Background Congress passed TRIA in 2002 to address some of the challenges the insurance industry and businesses faced after the September 11 terrorist attacks. For example, after the attacks, insurers left the market, excluded terrorism risk coverage from policies, or steeply increased premiums. The Real Estate Roundtable reported in 2002 that nearly $16 billion of real estate projects in 17 states were stalled or cancelled because of the lack of coverage for terrorism risk (because many businesses are required to have coverage for terrorism risk as a condition for a mortgage loan). The purpose of TRIA is to (1) protect consumers by addressing market disruptions and ensuring the continued widespread availability and affordability of commercial property/casualty insurance for terrorism risk; and (2) allow for a transitional period for private markets to stabilize, resume pricing of such insurance, and build capacity to absorb any future losses, while preserving state insurance regulation and consumer protections. By law, an insurer’s coverage for terrorism losses must not differ materially from the terms, amounts, and other coverage limitations applicable to losses arising from other events. For example, an insurer offering $100 million in commercial property coverage also must offer $100 million in commercial property coverage for certified acts of terrorism. Insurers may charge a separate premium to cover their terrorism risk. TRIA requires insurers to make terrorism coverage on certain lines of property/casualty insurance (such as coverage for fire, workers compensation, and liability) available to commercial policyholders (such as businesses), although TRIA does not require commercial policyholders to buy it. The federal government does not collect an up-front charge from insurers for the government’s coverage of terrorism risk under TRIA. In a 2019 report, we noted that the federal government has multiple programs that can provide compensation to specific third parties if they suffer certain losses from future adverse events, and the federal government may not always charge premiums for accepting this risk of loss. However, under TRIA, the government must recoup at least some of its losses following a certified act of terrorism, as discussed below. TRIA has not caused financial liabilities to the federal government, but it could require large, previously unbudgeted expenditures by the federal government if an event occurred. Certification of an Act of Terrorism for Purposes of TRIA and Claims Processing For insurers to start submitting claims and receiving payments to cover terrorism losses, Treasury must first certify an event as an act of terrorism under TRIA. Certification requires the Secretary of the Treasury to evaluate the event based on two criteria: 1. Did the event meet the nonmonetary definition established under TRIA? Defining an event as an act of terrorism includes determining whether it was “committed by an individual or individuals as part of an effort to coerce the civilian population of the United States or to influence the policy or affect the conduct of the United States Government by coercion.” It also includes determining whether it was a “violent act or an act that is dangerous” to human life, property, or infrastructure, and whether it resulted in damage within the United States or certain areas outside the United States. As part of this determination, the Secretary of the Treasury must consult with the Attorney General and Secretary of the Department of Homeland Security before certifying an event. 2. Did the event cause at least $5 million in insurance losses in TRIA-eligible lines? TRIA prohibits the Secretary of the Treasury from certifying acts of terrorism unless insurance losses exceed this threshold. In 2004 Treasury issued regulations to implement TRIA’s procedures for filing insurer claims for payment of the federal share of compensation for insured losses. Within 7 days after certification of an act of terrorism, a Treasury contractor is to activate a web-based system for receiving claims from insurers and responding to insurers that seek assistance. Loss Sharing under TRIA The Terrorism Risk Insurance Program provides for shared public and private compensation for insured losses resulting from certified acts of terrorism. Under the current program, if an event were to be certified as an act of terrorism and insured losses exceeded $200 million, an individual insurer that experienced losses first would have to satisfy a deductible before receiving federal coverage. An insurer’s deductible under TRIA is 20 percent of its previous year’s direct earned premiums in TRIA-eligible lines. After the insurer pays its deductible, the federal government would reimburse the insurer for 80 percent of its additional losses and the insurer would be responsible for the remaining 20 percent. Annual coverage for losses is capped––neither private insurers nor the federal government cover aggregate industry insured losses in excess of $100 billion. After an act of terrorism is certified and once claims are paid, TRIA requires Treasury to recoup part of the federal share of losses in some instances. Under this provision, when insurers’ uncompensated insured losses are less than a certain amount (up to $41 billion for 2020), Treasury must impose policyholder premium surcharges on commercial property/casualty insurance policies until total industry payments reach 140 percent of any mandatory recoupment amount. When the amount of federal assistance exceeds this mandatory recoupment amount, TRIA allows for discretionary recoupment. Prior TRIA reauthorizations decreased federal responsibility for losses and increased private-sector responsibility for losses, but the 2019 reauthorization of TRIA made few changes to the program. For instance, the 2015 reauthorization required incremental decreases in the federal share of losses over 5 years (to 2020). The 2019 reauthorization extended the program to December 31, 2027 and proportionately adjusted the dates by which the Secretary must recoup policyholder surcharges to the new reauthorized time frame, but it did not change the federal share of losses. TRIA-Eligible Lines of Insurance TRIA covers insured losses in eligible lines that result from a certified act of terrorism (see table 1). Many lines of commercial property/casualty insurance are eligible for TRIA, such as workers’ compensation, fire, and commercial multiple peril (multiperil) lines. States generally require that workers’ compensation insurance covers terrorism risk and do not permit exclusions, including for terrorism, according to Treasury. Workers’ compensation covers an