The question is: An online travel agency stores significant amounts of information, including customer details on its server. It is reviewing its insurance cover and the Risk Officer has suggested that cyber insurance should be purchased. (i) Suggest why the travel agency may purchase cyber insurance. [4] (ii) Outline the factors that an insurance company would take into account in assessing the risk premium for a company seeking cyber insurance cover. [5] (iii) Outline the areas of uncertainty associated with deriving a risk premium for cyber insurance. [3] My answer for iii is: - Latent claim in the future. - New way of hacking that makes database hacked much easier than now. - The customer’s information stored changed? - > For example, in the future, the company stored credit card information of customer as well. - The expansion/ shrinkage of the company. For example, expansion making the company storing more data, exposing to more risk. - The Human resources: the IT person of the agency changed, and the carefulness level inside the company reduce largely. - The investment in cyber security of the agency in the future: for example in the future the company cut cost for firewall and antivirus will lead to risk premium increase. No single point match the report. If you're the grader, how much points I get?
You needn't match the exact answer. For example, if a solution says 'expenses may go up because ...' whereas you say 'expenses may go down because ...' you're still likely to get the mark, so long as you have given a valid explanation. Glancing at the solution, I see it mentions the possibility of breaches being discovered years later - perhaps your latent claims idea might have scored here. If you find that you have still missed many answers, even allowing for this, it may be that you are not answering the question that has actually been asked. Go back and check the wording of the question, and review the main thrust of the answer to see if you have wandered off topic. More specifically for this question, key risks for a general insurer will very often centre on claims uncertainty (so think of why large losses / aggregations may occur, for example). It's a relatively new class of business so lack of data with which to price the business/estimate claims will also be a key problem. For more detail and exam technique, take a look at the ASET.
