Insurance Valuation TODAY

In this issue of Insurance Valuation TODAY, we cover topics of interest for

insurance professionals, risk managers and others that need to determine

insurable values and replacement costs of real and personal property. In one

of the featured articles, Rebecca Fuller, Managing Director in Duff & Phelps’

Valuation Advisory practice, looks at the problem of underinsurance and

how to solve it. In our second featured article, our experts from Kroll, a

division of Duff & Phelps, discuss the rise in new ransomware involving data

exfiltration and how it can lead to regulatory issues.

In this issue you will also find a cost trend update providing construction and

equipment cost indices for selected countries around the world that can be

applied to building and equipment historical costs to determine replacement

cost indicators. These indicies are monitored, gathered and analyzed in a

retrospective manner. Given the current economic environment due to

COVID-19, the impacts on both construction and equipment costs are

unknown. We will continue to monitor the indices and expect to include new

indicators in upcoming cost trend updates.

We hope you find this newsletter useful and encourage you to contact us if

you require additional support.

I N S I D E

02 U.S. Cost Trend Update

03 International Cost Trend

Updates - UK, Italy,

Netherlands and Brazil

05 Opinion: It’s Time to

Regulate Commercial

Building Valuations

07 New Ransomware Reality

Could Lead to Regulatory

Issues

10 Interim Insurance Appraisal

Services

May 2020

Providing insights into current trends and issues affecting insurance valuation of real and personal property

2

Insurance Valuation Today - May 2020

Duff & Phelps

U.S. Cost Trend Update March 2020

Construction Cost Indices

Through the end of 2019, in the U.S., we saw the annual year-

over-year increases begin to decline when compared to 2017 and

2018. All four indices show annualized increases for 2019

between 0% and +2.1%. Over the past few years, steel prices—a

leading indicator of construction indices—had stabilized at USD

662 per metric ton in 2016; increased to an average of USD 767

per metric ton in 2017 and jumped up to an average of USD 907

per metric ton in 2018. In 2019, steel prices dropped significantly

to an average of USD 668 per metric ton and were on a consistent

downward trend in 2019. Overall, this represents a 26% decrease

in average steel prices from 2018 to 2019.1 With regards to labor,

wages continue to rise and more experienced individuals are

entering the workforce; however, there is a limit to the availability

of qualified individuals. The average wages for those working in

construction have increased 3.8% in 2019.6

2016 2017 2018 2019

ENR – Building Cost Indice2

+2.9% +3.3% +3.3% +1.7%

FM Global – U.S. Industrial Buildings Average3

+1.6% +1.2% +5.2% +1.7%

RSMeans – 30-City Average4

+0.8% +4.0% +5.5% +2.1%

Marshall & Swift, U.S. Average5

+0.0 to + 0.9%

+2.7 to +3.7%

+3.2 to +6.0%

+0.0 to +1.3%

Note: The range of change shown by Marshall & Swift represents different

classes of construction.

Equipment Cost Indices

Three sources for equipment cost indices had significant

increases in 2018 compared to the previous three years, with the

annual increases in 2019 retreating back towards historical

averages in all three indicators.

2016 2017 2018 2019

Marshall & Swift/Boeckh - Industrial Equipment Avg.5

+0.9% +2.6% +4.8% +0.8%

U.S. Bureau of Labor Statistics - Producer Price Indice for Finished Goods, Capital Equipment6

+0.9% +0.9% +2.7% +1.1%

FM Global - Industrial Equipment Composite3

+0.0% +1.2% +2.8% +1.9%

Take care when selecting an index to track the rate of cost change

for your company’s capital equipment. The three indices in the

table above all track average capital equipment cost change

percentages and indicate the differences that have occurred over

the past four years. Developers, insurance brokers, underwriters

and valuation consultants can all recommend appropriate indices

for your particular facilities. Select one that represents your capital

equipment as closely as possible; there are significant differences

between the average indices shown here and specific industrial-

sector indices.

Always remember that cost indices are just average indicators of

change; they are not absolutes, and there is no average building or

average assemblage of equipment. After five to seven years, you

should establish a new replacement cost basis by using a

qualified valuation consultant.