employer’s liability for medical care and physical rehabilitation of injured workers and helps to replace these workers’ lost wages. TRIA also excludes certain lines (such as personal property and casualty insurance and health and life insurance). Terrorism coverage typically is embedded in all-risk property policies but also may be available in stand-alone policies, according to Treasury: Embedded. Most policyholders have terrorism risk insurance coverage embedded in a policy that covers other risks. Embedded policies are subject to TRIA’s “make available” requirements. In the event of a certified act of terrorism, policyholders would be covered if they have not declined terrorism coverage. Stand-alone. Stand-alone terrorism policies provide coverage only for terrorism risks. Insurers may provide stand-alone terrorism coverage through “certified” policies that are subject to TRIA terms and conditions and provide coverage only in the event of a certified act of terrorism. Alternatively, insurers may provide terrorism coverage through “noncertified” policies that do not meet TRIA terms and conditions. Such noncertified policies cover terrorism-related losses regardless of whether Treasury certifies an event, but losses paid by insurers would not be eligible for reimbursement under TRIA. Nonconventional Coverage under TRIA Nonconventional terrorism risks generally include nuclear, biological, chemical, or radiological (NBCR) weapons, as well as cyber risks. Predicting losses associated with nonconventional risks can be particularly challenging because of the difficulty in predicting terrorists’ intentions and the potentially catastrophic losses that could result. TRIA is silent on NBCR and cyber risks, but Treasury has clarified how these nonconventional risks are covered under TRIA. In 2004, Treasury issued an interpretive letter clarifying that the act’s definition of insured loss does not exclude losses resulting from nuclear, biological, or chemical attacks, and does not preclude Treasury from certifying a terrorist attack involving such weapons. According to Treasury’s interpretive letter, the program covers insured losses from NBCR events resulting from a certified act of terrorism. However, for TRIA provisions to apply, insurers must provide coverage for those perils. Most insurers are not required to provide NBCR coverage and generally have attempted to limit their exposure to NBCR risks by largely excluding NBCR events from property and casualty coverage. In December 2016, Treasury issued guidance clarifying that, to the extent that insurers write cyber insurance in TRIA-eligible lines, the TRIA provisions apply. We further discuss Treasury’s guidance on cyber risk later in this report. Program Administration and Reporting Requirements TRIA authorizes Treasury to administer the Terrorism Risk Insurance Program. The Secretary of the Treasury administers the program with the assistance of Treasury’s Federal Insurance Office, according to Treasury officials. TRIA requires Treasury to conduct a biennial study of the effectiveness of the program. The 2015 TRIA reauthorization added a requirement that insurers submit information to Treasury about the coverage they write for terrorism risk, including the lines of insurance with exposure to such risk, the premiums earned on such coverage, and the participation rate for such coverage. The 2019 reauthorization added a requirement that Treasury report on the availability and affordability of terrorism risk insurance, including an analysis specifically for places of worship. Since 2016, Treasury has completed annual assessments of the program, including a report on the effectiveness of the program in June 2018. Treasury’s reports focused specifically on small insurers in June 2017 and June 2019. Treasury conducts an annual data call to collect information for the required studies and for purposes of analysis and program administration. Participation in the data call is mandatory for all insurers that write commercial property and casualty policies in lines of insurance subject to TRIA, subject to two exceptions. Treasury collects data separately for the following four groups of insurers: Small insurers have both a policyholder surplus and prior-year TRIA- eligible direct earned premium of less than five times the program trigger. Nonsmall insurers have policyholder surplus or the specified premiums above the small threshold and are not classified as captive or alien surplus line insurers. Captive insurers are special-purpose insurance companies set up by commercial businesses to self-insure risks arising from the owners’ business activities. Alien surplus lines insurers are foreign insurers that are qualified to do business in the United States through a process administered by NAIC. The Market for Terrorism Risk Insurance Is Currently Stable with the Support of TRIA The market for terrorism risk insurance has been stable in recent years, with coverage both available and generally affordable. According to our reviews of policy language, reports from and interviews with Treasury, researchers, insurers, and other industry stakeholders, the expiration of TRIA and the absence of an alternative backstop to terrorism risk insurance would cause disruptions to the market. Terrorism Insurance Generally Is Available and Affordable in the United States Reports from Treasury and an industry risk-management firm generally suggest there has been a stable market for terrorism risk insurance in recent years, with the coverage available and generally affordable in the United States. According to Treasury’s reports analyzing industry data, the majority of commercial policyholders in the United States purchase terrorism risk insurance, and at a relatively small percentage of total premiums. The market for terrorism risk insurance in the United States continues to remain competitive for most buyers according to 2018 and 2019 reports by Marsh, an insurance risk-management firm. Marsh attributed the competitive market for buyers to a steady decline in the frequency of global terrorist incidents and minimal insurance claims. Take-up Rates Since all insurers must offer terrorism risk insurance, the availability of such coverage can be measured in terms of take-up rates—the rates at which policyholders select terrorism risk insurance. These rates have remained stable in recent years, according to Treasury. However, take-up rates vary by line of insurance, industry sector of the policyholder, geographic location, and type of insurer writing the policies. Terrorism risk coverage is considered available when insurers offer coverage for losses resulting from a terrorism event, and