Crisis Management And Disaster Recovery: A Matter For Experienced Forensic Advisors

Monday, June 24, 2013 - 08:17

The Editor interviews Troy Dahlberg, Douglas Farrow and Ginger Menown, Advisory Services Forensic Partners with KPMG LLP.

Mr. Dahlberg is a Partner in New York with the firm’s Forensic Practice. Troy has more than 30 years of experience providing accounting, auditing and consulting services to companies in many industries. 

Mr. Farrow is a Partner in the firm’s Forensic Practice and has over 25 years of experience assisting corporations, attorneys and their clients with a wide spectrum of financial, economic and accounting matters.

Ms. Menown is a Partner in Houston with the firm’s Forensic Practice. She has over 20 years of experience providing services in dispute resolution, investigations, mergers and acquisitions, valuation, financial advisory and auditing.

Editor: Please give us an overview of disaster situations that you have helped clients manage.

Dahlberg: We have assisted clients affected by the 9/11 terrorist attack, Oklahoma bombing, Japanese earthquake, Hurricane Irene and more recently Superstorm Sandy. Our work primarily involves economic accounting or other financial assistance to the companies that have been impacted by the disaster.

Farrow: For instance, we are currently assisting organizations of a wide range of sizes and industries that have suffered losses and/or incurred extra costs as a result of Superstorm Sandy. We are coordinating claim programs with management’s recovery plan, compiling cost data and assisting with quantifying economic and financial losses that companies have sustained as a result of the storm. In the past, we have worked on insurance claims in the tens and hundreds of millions of dollars for companies in diversified industries as a result of natural disasters such as earthquakes, floods and hurricanes.

For example, the 2011 storm in Thailand caused severe flooding that disabled the operations of many of Thailand’s main industries, including automotive, electronics, and agriculture. Specifically, the storm caused major disruptions for global companies that manufacture parts for the technology industry. This created a pile-on effect, or business interruption, as manufacturers in other countries were forced to halt production due to the inability to secure supplies or parts from Thailand. Both local businesses and companies abroad sustained losses and required assistance with preparing and substantiating lost revenue calculations.

Dahlberg: And some disaster situations are naturally occurring while others are man-made, such as the riots in Los Angeles following the arrest of Rodney King, which gave rise to a large insurance claim that related to economic damage suffered by businesses in the area. Similarly, we handled large insurance claims for 40 or 50 businesses that were adversely affected by the construction of a major metro subway system in Southern California.

Editor: Please explain how your approach might change based on the type of disaster, whether in relation to preparing or paying claims.

Dahlberg: In some situations, we gather economic information in order to make a financial claim against other people or organizations because of a disaster. Certainly insurance coverage may give a potential right for such claims against the insurance company, and these policies usually cover things like flood, earthquake, civil authority, power or utilities. Now, we also see policies that protect against claims by clients or customers, such as in the event of a labor strike.

Farrow: The approach to getting cost recovery from insurance companies as a result of a disaster is dictated by the insurance policy. The insurance claim may consist of business interruption, extra expense and property damages such as inventory loss. In addition to cost recovery under the insurance policy, when costs exceed insurance coverage, costs may be recouped through other sources, including government funding, such as Federal Emergency Management Agency, commonly known as FEMA. A company might turn to these other sources of funding for recovery, but this is an entirely separate course of action because the state or federal government may not reimburse until after the company files an insurance claim. But note, other sources of recovery funds are not limited to the insurance companies and government agencies.

Menown: On the claim-paying side, we gather information and provide the business interruption analysis that supports that claim. These are significant dollars relating to huge business interruptions, and we assist companies with determining the validity of a  claim and whether or not it meets certain regulatory requirements.

Dahlberg: Let me provide an example that illustrates the numerous possible approaches pursuant to a natural or man-made disaster. After a disaster, the affected companies have various economic recovery choices. For example, they could look to their insurance company for a civil authority claim because the area was closed off and thus not accessible to the public, which resulted in lost revenue.  Alternatively, the company may pursue damages from the government or other responsible parties.

Editor: What players within an organization get involved in these issues?

Farrow: Depending on the impact of a disaster on the organization, it may reach all the way up to the CEO. If a company decides to pursue an insurance claim, senior level executives such as the CFO or CEO are typically involved if the claim is relatively significant to the company, whereas a minor insurance claim may only require risk management. Externally, an adjuster working on the insurance side may be involved as well as the insurance broker and/or insurance company’s consultants. For a disaster like Superstorm Sandy, which had a major impact on many companies, we worked with the senior executives, often including general counsel and various departments.