Sources

1 MEPS (International), Ltd. All carbon steel products composite price and indice

2 FM Global, Industrial Cost Trends

3 RSMeans, Construction Cost Indices, 30-City Average

4 Marshall & Swift/Boeckh, Marshall Valuation Service, Quarterly Cost Indice

5 U.S. Bureau of Labor Statistics, Producer Price Indice for Finished Goods - Capital Equipment

6 U.S. Bureau of Labor Statistics, Employment Cost Indice, Wages and Salaries for

Private industry workers in construction, 12-month percent change

3

Insurance Valuation Today - May 2020

Duff & Phelps

International Cost Trend Update

UK

Index Source 2016 2017 2018 2019

BUILDINGS

Building Cost Index

SPON's 1.8% 3.5% 3.4%

Tender Price Index SPON's 6.3% 4.3% 3.1%

Building Cost Index1

BCIS 1.5% 4.2% 3.5% 2.7%

Tender Price Index1

BCIS 1.9% 12.7% 4.6% 0.7%

M&E

Machinery & Equipment2

ONS 1.8% 2.7% 1.3% 1.4%

Metal Forming Machinery & Machine Tools2

ONS 1.4% 2.9% 5.4% 1.1%

Food, Beverage & Tobacco Processing2

ONS 1.7% 1% 1.6% 5.7%

Electric Motors, Generators & Transformers

ONS -3.6% -0.6% 0.4%

Pump & Compressors ONS 0.2% 1.5% 1.9%

Computer Equipment ONS 4% 5.4% 1.1%

Source:

1Building Cost Information Service (BCIS)

2Office for National Statistics

* Provisional figures

Since the economic crash in 2008, and the sharp decline in building costs the following year, the UK construction sector has shown a period of stability as noted by the cost increases of between 1-4% year-on-year, as per BCIS’s Building Cost Index. Forecasts predict that construction costs in the UK will see rises of 3-4% a year over the next four years, although this should be treated with some caution due to the current political uncertainty in the UK. The cost of machinery & equipment in the UK has also noted increased stability with prices rising on average by 1-3% over the past four years. The exception to this is the Machinery & Equipment for the production of food, beverages and tobacco which showed a sharp increase in the second quarter of 2019 and has remained at this level since.

Italy

Index Source 2016 2017 2018 2019

BUILDINGS

Building Cost Index ISTAT +0.3% +0.5% +1.4% +0.6%

Tender Price Index1 NA NA NA NA NA

M&E2

M&E General ISTAT -1.9% +2.3% +3.3% +0.2%

Metal Forming Machinery/Tools

ISTAT 1.2% 1.3% 1.3% 0.3%

Food, Beverage and Tobacco Processing

ISTAT +0.8% +1.2% +0.9% +2.2%

Note:

1Tender price index is not available in Italy

2M&E indexes are referred to total market (internal and external)

Sources: ISTAT, Italian National Institute of Statistics

In the fourth quarter of 2019, the economic signs of the manufacturing industry in Italy recorded a picture of overall stagnation in production, with only a few exceptions. Although the construction sector is slowly emerging from the mid-2000s crisis, the market has shrunk and has profoundly changed since. During the last four years, the trend in the cost of buildings has been characterized by rather weak growth, and forecasts are not showing signs of strong recovery for the moment. The trend in cost of machinery and equipment has had alternating moments during the last four years and, in line with the slowdown in the manufacturing sector at an international and national level, growth expectations for the first quarter of 2020 do not indicate a consolidated recovery.

4

Insurance Valuation Today - May 2020

Duff & Phelps

Netherlands

Index Source 2016 2017 2018 2019

BUILDINGS

Building Cost Index CBS 101.7 103.9 106.5 109.5

+2.2% +2.5% +2.8%

M&E

Manufactured Products

CBS 97.7 102.2 105 106.2

+4.6% +2.7% +1.1%

Chemicals and Chemical Products

CBS 93.6 100.8 105.3 101.6

7.7% 4.5% -3.5%

Source: Dutch Central Bureau of Statistics

Building costs in the Netherlands have seen a steady increase of 2-3% a year for the past four years, which is anticipated to persist as the Dutch housing market continues to grow.

The cost of manufactured products in the Netherlands has also increased annually over the past four years, however the level of year-on-year increase is tailing off, with just 1% growth from 2018-2019. This could be due to increased pressure from global trade tariffs enacted by the Trump administration.