take-up rates are an indication of how insurers are complying with TRIA’s “make available” requirement, according to Treasury. Treasury found take-up rates by insurer category ranged from 62 to 78 percent in its 2018 report, depending on how the rates were measured. According to Marsh’s 2019 report, the take-up rate for terrorism coverage embedded in policies that cover other risks has been around 60 percent for the past several years. Lines of insurance. According to Treasury’s 2018 report, take-up rates across lines of insurance ranged from 43 percent in the products liability line to 83 percent in the boiler and machinery line in 2017, as measured by direct earned premium (see fig. 1). The take-up rate for cyber insurance coverage is in the middle of the range, relative to other lines of coverage. Specifically, the take-up rate in 2018 for terrorism risk insurance under cyber policies (by TRIA-eligible direct earned premium) was 69 percent for stand-alone policies, up from 50 percent in 2017, as reported by Treasury. For coverage that is part of an embedded policy, the 2018 rate was 63 percent, up from 54 percent in the prior year. Industry sectors. Take-up rates across the industry sectors of the policyholders varied widely and ranged from 7 percent in the information sector to 76 percent in the finance and insurance sector in 2017, according to Treasury’s 2018 report (see fig. 2). Marsh found in its 2019 report that commercial policyholders in the education, media, financial, and real estate sectors were the most frequent buyers of terrorism risk insurance in 2018. Geographic location. Take-up rates varied by location, with the highest rates in the Northeast. In Treasury’s 2018 report, the rates ranged from 50 to 75 percent by state (see fig. 3). In its 2018 report, Marsh noted that the Northeast had both the highest rate of purchase and the most expensive coverage, and said that these trends were because of the presence of major metropolitan areas (such as New York and Boston) that have high-value targets for terrorism. Premiums According to Treasury’s 2018 report, premiums associated with terrorism coverage have remained relatively consistent in recent years and are a small part of overall premiums for embedded policies. According to that report, about 80 percent of the market (as measured by terrorism risk direct earned premium) comprises embedded policies and 20 percent stand-alone policies, and the price for each varies. Premiums for terrorism risk insurance embedded in a property/casualty policy are priced at a relatively small percentage of the total premium charged for the policy and typically range from 2.5 to 3.0 percent when a charge is made. In about 30 percent of policies, insurers do not charge for providing terrorism risk coverage. Stand-alone policies vary significantly in terms of cost because of differences in the relative size or nature of exposures covered under each policy, whether the policy was certified, and the type of insurer providing the coverage, according to Treasury’s data. Premiums also varied across lines covered and insurer types, with the most premium collected for workers’ compensation. According to Treasury’s 2018 report, about 36 percent of the total premium collected in TRIA-eligible insurance lines was for workers’ compensation. In stand- alone cyber policies an average 6.2 percent of the total premium was allocated to terrorism risk. See table 2 for more information on how premiums vary across lines of coverage. Small Insurers and Captives Trends for small and captive insurers in many instances are different from trends for nonsmall insurers. Small insurers. Total market share for small insurers within TRIA-eligible lines of coverage declined, relative to nonsmall insurers, over the past decade. The small insurer market share, as measured by direct earned premium, fell from 18.6 percent in 2009 to 12.6 percent in 2018. (Despite that overall decline, there was an increase from 2016 to 2018 as more insurers were defined as small because of the increased dollar amount of the program trigger). In addition, take-up rates tended to be lower for policies written by small insurers, compared to nonsmall insurers, both within most individual lines and across the overall market. Small insurers generally charged less premium for terrorism risk insurance overall than nonsmall insurers, although they may charge proportionally higher premiums in some lines of insurance, such as commercial multiple peril (liability). According to Treasury’s 2019 report, small insurers allocated a lower percentage of direct earned premium for terrorism risk than nonsmall insurers. Furthermore, small insurers also were more likely to offer terrorism risk insurance for free. In addition, small insurers earned a higher percentage of their total program direct earned premium in commercial multiple peril and workers’ compensation lines than did nonsmall insurers. The workers’ compensation market is subject to very high loss amounts with no defined limits of liability and significant potential aggregation risks. Captive insurers. Like small insurers, captive insurers often have premiums that are small, relative to other insurer categories. However, captive insurers generally can offer broader coverage than commercial policies, according to Marsh’s 2019 report. The report states that a captive insurer often offers policies that cost less than policies from commercial insurers, which also often restrict coverage for NBCR or cyber events. In addition, according to Treasury a highly concentrated event affecting only captive insurers (or small insurers) carries a higher likelihood that the affected insurers’ losses would not meet the program trigger, and therefore would not be reimbursed under the program. In this case, captive insurers could incur significant losses. Absence of Federal Program Could Disrupt Markets Based on Analysis of Policies and Selected Stakeholder Perspectives There could be significant disruptions to the insurance market if no federal terrorism risk insurance program existed, according to our reviews of policy language, reports from and interviews with Treasury, researchers, insurers, and other industry stakeholders. As Marsh noted in its 2019 report, TRIA’s federal backstop remains crucial to the continued stability of the terrorism risk insurance market. In its 2018 report, Treasury concluded that TRIA had made the coverage available and affordable, supporting a relatively stable market over the past decade. According to NAIC, TRIA helps foster the existence of a broader market for risks that otherwise would be either largely uninsured or borne by taxpayers. In the absence of