Editor: What lessons have you learned from these disasters?

Dahlberg: The biggest lesson is this: companies may be well prepared for disasters operationally, but they are usually not prepared from an accounting, financial or even legal perspective.

We did a lot of post-Sandy work for healthcare institutions in the New York Area. They all had phenomenal emergency plans for patient care, evacuation procedures and other matters of public safety. But there was virtually no plan to capture costs or any other financial impact of a disaster, and to the extent that they had such a plan, it was not linked with other emergency plans surrounding a hospital evacuation or foreseeable additional expenses. In our world of financial accounting, it is more labor intensive to trace the actual economic impact of a disaster when systems are not already in place to document it.

And healthcare institutions face special challenges because of the public-safety need to evacuate and incur costs before the event, so they need to activate their emergency cost-recording systems during the preparation stage. Generally speaking, insurance coverage doesn’t begin until physical damage occurs, but many healthcare policies in the Northeast allow reimbursement for pre-event costs that are incurred under civil authority.

Farrow: Another important lesson relates to maintaining regular and constant communication with the insurance company to keep them apprised of the status of the claim and letting them know when you anticipate a problem. Insurance companies want to know as soon as possible the total anticipated claim amount and when that estimated figure should significantly change. When a company is impacted by a disaster, significant extra expenses are incurred to stabilize and restore the company’s operation.  A good way to maintain a steady cash flow during the recovery process is to secure and negotiate an advancement from the insurance company relative to the overall claim amount. This can be accomplished through establishing and maintaining good communications with the insurance company.

Dahlberg: And those expenses extend well beyond a simple tracking of third-party invoices for post-event expenses. It is more difficult to recreate the internal costs incurred while preparing for and dealing with a disaster, such as payroll. These costs are generally incurred in lieu of bringing in a third party to do the work and may need to be parsed out by department. So it’s best to avoid a need to figure these things out after the fact and from memory.

Menown: There are many different data elements that could be cost related to the disaster and, therefore, applicable to a claim. We help our clients with various forms of analysis on aspects that include geographic factors and internal and external communications, such as press releases. So it’s a lesson well learned to understand that a good database is critical for our work in responding to claimants and generating claims, particularly for clients with many different stakeholders. And not being able to respond to government inquiries can be a disaster in itself.

Editor: Certainly, companies may experience operational disruption in the wake of a natural disaster. Are companies often blindsided by other kinds of disruption?

Dahlberg: Yes, there may be disruption to financial and accounting systems as well as to computer systems, which may leave companies unable to access accounting department functions and critical financial and other data. These issues point to the need for data back-ups and other measures to ensure the integrity, safety, and reliability of company information, financial and otherwise.

Menown: Also, companies often don’t plan for the human resources they will need in a disaster situation, or they don’t account for the fact that reassigning people to disaster management tasks reduces the ability to handle day-to-day operations. Having a disaster recovery plan in place doesn’t always prepare companies for the particular circumstances of an actual event, so they may be surprised to learn what they really need in terms of bench strength, participation by senior management and the need for outside professionals, such as financial and insurance consultants.

Editor: What is the recovery process following a disaster?

Farrow: There are a number of issues that companies face relative to the recovery process post-disaster, but from an insurance claims perspective, the first step is to review and thoroughly understand the organization’s insurance policy to determine the coverage and recoverable losses.  In addition, the company needs to notify the insurance company of a possible claim.  The next step is for the company to gather, compile and analyze financial data that may be relevant to the preparation of an insurance claim. If the information has become unavailable due to damaged systems, then we would have to reconstruct the information.  Once the data has been collected, the analysis may include a review of historical financials as well as financial projections and forecasts. 

For example, for a business interruption claim, a company would need to analyze historical sales numbers to forecast their financial position for the period of interruption.  If property damage is a component of the claim, we would prepare a construction analysis and work with a contractor to make sure that all costs are supported by invoices and all invoices are paid and submitted with the claim. The company should also confirm, in advance, that the policy will cover the more esoteric items, such as expediting expenses, which involves paying above-market price.