Following some major industry consolidations, the cost of chemicals and chemical products in the Netherlands saw a fairly steep increase of roughly 12.5% from 2016-2018. This was followed by a correction during 2018-2019, bringing prices closer to 2017 levels due to oversupply and the resulting pressure on sales volumes.

Brazil

Index Source 2016 2017 2018 2019

BUILDINGS

Building Cost Index

FGV IBRE 6.5% 5% 3.8% 4%

M&E

General Price Index

FGV IBRE 10.4% 1% 5.5% 6.1%

Machine & Equipment

FGV IBRE 6.2% 3.6% 5.9% 7.4%

Electrical Machines & Materials

FGV IBRE 7.1% 3.9% 6% 4.9%

Mineral Coal FGV IBRE 7.4% 4.2% 0.5% 5.5%

Metallic Minerals FGV IBRE 6.3% 22.8% 3.8% 40%

The costs of both building construction and machinery and equipment over this period was generally driven by Brazilian inflation (the local Consumer Price Index, CPI) and the Brazilian real currency rate.

5

Insurance Valuation Today - May 2020

Duff & Phelps

It’s Time To Regulate Commercial Building Valuations

In this Opinion piece, Rebecca Fuller, Managing Director,

Valuation Advisory at Duff & Phelps, looks at the problem of

underinsurance and how to solve it. The days of getting a rebuild

valuation done once and then simply bumping it up a few

percentage points every renewal date are long gone. It’s time to

regulate—seriously.

The problem of underinsurance in the commercial property

insurance markets is widely recognized—and just as widely

ignored. It’s a common complaint throughout the industry among

both insurers and brokers. But so, too, is the weather. While you

can’t do anything about the latter, the former is, in fact, easily

addressed by regular valuations—and yet this is largely ignored.

The evidence strongly suggests that if it is going to be

addressed, something needs to change. That change could be

regulation.

The insurance industry is already heavily regulated, of course, but

this makes the silence over valuations even more glaring.

That’s most striking when it comes to the Insurance Act. What

can be said of the customer’s duty to make a “fair presentation of

the risk,” for example, when there is such uncertainty as to

something so fundamental as the value of property at risk? How

can customers be said to be disclosing “every material

circumstance” when that doubt remains? And, given the

recognition of widespread problems in this respect in the market,

shouldn’t a prudent insurer be “on notice” of the risk of

underinsurance if no evidence of a recent valuation is provided?

Perhaps more seriously, we should probably be asking if an

insurer can really be treating customers fairly in these cases: if it

is content to be complicit with a state of affairs in which

businesses may be overpaying premiums if over-insured or

putting their very survival at risk if underinsured.

A No-Win situation

It is in everyone’s interests to tackle this problem. The failure to

get regular valuations and consequent risks of underinsurance

benefit neither the insurer nor the insured.

Most obviously, businesses suffer in the event of a claim. In the

very best case, if the insurer pays up to the sum insured for

damage to buildings and equipment, businesses will be left with

a shortfall against the costs of rebuilding or replacement. With

underinsurance often close to 20% or much more, many small

and medium-sized businesses without big cash reserves face

bankruptcy. Those that continue will see the resulting disputes

delaying resolution of their claims.

However, there are significant costs for insurers, too. To begin

with, there is the lost revenue from the premiums they would be

charging for higher sums insured were valuations accurate. In the

event of a claim, meanwhile, they face a quandary: In a soft

market and for important clients they are likely to feel pressure—

from brokers, if not themselves—to simply pay up to the sum

insured. For customers who aren’t key or big losses, insurance

providers will have to commit to weeks of wrangling, costing time

and money, to try and negotiate the payment. That’s particularly

true since “average” clauses, reducing payments across claims in

proportion to the level of underinsurance, have been excised from

so many contracts.

Certainly, following the Insurance Act, they cannot avoid liability

entirely, and must come to a reasonable settlement with

businesses (who have insurance and reinsurance policies that

are governed by the laws of England and Wales, Scotland and

Northern Ireland) that suffer a loss.