a loss-sharing program, insurers likely would limit coverage, exit certain markets, or attempt to increase capacity, according to our review of reports from the federal government, researchers, industry entities, and interviews with industry stakeholders. For example: Limiting coverage. Most insurers begin the process to limit their coverage more than a year before any TRIA expiration by filing conditional exclusions, which, in effect, limits terrorism risk coverage in the event TRIA expired. According to one industry association, insurers have filed conditional exclusions before each of TRIA’s reauthorizations, although they are not commonly used for policies more than a year away from a potential expiration of the law. Our analysis of several policy endorsements filed with conditional exclusions suggests that, in the event of TRIA’s expiration, insurers likely would limit the total losses associated with an attack, and exclude certain types of terrorist attacks. We reviewed a nongeneralizable sample of conditional exclusions provided by the Insurance Services Office, which representatives say are widely used in the industry, and several selected conditional exclusions from individual insurers. These policies suggest that insurers filing conditional exclusions cap coverage for losses associated with an attack at $25 million, and entirely exclude losses caused by NBCR weapons. One policyholder association said that TRIA’s potential expiration and the need to file conditional exclusions results in a chaotic process, with insurers needing to file exclusions in each state in which they operated. Exiting markets. In the absence of a loss-sharing program, some insurers likely would exit certain markets, no longer offering terrorism coverage in specific geographic locations or lines of insurance, according to federal and industry reports and interviews with stakeholders. Small and midsize insurers in particular may withdraw from providing terrorism risk coverage entirely, according to one industry association. Furthermore, insurers providing NBCR or workers’ compensation coverage may decide to limit the policy terms or stop providing coverage, because of the risk of increased losses and potential exposures, according to Treasury. In addition, workers’ compensation risks are greater in large, metropolitan, more densely populated areas, and there are higher aggregation risks for insurers in large metropolitan areas, particularly for events involving NBCR weapons. Small insurers tend to operate on a regional basis in a smaller number of states than nonsmall insurers, and thus have a significant presence in individual local markets, according to Treasury. Options for increasing capacity. Insurers told us that they also likely would increase their premiums and purchase additional reinsurance for terrorism coverage in the absence of a program, although their ability to do so may be limited. One insurer said that premiums likely would go up significantly, although rate increases are subject to state limits. According to another insurer, reinsurance coverage for terrorism risk likely would become more limited, and be provided at notably higher rates. Insurers that are public companies may be able to increase capital through the stock market to build loss-absorbing capacity to help mitigate their increased loss exposures if TRIA expired. However, mutual insurers are not owned by shareholders and therefore cannot raise capital through the sale of shares; instead, they would have to rely on other ways of building capital. Several industry stakeholders pointed to particular challenges for certain insurers and lines of coverage if TRIA expired and Congress did not establish another loss-sharing program. Small insurers. Small insurers may be particularly vulnerable, facing ratings downgrades or otherwise being forced to exit the market for terrorism risk coverage, according to industry stakeholders. In May 2019, AM Best, a credit rating agency that focuses on the insurance industry, said insurers that did not limit exposure to terrorism risk losses before TRIA’s potential expiration in 2020 could face negative ratings pressure. AM Best identified 30 insurers (of about 230 with significant terrorism risk exposure) that failed stress tests, but said in October 2019 that implementation of plans established by these insurers would mitigate concerns about insolvency in the event TRIA expired and a terrorist attack occurred. The 30 insurers generally were small or midsize insurers. Captive insurers. Captives (entities that businesses set up to self- insure) generally require private reinsurance to insure against terrorism risk, and it is unclear if there would be sufficient capacity in the reinsurance market to obtain this coverage without TRIA. Captives tend to insure against a broader range of risks, including NBCR and cyber risks, when that coverage is unavailable or unaffordable in the market. One industry association representing captive insurers noted that captive insurance likely would become a more common way to insure against terrorism risk without a federal loss-sharing program. However, it warned that captive insurers may lack the capacity to ramp up operations quickly enough or secure the necessary reinsurance to fully absorb the risk of increased losses. NBCR coverage. Coverage for terrorism attacks involving NBCR weapons, which is already limited, would be further limited without a federal loss-sharing program, according to industry stakeholders. One industry association of insurance agents said that insurers’ capacity to absorb losses from such an attack would be a challenge without a backstop, as it was during the aftermath of the September 11 attacks, when there was very little capital devoted to coverage for terrorism risk. The representatives said this capacity would be even more limited for an NBCR attack, as losses could be significantly greater and few insurers offer NBCR coverage. Workers’ compensation coverage. The cost of coverage for workers’ compensation likely would increase significantly and availability likely would decrease without a federal loss-sharing program, according to researchers. Insurers have less flexibility to control terrorism exposure in workers’ compensation coverage, relative to other TRIA-eligible lines, according to Treasury. As noted earlier, state laws require employers to have the coverage and prohibit insurers from excluding terrorism risk, including NBCR risks, from workers’ compensation policies, according to Treasury. Insurers might respond to the absence of a federal loss-sharing program by not providing workers’ compensation coverage to employers, particularly those