretionary recoupment funds, including the associated  collection time frames.

To describe the potential exposure resulting from federal assistance for  uninsured or underinsured losses, we reviewed and summarized findings  in prior GAO reports on past instances in which the federal government  provided disaster assistance (such as following the September 11  terrorist attacks, the financial crisis, and large natural disasters). We  summarized Treasury, NAIC, and industry stakeholder views on the  likelihood of terrorist events reaching the program cap, their expectations  for federal intervention in that case, and the importance of the cap to the  terrorism risk insurance market.

To describe the potential exposure resulting from federal assistance to  stabilize the insurance market following a terrorist event, we interviewed  industry stakeholders about scenarios that could produce an expectation  for government assistance (implicit exposure), the stability of the terrorism  insurance industry, how program details could affect different insurer  groups, and insurers’ options for covering their share of losses. We used  Treasury’s data to quantify the number and share of insurers that might  not be able to access TRIA’s loss-sharing provision and to illustrate  estimated loss sharing in Treasury’s scenarios of losses that would have  occurred in three hypothetical events: New York City (2016), Chicago  (2017), and San Francisco (2018). We also interviewed various insurer  associations.

Appendix II: Changes in TRIA Reauthorizations

As shown in table 1, Terrorism Risk Insurance Act (TRIA)  reauthorizations through 2015 changed several loss-sharing provisions,  which decreased the federal share and increased the insurer share of  losses. The 2015 reauthorization required incremental decreases in the  federal share of losses over 5 years. The 2019 reauthorization extended  the program until the year 2027, but did not make any changes to the  program parameters discussed below.

Appendix III: Comments from the Department of the Treasury

Appendix IV: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Jill Naamane (Assistant Director),  Karen Jarzynka-Hernandez (Analyst in Charge), Rudy Chatlos, Giselle  Cubillos-Moraga, Kaitlan Doying, Lijia Guo, John Karikari, Barbara  Roesmann, Jessica Sandler, Jena Sinkfield, Frank Todisco, and Rachel  Whitaker made key contributions to this report.

After the Sept. 11 attacks, insurers generally stopped covering terrorism risk. Through the Terrorism Risk Insurance Act, Congress sought to ensure available, affordable commercial insurance for this risk. Under this program, the government and insurers share losses.

Since 2003, the share of any losses insurers would pay has increased and the federal government’s share (and related fiscal risk) has decreased.

Some insurers may not fully understand program parameters, such as how the Treasury Department determines when government participation starts and when its payment limit has been reached. We recommended Treasury clarify this for insurers.