Next is to prepare and present the losses to the insurance company. Here it is helpful for the insurance adjuster to be involved in the process, which can include monthly discussions and interim reports of costs incurred, or the extent of business interruption to date. Again, the idea is to provide information sufficient to secure the necessary cash advancements up to the insurance claim amount. This part of the process can involve more extensive negotiation with the insurance company.

Although we mentioned the need to complete the insurance claim process before seeking recovery from government funding, with larger claims for which we forecast expenses in excess of insurance coverage, we would strategize with organizations to prepare a FEMA, or other government claim, in tandem with the commercial claim.

Dahlberg: From another perspective, the process involves understanding the company’s legal and regulatory responsibilities as well as any exposure to third-party claims, which involves meeting with in-house and outside counsel. These are risk management issues that we address in collaboration with general counsel and all relevant company departments. We also want to determine if the company can seek recovery from a third party for damages suffered.

Take as an example a drug manufacturer tampering case. Here, we would have to determine the exposure to customers or to a possible regulatory investigation and then consider what the settlement terms might look like. So there’s a whole other world of disaster management beyond the insurance side.

Menown: And companies in this kind of situation also have to look at shareholder or class-action disputes plus any related appeals, all of which make for a longer recovery period. Shareholders tend to want issues to be resolved quickly, so the possibility of derivative suits is very real when dealing with a disaster recovery process that can take years.

Editor: What do companies need to know about complex property and business insurance claims?

Farrow: It is important to realize that insurance claims are triggered by the occurrence of unanticipated events outside of a company’s ordinary and customary business. Most companies may not have readily available resources, experience or personnel that are required to handle complex insurance claims in-house. Further, most major insurance policies reimburse companies for outside professional consulting services for insurance claim support.

Dahlberg: And usually those professional reimbursements cover the services of engineers or accountants who provide valuable input on constructing the claim rather than actually make the claim on the company’s behalf. Insurance companies are not keen on having attorneys and others make claims on behalf of a company, but they do understand the need for a company with limited resources to engage outside professionals to provide the required analyses.

Surprisingly, brokers and even members of corporate risk departments are usually not experts in the intricacies of policy language. As an example, there is a big difference between a loss and an insured loss, and it is very important to select a professional consultant that understands that distinction. The actual wording of policies is very tailored and literal, and it has been developed and litigated by the insurance industry for a very long time. For example, most of the damage from Superstorm Sandy was related to power outages, rather than property damage due to flooding, which is what everyone expected. And policy language is very different – as to deductions, limitations and periods of loss – in describing coverage for a power outage versus for property damage.

Editor: How do you address fraud, waste and abuse?

Dahlberg: Disastrous situations create an environment where normal safeguards are let down, and this opens up the door for people to be opportunistic and exhibit behavior that falls below their usual ethical standards. Many times, people feel they need to do whatever is necessary to restore business operations, so internal controls and approval chains may be relaxed. This is where fraud and abuse can enter, so companies need to establish specific control policies to oversee the unique expenses connected with all stages of a disaster situation, and these policies should temporarily supersede standing policies for normal business operations.

Menown: I agree. And some people actually practice fraud for a living by participating in organized fraud rings that artfully create documents to appear legitimate. Their hope is to take advantage of the large volume of information blowing through the system during a disaster scenario, and their impression is that company personnel are just pushing the “payment” button indiscriminately. I don’t think they realize the level of scrutiny our clients are getting. The reality is, we can figure this out and pick them out.

Dahlberg: It’s also important to remember that the disaster control systems are usually new to a company, and the financial aspects may not be the top priority. In the case of a man-made disaster, for instance, the public relations issue may take precedence over the operational aspects, which may indicate the need for different kinds of internal controls and scrutiny around the financial/accounting system. In all events, it’s a brand new system from what they use in the normal course of business and, therefore, is vulnerable to fraud and abuse.

Editor: How does data analytics play into your efforts and services?

Menown: In the claim space, we are called upon to analyze information by industry, geographical area and nature of claims, to name some. Databases help us sort, cut and dice that information, look at trends and identify what is not normal or what is potentially fraud related. This kind of analysis helps our clients analyze their positions and develop the right strategies. A key capability relates to external reporting, whether that is to the government, to a regulator, or in connection with a lawsuit, so it’s very important for companies to feel confident in reporting accurate information.