near high-risk targets in major metropolitan areas, according to a 2014 RAND Corporation policy brief issued before TRIA’s 2014 expiration. The brief added that this would force high-risk employers in these areas to obtain the required coverage from the residual market (state-run insurers or mechanisms of last resort), in which premiums are higher. In addition, the absence of a loss-sharing program could disrupt policyholders and the greater economy by stalling new building projects. Some stakeholders noted concerns that new building projects might be stalled if the law expired, similar to concerns in the weeks and months following the September 11 terrorist attacks. At that time, policymakers were concerned that the reduction in coverage by insurers uncertain of future losses would render commercial developers in high-risk areas unable to finance their projects, according to a report by the Congressional Budget Office. An insurance industry association told us businesses might find it difficult to obtain terrorism risk insurance, particularly for high-value projects in cities considered high-risk, such as New York and Washington, D.C. Treasury Has Certification and Claims Processes but Communication on Certification Is Limited Treasury has a process to certify acts of terrorism. However, industry stakeholders said Treasury does not publicly communicate information about the process and the lack of timely information might negatively affect the speed with which insurers respond to policyholder claims. Additionally, Treasury is to consult with DOJ and DHS but DHS’s understanding of its role during the certification process appears inconsistent with Treasury’s purpose, and no agreements document these roles. Treasury also has a process to pay insurer claims and has issued guidance concerning how cyber insurance is treated under TRIA. Treasury Incorporated Flexibility into Its Certification Process Treasury has established a process for certifying an event as an act of terrorism that provides the Secretary a flexible time period for gathering information after an event. Before insurers may submit claims under TRIA, the Secretary must certify an event as an act of terrorism. Congress directed Treasury to study the certification process in the 2015 reauthorization of TRIA, including the establishment of a “reasonable timeline” for a certification determination. In response, Treasury sought and received public comments on the process. Treasury issued its conclusions in an October 2015 report. According to this report, seven of the nine comments received recommended Treasury adopt a timeline governing the certification decision. But Treasury concluded the certification process must provide the Secretary with flexibility to gather information after an event, and thus a “rigid” timeline for certification would not be appropriate. Instead, Treasury concluded that “enhanced public communication” about the status of the Secretary’s assessment of an act may address commenters’ concerns. Treasury established an interim final rule for the certification process in December 2016. Treasury’s process for certification decisions includes an internal review phase and a public review phase before Treasury can make a determination (see fig. 4). Internal review phase. During this phase, Treasury establishes and convenes a certification management team and prepares a brief for the Secretary, according to interviews with agency officials and our review of Treasury documents. Treasury may conclude the internal review of an event without progressing to the public review phase. Public review phase. The public phase of the certification process includes communication requirements set by Treasury’s certification regulations. TRIA regulations direct that within 30 days of the Secretary commencing review of an event, Treasury must publish a notice in the Federal Register informing the public that an act is under review for certification. Treasury also may publish a notice that it is not reviewing an act for certification. The regulation does not establish a timeline by which the Secretary must begin reviewing an event, which leaves the timeline for certification flexible. Treasury’s public announcement that an event is under review begins a series of requirements for public notification and consultation with other agencies, according to TRIA regulations. As of March 2020, Treasury has not conducted the public review phase of its certification process. When the Secretary of the Treasury’s review concludes that an act satisfies the elements of certification, the Secretary then is to consult with the Attorney General and the Secretary of Homeland Security within 30 days, or as soon as practicable. According to our review of Treasury documents, this Secretary-level consultation is to occur immediately before Treasury issues a certification decision. According to interviews with officials and Treasury documents, Treasury engages with staff in specific offices in DHS and DOJ much earlier in the process, during the internal review phase. Coordination with officials in these offices continues throughout both phases of the certification process. For example, Treasury documents state it may hold conferences with DHS and DOJ to discuss factors relevant to making a recommendation to certify an event. No later than 5 business days after the certification determination, Treasury must publish a statement in the Federal Register notifying the public. By contrast, the UK’s terrorism risk insurance program publicly communicates clear timelines by which government entities must certify potential events. The UK Treasury has 21 days to certify an event once the program administrator requests a formal review. This deadline was extended from 10 days in 2015 to allow the police enough time to determine if an event met the definition of terrorism, according to UK Treasury officials. This timeline was chosen to balance providing time for certification with ensuring that businesses would see claims paid quickly. Regular communication with industry stakeholders after an event maintains confidence in the certification process, they said. Treasury’s Internal Review Phase Generally Not Publicly Communicated Treasury’s procedures for certifying an event do not include public communication of its internal review phase. Steps Treasury is to take during this internal review stage include establishing and convening a certification management team and preparing a brief for the Secretary, according to interviews with agency officials and our review of Treasury documents. To date, Treasury has not communicated to industry stakeholders whether it was reviewing events as