6

Insurance Valuation Today - May 2020

Duff & Phelps

The incentive to tackle the problem of underinsurance, then, and

commit to independent valuations and regular reappraisals should

be strong on both sides. And yet, far too often, nothing is done.

Head in the Sand

There are several reasons for underinsurance. The first is that

customers assume they are fully insured. They may rely on market

values rather than rebuilding costs (including removal of debris

and land clearance), for property or reinstatement for equipment,

for instance. In many other cases initially, accurate valuations drift

over time, either because they are not adjusted at all or, more

commonly, they are increased according to an inappropriate or

simply inaccurate index.

At the same time, there’s often reluctance to commit to

independent valuations. In many cases that’s down to the

perceived cost or the fear of disruption to the business from the

time required to enable valuers to assess the site, buildings and

equipment.

These fears are increasingly unfounded. Modern technology has

markedly enhanced the speed and efficiency of valuations, with

valuers able to draw on the mass of data available online and

in-house from open and specialist sources to hugely reduce the

time required on site and costs to businesses. To help clients with

these issues, Duff & Phelps uses proprietary technology to scan

and analyze large property portfolios to highlight those in need of

a valuation, and those that can safely be left for the future.

Our solution benchmarks insured values based upon extensive,

global data collected by Duff & Phelps, the world’s largest

independent valuation provider. In some ways, this reality does not

matter, though: As long as the perception that valuation is both

expensive and burdensome persists, there will always be the

temptation to do without.

And perception is key: perhaps the biggest issue is simply that, for

all the talk, there’s a lack of hard facts when it comes to

underinsurance in this area. Businesses and insurers rarely wish

to battle it out in court, so there’s little publicly available

information. The oft-quoted research from the RICS’ Building

Cost Information Service (BCIS), which found 80% of commercial

property is underinsured, is largely all we have to go on. And that

dates from 2012.

Again, this may be something technology can help address. With

data captured by Duff & Phelps—currently used by insurance

companies for their clients approximately 5,000 times a year—we

can begin to build a real picture of the levels of underinsurance

around the world. For now, though, there’s little empirical

evidence; it’s all anecdotal. That makes it all too easy for

businesses to think an event will never happen to them.

Cruel to Be Kind

Even in light of all this, a call for regulation isn’t going to be

popular with everyone. As Ronald Reagan joked, “The most

terrifying words in the English language are: I’m from the

government and I’m here to help.”

In this case, though, regulation would greatly help both insurers

and their customers. That includes small to medium enterprises

(SMEs). In fact, it’s particularly true for them. They are, first, less

likely to benefit from insurers choosing to accommodate their

oversight and pay up to sums insured in full and they are the least

able to bear the cost of underinsurance if the worst happens.

Regulating valuations can help to protect SMEs from exposure

due to an existential threat. Specifically, for the dwindling numbers

of small industrial businesses, this could prove a key policy.

For insurers, meanwhile, tackling this problem once and for all

would help close the insurance gap, and provide greater certainty

for themselves and their customers, preventing disputes.

Some countries have already taken concrete steps to address

this. In Saudi Arabia, for instance, since April 1, 2016, businesses

with property policies written by locally-licensed insurance

companies must have a professional insurance valuation report

that is not older than three years. In Italy, meanwhile, there is no

regulation, but “insurance with declaration of value” policies are

widely used. These require an appraisal of the assets to indicate

the correct value to be insured.

In the U.S. and UK, though—where the market is beset with

regulation in so many other areas—the problem is allowed to

fester. Insurers and businesses have proved unable to tackle this

themselves; it’s time the regulators stepped in. This can help

promote a fairer, stronger commercial property insurance market

for everyone.

7

Insurance Valuation Today - May 2020

Duff & Phelps

New Ransomware Reality Could Lead to Regulatory Issues

The number of ransomware cases investigated by Kroll, a division of Duff & Phelps, quadrupled over the last seven months of 2019. In fact, ransomware surpassed business email compromises as the threat type most commonly reported to Kroll during the month of September and maintained this dubious monthly distinction throughout the end of the year.

While Ryuk was the most frequently reported ransomware, 13 new variants appeared in Kroll cases following the summertime ransomware spike. But apparently, threat actors are no longer content with simply creating new ways to lock up data; recently, they have raised the stakes by adding data collection and exfiltration to their arsenal of tactics, techniques and procedures (TTPs).