Farrow: Data analytics have revolutionized the approach and structure to recover from a disaster situation. Ten or fifteen years ago, we would compile supporting hardcopy documents such as invoices into three-ring binders that were then presented to the insurers. Today we employ data analytics that allow us to more efficiently and effectively compile cost data through electronic means, and to structure and strip that information down to the essential cost data, which is valuable not only from a fraud and abuse standpoint, but also in facilitating and expediting the claim process. These benefits only increase with the size of the claim and what’s at stake. We are currently working with an organization whose insurance claim is within the range of 50 to 200 million dollars. We are using data analytics to extract data from multiple cost-management and accounting modules of the organization’s information environment and create an offline “relational database” that allows more efficient and effective data retrieval and analysis. In turn, this will enable us to put forth a claim quickly and also identify fraud and abuse issues or unsubstantiated claim components as they may arise.

Dahlberg: In my experience with healthcare clients, data analytics helps us put together better documentation and, as Doug mentioned, extrapolate costs directly from an accounting system, deliver them straight to a third party and provide the ability to review the information thoroughly and even pull up the underlying documents to vouch for the amount and timing of an expenditure. Insurance companies, and the claims-analysis professionals they hire, are now expecting us to provide this data before claims are paid to our clients. It’s the new reality.

Editor: What can companies do ahead of a disaster to be prepared?

Farrow: As previously mentioned, the first steps are to understand your policy and establish a system to account for the financial consequences of a disaster. For example, if a company is alerted in advance of the disaster, it can establish various accounts in its general ledger to track and capture information related to external and internal costs, allowing the company to fully recreate the costs associated with recovery in the months following. It is best to understand in advance that some costs may be covered by insurance, some by the government and some not at all.

Dahlberg: And it’s a good idea to expand corporate disaster recovery plans – which typically cover the operational, regulatory, and public relations aspects – to include the financial, insurance, and legal aspects of recovery. People tend to focus myopically on enterprise risk and, let’s say, the risk du jour. Is the Federal Trade Commission currently focusing on a particular issue, or was there a flood somewhere that affects the supply chain, the customer base or the viability of an operations facility?

The truly difficult tasks in our global economy involve developing a comprehensive risk analysis, quantifying what the overall impact may be, performing an economic analysis to determine how to insure against these risks, and finally deciding what amount will be self-insured and what kinds of other coverage are warranted and effective.

Editor: What policies, procedures and controls should be in place before a disaster strikes?

Dahlberg: Companies should draw clear lines of responsibility and accountability because normal decision-making processes can break down quickly in disaster situations. Purchasing decisions have to be made in drastically shortened time frames – often in real-time and on the ground – and this authority likely will be given to someone who doesn’t normally make such decisions. So disaster-related policies and procedures should comprehend that normal business operations are out the window for the moment, and a new chain of authority and accountability is needed to manage the foreseeable changes required to operate in a destabilized environment. And these policies should cover the financial and accounting side as well.

Menown: Yes, and I would add that these policies and procedures need to be adaptable to what invariably are fluid conditions that may require key individuals to make adjustments as the situation progresses and they are continuously faced with managing the risk of the enterprise.

Editor: Should special provisions be put into effect when a company has global operations?

Dahlberg: Certainly, having global operations will require policies that are geared to a location, and additional resources may be required to deal with the economic, regulatory, governmental and public relations aspects with sensitivity to that particular part of the globe. It doesn’t necessarily make sense to allocate resources for this purpose under normal business conditions, but in a disaster situation, you need a strike team to function in the affected location and sustain its involvement throughout the entire crisis.

Editor: Do you have any further comments?

Farrow: In the world of insurance claims, I will emphasize the importance of continuous dialogue with the relevant parties involved. Frequent and strong communication during the recovery process can ensure that all parties are up to speed about the issues and facilitate a meeting of the minds in addressing the various issues, which can result in a swift and fair settlement between the parties.

Dahlberg: Also, because disasters present very real and immediate challenges, companies often forget to look at the long-term picture. Dealing with an earthquake certainly requires immediate action, but there should also be an awareness of the immense back-end and long-term nature of dealing with crises, and the tremendous drain on resources to actually see things through. Thinking through the issues over time can help companies properly and efficiently allocate internal and external resources and actually deal with the disaster more effectively.

Please email the interviewees at tdahlberg@kpmg.comdfarrow@kpmg.com or gmenown@kpmg.com with questions about this interview.