possible acts of terrorism. Treasury officials told us that after events have occurred, they have looked into the circumstances and the amount of insurance losses caused. These considerations did not progress past the internal review phase of the certification process, which meant Treasury did not publicly communicate that it was reviewing these events for certification. For example, Treasury conducted internal reviews after the Boston Marathon bombing in 2013, but Treasury did not publicly communicate that it was looking into the event or that it had decided not to formally review the event for certification. Treasury ultimately did not certify the event because insured losses from the bombing on TRIA-eligible lines of insurance totaled $2.1 million, which was under the $5 million certification threshold, according to Massachusetts state insurance officials. In interviews and formal public comments on Treasury’s proposed certification rule, some industry stakeholders said the Boston Marathon bombing raised questions about the certification process because they viewed the event as a clear terrorist attack. It was unclear to some industry stakeholders if the event was not certified because it did not reach the monetary loss threshold for certification, which was unknown at the time, or because it did not meet TRIA’s nonmonetary requirement for establishing intent. Insurers and industry stakeholders told us they were uncertain about the length of time Treasury would take after future events to communicate that it was considering certification. All five insurers we interviewed said they would like improved communication from Treasury after an event like the Boston Marathon bombing. Treasury officials said that in response to the Boston Marathon bombing, they documented procedures for certification. However, these procedures do not include steps to communicate publicly during the internal review phase, according to our review of Treasury documents. If a future event analogous to the Boston Marathon bombing were to occur, under Treasury’s current procedures it would not communicate the status of its internal review publicly, and public communication would not occur if it chose to conclude its review before the public review phase began. Implication of Certification of an Act of Terrorism for Terrorism Risk Insurance Act (TRIA) Coverage TRIA is designed to share losses from a certified act of terrorism between insurers and the government. For insurers to receive support from this federal backstop, they must offer insurance for “acts of terrorism” defined in a manner consistent with the law, which requires certification by the Secretary of the Treasury. A certification determination affects policyholders differently, depending on if they purchased or declined terrorism coverage. Specifically, insurers would pay claims from policyholders that purchased terrorism coverage in the event of a certified act of terrorism, whereas insurers would not pay claims from policyholders that declined terrorism coverage. Insurers could face uncertainty about whether to pay claims on both policy types, however, if the Secretary of the Treasury does not make a certification determination. This is because the definition of an act of terrorism in insurance policies for both policy types is often linked to certification. Industry stakeholders and insurers we interviewed said they need to know whether Treasury is considering certifying an event to help provide certainty in paying policyholder claims and receiving reinsurance payments (see sidebar). Policyholder claims. Industry stakeholders and four of five insurers we interviewed said Treasury’s lack of communication about an event’s potential certification can lead to uncertainty about whether to pay claims on policies—both those that include and exclude terrorism coverage. Delays in paying claims while waiting for communication about certification put them at risk of violating their agreements with policyholders and state laws, they said. Insurance policies typically have timeline requirements for the insurer to investigate and pay claims, and some state laws require insurers to pay claims by a certain date, according to NAIC. Treasury officials said state requirements to pay claims by a certain date may receive extensions under state regulation when uncertainty requires that a claim investigation continue. One insurer with which we met said that a statement from Treasury when it was considering an event would help them determine whether to pay claims or not. Reinsurance. Industry stakeholders said uncertainty would delay reinsurance coverage. If insurers delayed paying policyholder claims because of uncertainty about certification of a terrorist attack, reinsurers also might delay payments to insurers. Reinsurance payments are often triggered by the insurer’s payment of a claim to the policyholder. Additionally, some reinsurance contracts may define terrorism specifically as a Treasury-certified act of terrorism, and may be contingent on Treasury making a certification determination. The goals of TRIA are to foster market stability and to protect consumers by addressing market disruptions. In addition, according to federal standards for internal control, management should externally communicate the necessary quality information to achieve the entity’s objectives, including communicating with external parties. Treasury officials said they have not chosen to set a deadline for public communication after a potential terrorist event because they need flexibility to collect accurate information about events whose circumstances can vary widely. In the preamble to its interim final rule on certification, Treasury concluded that public communication about the certification process provides the public with necessary information while avoiding the problems Treasury raised with establishing a strict timeline. However, Treasury’s internal review phase includes no public communication. Additionally, Treasury may conclude its review of an event without progressing to the public review phase and therefore may not issue any public communications on the event. Without public communication about when it is considering certification, Treasury risks contributing to market uncertainty rather than stability after an attack. Treasury Consults with DOJ and DHS, but No Agreements Document the Agencies’ Roles TRIA requires cabinet-level consultation with DOJ and DHS in the public review phase of the certification process, but Treasury officials also conduct staff-level consultations. Treasury officials consult with DOJ’s National Security Division and DHS’s Support Anti-terrorism by Fostering Effective