Ransomware Variants Investigated by Kroll

Bold items are new since August 30, 2019

“In Kroll’s investigative experience, and according to open- and

closed-source intelligence, ransomware actors were traditionally

more interested in collecting ransoms than in collecting sensitive

data. That all changed in November 2019,” said Ben Demonte,

North America Leader of Kroll’s Cyber Risk practice, who has

spoken on the issue at recent industry events.

The group behind Maze ransomware publicly exposed a victim

company’s data in November 2019 after the company failed to pay

the ransom. In mid-December, the same group created a public

website naming what it claimed to be additional victim companies

and threatening to expose their data if ransom demands were not

met (Figure 1). As of early 2020, the group has made multiple

updates to this “shaming site,” both removing companies and

adding new ones. Since its inception, the site has publicly outed

approximately 29 companies.

Dharma/CrySIS Actin

DoppelPaymer Adage

Evil Locker Bad Day

GandCrab Buran

GlobeImposter 2.0 Defray777

Hermes FabSysCrypto

Matrix FileCoder

Mr.Dec Horrible Morning

Nozelesn I-encrypt

Phobos Locky

RobbinHood MedusaLocker

Ryuk Megacortex

SamSam Rapid

Snatch

Sodinokibi

Tflower

WannaCry

8

Insurance Valuation Today - May 2020

Duff & Phelps

Threat actors behind other common ransomware variants may be

following the same path. In mid-December, an actor known as the

operator of REvil (aka Sodinokibi) ransomware claimed that each

of their attacks will be “accompanied by a copy of commercial

information.” According to the post, if payment demands are not

met, the data will be exposed. At this point in their post, they

added the phrase “GDPR,” possibly playing on organizations’

fears that such exposure could incur GDPR fines.

Prepare for a Bumpier Ride Ahead

Do these recent events constitute a long-term change in TTPs of

ransomware gangs? Or are these particular threat actors making a

quick bid for significant cash that will precede a retirement

announcement? So far, the answer remains to be seen, but clues

have emerged.

Earlier this year, the GandCrab operators announced their

retirement with a proclamation that they had earned more than

USD 150 million per year, stating “we proved that in a year you

can earn money for a lifetime.”

Kroll experts have previously offered best practices for

ransomware mitigation and recovery. “Multifactor authentication,

least privilege policies, vetting and securing all remote access

applications (including connections with managed service

providers and other third parties), creating and protecting

backups, and reinforcing a cyber security culture throughout the

enterprise should be at the top of every organization’s security

list,” added Ben.

But in this uncharted landscape, organizations must be able to

simultaneously grapple with regulatory requirements related to

data breach notifications. According to Ben, “I don’t think there’s a

worse time than in the midst of a ransomware attack to have to

assess whether—or how many – aspects of the organization’s

network have been compromised. Aside from simply not having

access to systems, recovery efforts can often obscure or

obliterate vital forensic evidence. In either case, it takes careful

investigation to determine the extent of potential data exposure.

This includes identifying attack vectors, other malware introduced

into the environment, where actors may have moved (e.g., email

accounts; collaborative platforms (e.g., SharePoint); finance,

human resources or ERP systems; on-premises or cloud

databases; to name a few) and the types of data viewed and/or

exfiltrated (PII, PHI, PCI-regulated, etc.) So, one ransomware

event can ultimately lead to myriad, time-sensitive, individual and

regulatory notifications.” These problems require different skill

sets and mitigation techniques in order to meet critical deadlines.

Kroll Experts Corner – Best Practices for Data Exposure

Following are some insights from Kroll experts on mitigating data

breach exposure from ransomware attacks.

Now that ransomware attacks bring the simultaneous prospect of

a data breach, organizations must understand that today’s stricter,

and often, multijurisdictional data privacy laws will also start the

clock ticking for potential notification. In addition to recovery

activities, initial response efforts will likely need to include

forensics and eDiscovery to ascertain the type and scope of data

affected.

Michael Quinn, Kroll Managing Director, commented that the value

of incident response planning cannot be overemphasized in these

situations. “Once you realize your data or network has been

compromised, there is no time to spare. If you have taken time to

create and regularly test an incident response plan, your team will

be better able to react quickly and confidently. Staff will know the

experts and other resources to call in, as well as when and how to

escalate response to the next level if needed.”