Technologies (SAFETY) Act office during the internal review phase of the certification process and have identified a single point of contact in each office (see sidebar). Consultation Agencies The Department of the Treasury consults with two other federal offices in the Department of Homeland Security (DHS) and the Department of Justice (DOJ), respectively, that have the following responsibilities: The Support Anti-terrorism by Fostering Effective Technologies (SAFETY) Act Office in DHS provides liability protections to manufacturers and sellers of specified anti-terrorism technologies. The Office of SAFETY Act Implementation reviews if an attack meets the SAFETY Act definition of an act of terrorism and if terrorists use such technology in the course of an attack, according to DHS officials. The Secretary of Homeland Security then determines whether an act has met the size and intent definitions of the SAFETY Act. DOJ’s National Security Division also makes recommendations for the International Terrorism Victim Expense Reimbursement Program, which provides funds to compensate victims of international terrorism occurring outside the United States. The Assistant Attorney General for National Security, in consultation with the National Counterterrorism Center, then determines whether to certify an event for the program, according to DOJ officials. determine whether an event meets TRIA’s definition of an act of terrorism. Such information might include things like who claimed responsibility for the event or evidence of the motivation for the attack. Officials said they provide this information upon request within 24 hours after an event. DOJ officials said the process they use to review events for TRIA purposes is similar to that used for DOJ’s International Terrorism Victim Expense Reimbursement Program. In contrast, DHS officials said their office does not provide information about an event to Treasury for purposes of certification, and that they believed DOJ would have the majority of this information. They said DHS informs Treasury about whether the event is being reviewed for the purposes of the SAFETY Act and whether terrorists used SAFETY Act-qualified technology (see sidebar). DHS officials said this is the information Treasury has requested from them and they consult with Treasury because many applicants for SAFETY Act designations have insurance policies backed by TRIA. Treasury officials stated that that they expect these two DHS and DOJ offices to serve as a single point of contact and coordinate with other relevant offices in their agencies as needed. DOJ officials confirmed they see this as their role, and said they would work with other offices in DOJ, including the Federal Bureau of Investigation, to consult with Treasury on certifying an act of terrorism. However, DHS officials said they do not see this as their role. The Secretary of the Treasury must consider, along with monetary requirements, the nature and motivation behind a potential terrorist attack to determine if it meets TRIA’s definition of an act of terrorism, according to TRIA regulations. Coordination among Treasury, DOJ, and DHS allows the Secretary access to critical and timely information relevant to certification, according to Treasury. In addition, according to federal internal control standards, management should use quality information to achieve the entity’s objectives, which includes identifying information requirements and obtaining relevant data from reliable sources in a timely manner. The standards also state that agencies should use methods such as written documentation to internally and externally communicate the information needed to achieve their objectives. In addition, our 2009 report on disaster planning provides an example of the benefits of clearly defined roles among federal agencies. We reported that defining the roles and responsibilities of stakeholders prior to a disaster could help foster collaboration, and that effective recovery plans should identify specific roles and responsibilities among various stakeholders. However, Treasury has not documented DOJ’s and DHS’s roles in certification consultations and instead relies on informal relationships with agency staff. This may contribute to the different perspectives DHS officials had on their role in the process. Treasury officials said although they do not have a written agreement, each agency understands its obligation to consult with Treasury in light of TRIA’s provisions requiring it. Although each agency told us it understood the certification process, DHS officials and Treasury differed in their understanding of DHS’s role in certification. A documented agreement among the agencies would provide procedures on roles and information sharing to which to refer during the potentially chaotic aftermath of a terrorist attack. As agency staff change over time, documenting these roles and information sharing among Treasury, DOJ, and DHS could help ensure continuity of operations if future events occurred. Furthermore, a written agreement would help Treasury access quality information and help ensure a smooth and timely process for certifying events under TRIA. Treasury Has Developed and Tested a Process for Fulfilling Insurer Claims for the Federal Share of Losses Treasury has a process for fulfilling claims that uses a web-based system developed and operated by a contractor. Once the Secretary certifies an act of terrorism, Treasury is to issue a task order to the contractor, which is to make the claims website operational within 7 business days, according to its contract. The claims process begins for insurers when their total insured losses exceed 50 percent of their deductible within a calendar year, at which point insurers must submit a form notifying Treasury. An insurer may claim the federal share of compensation when its total insured losses exceed its deductible for a calendar year, according to TRIA regulations. The responsibilities of Treasury’s contractor include reviewing and testing the web-based claims system; activating and providing ongoing operation of the claims system; receiving and reviewing insurers’ required documents for completeness and accuracy; obtaining information from insurers as needed and answering questions by email and telephone; and recommending Treasury pay claims. Treasury’s contractor has developed operating guidelines that detail work flows and controls for how it will begin processing claims. The operating guidelines include a plan to transfer existing staff from other responsibilities to operate the claims process, as needed. According to the contractor, staff responsible for processing claims in the event