Figure 1

9

Insurance Valuation Today - May 2020

Duff & Phelps

“Leaders may also want to consider incident response retainers,

which can accelerate recovery while taking even more uncertainty

out of the equation. All this advance work and incident response

planning may pay additional dividends as part of a defensible

cyber security strategy when communicating with regulators and

other stakeholders, if notification becomes necessary,” he added.

According to Brian Lapidus, global leader of Kroll’s Identity Theft

and Breach Notification practice, most in-house teams will need

the help of experts in diverse disciplines for their notification

efforts to be effective and compliant. “First, it’s imperative to

determine the exact scope of a breach incident,” said Brian.

“We have seen where original estimates of affected individuals

have been substantially higher, and in some cases lower, after the

forensics reports come in. Experts in data scrubbing and

deduplicating can further refine the scope of notification.”

Brian continued, “The characteristics of the data—is the data

generally identifying, protected health information or credit-

related?—will also affect notification, as will the jurisdictions

where affected individuals reside. With many data privacy laws

compressing the timeframe for notification, being able to rely on

experts who can expedite overall decision-making and the

operational essentials of notification can bring enormous peace of

mind.”

Breach counsel, crisis communications professionals and a

breach recovery team who can manage the entire cycle of

notification—from letters, FAQs and websites to local and

international call centers, identify theft monitoring and restoration

services and auditable reports for regulators—can better protect

your organization’s reputation, brand and bottom line.

Validate Your Readiness

A ransomware attack can make response and recovery

exponentially more complex and costly when compounded by a

data breach. Speak with a Kroll expert today to learn how we can

help you strengthen your overall cyber security and mitigate

potential data breach exposure.

About Duff & Phelps

Duff & Phelps is the global advisor that protects, restores and maximizes value for

clients in the areas of valuation, corporate finance, disputes and investigations, cyber

security, claims administration and regulatory issues. We work with clients across

diverse sectors on matters of good governance and transparency. With Kroll, the

leading global provider of risk solutions, and Prime Clerk, the leader in complex

business services and claims administration, our firm has nearly 4,000 professionals

in 25 countries around the world. For more information, visit www.duffandphelps.com.

© 2020 Duff & Phelps, LLC. All rights reserved. DP200978

M&A advisory, capital raising and secondary market advisory services in the United

States are provided by Duff & Phelps Securities, LLC. Member FINRA/SIPC. Pagemill

Partners is a Division of Duff & Phelps Securities, LLC. M&A advisory, capital raising and

secondary market advisory services in the United Kingdom are provided by Duff & Phelps

Securities Ltd. (DPSL), which is authorized and regulated by the Financial Conduct

Authority. Valuation Advisory Services in India are provided by Duff & Phelps India Private

Limited under a category 1 merchant banker license issued by the Securities and

Exchange Board of India.

Mark BobberManaging DirectorFixed Asset Management and Insurance Solutions +1 414 225 1288 mark.bobber@duffandphelps.com

Brad SchulzManaging Director Fixed Asset Management and Insurance Solutions +1 630 541 4656 bradley.schulz@duffandphelps.com

Rebecca FullerManaging Director Valuation Advisory +44 (0) 79 4923 1846 rebecca.fuller@duffandphelps.com

Brian LapidusPractice LeaderIdentity Theft and Breach Notification Practice+1 615 577 6770blapidus@kroll.com

Benedetto DemonteManaging Director and North America LeaderCyber Risk+1 201 687 8732bdemonte@kroll.com

Nicole SetteSenior Vice PresidentCyber Risk+1 609 514 8225nicole.sette@kroll.com

CONTACTS

Michael QuinnManaging DirectorCyber Risk+202 384 6946michael.quinn@kroll.com

There are many ways we can remotely assist with your

replacement cost/insurance valuation needs during periods of

restricted travel. Utilizing high-definition satellite imagery and

virtual measuring tools, our team of professional appraisers

provides the following services:

• Tabletop appraisals of buildings, personal property and land

improvements

• Diagnostic reviews of statements of values

• Annual updates of insurable values

Interim Insurance Appraisal Services