of a certified terrorist attack participate in an annual training session. Treasury’s contractor also built quality checks within its web-based system to automatically review submissions. Moreover, Treasury’s contractor has tested the web-based claims system. The contractor said it completed more than 40 rounds of readiness testing since 2004. The contractor must conduct readiness testing at least three times a year and test contingency plans and disaster recovery procedures at least annually, according to the contract. In addition, Treasury’s contractor developed a demonstration website that is publicly available (see fig. 5). Of the five insurers GAO interviewed, one said it used the demonstration website, two said they had not, and two were unsure if anyone in the company had used the website. The contractor said they previously have invited insurers to participate in testing. The website outlines the general claims process and includes the forms insurers would submit in the event of a certified terrorist attack. Most industry stakeholders who were familiar with the claims process told us they found it to be clear. Those stakeholders who were unfamiliar with the process said they had no concerns about it at present. Of the five insurers we interviewed, three said the only concern they had regarding the claims process is how quickly Treasury would certify an event and pay insurers’ claims. One insurer said the claims process was clear, and one said it was unable to comment because it had not tested the process. Guidance on Cyber Coverage under TRIA Is Clear to Selected Industry Stakeholders In December 2016 Treasury issued guidance clarifying that, to the extent that insurers write cyber insurance under an embedded or stand-alone policy in TRIA-eligible lines, the TRIA provisions apply. In our May 2014 report, we found insurers were uncertain about whether TRIA covered risks from a cyberterrorism attack, and recommended that Treasury clarify whether losses that may result from cyberterrorism were covered under TRIA. Treasury’s 2016 guidance included three elements: 1. Treasury considers cyber policies that are reported under the “cyber liability” line for state regulatory purposes to be “property and casualty” insurance under TRIA, and therefore eligible for payment of the federal share of compensation in the event of a certified terrorist attack. 2. Policies only would be eligible if insurers made the same required disclosures to policyholders about the program as other TRIA-eligible lines. 3. Treasury requires insurers to provide disclosures and offers that comply with TRIA and the program regulations on any new or renewal policies reported under the cyber line. Industry stakeholders said that Treasury’s guidance about cyber insurance coverage under TRIA was clear. Some industry stakeholders said that there was some initial confusion about the guidance because it indicated the NAIC created a new line for cyber liability on the property/casualty annual statement, although this was not the case. According to NAIC representatives, changes were made to how insurance products were coded for rate-filing purposes, and these changes did not affect the lines of business reported on the property/casualty annual statement state page. Treasury officials said there may have been some ambiguity in how they communicated the 2016 guidance. NAIC representatives said despite this initial confusion, the industry understood the guidance. Industry stakeholders said that questions remain about what type of cyberattack Treasury would certify as an act of terrorism. TRIA’s definition of an act of terrorism requires an act “to have been committed by an individual or individuals as part of an effort to coerce the civilian population of the United States or to influence the policy or affect the conduct of the United States government by coercion.” However, according to industry stakeholders and industry analysts, the nature of a cyberattack means that tracing and attributing the event to an individual is difficult. Additionally, generally the Secretary of the Treasury may not certify an act if it is committed as part of a war declared by Congress. The Advisory Committee on Risk-Sharing Mechanisms, which provides recommendations to the Federal Insurance Office about risk sharing for terrorism losses, has been researching issues related to cyberterrorism insurance. According to this advisory committee, this group will provide Treasury with recommendations regarding this and other issues in spring 2020. Conclusions Since shortly after the attacks of September 11, 2001, the Terrorism Risk Insurance Program has helped to ensure stability in the market for terrorism risk insurance, with the coverage generally available and affordable. However, insurers and policyholders are not aware of whether, and through what process, Treasury considers certifying an event as a terrorism event. Without public communication about when it is considering certification, Treasury risks contributing to market uncertainty rather than stability after an attack. The purpose of Treasury’s required consultation with DHS and DOJ in certifying an event is to provide Treasury the necessary law enforcement, intelligence, and homeland security information within the two agencies’ authorities and jurisdictions. However, DHS’s understanding of its role in the internal review phase of the certification process appears to differ from this stated purpose. Treasury has established and maintained informal connections with both agencies, but it has not documented these roles. By documenting agreements between Treasury and the two consulting agencies, Treasury can obtain quality information to help ensure a smooth and timely certification process. Recommendations for Executive Action We are making the following three recommendations to Treasury: The Director of the Federal Insurance Office should publicly communicate information about when it is considering certifying an event as an act of terrorism under TRIA. (Recommendation 1) The Director of the Federal Insurance Office should document an agreement with DHS about DHS’s role, and how the agencies share information, during the process of certifying an event as an act of terrorism under TRIA. (Recommendation 2) The Director of the Federal Insurance Office should document an agreement with DOJ about DOJ’s role, and how the agencies share information, during the process of certifying an event as an act of terrorism under TRIA. (Recommendation 3) Agency Comments We provided a draft of this report to Treasury, DOJ, DHS, and NAIC for review and comment. DOJ and NAIC did not have any comments. Treasury provided written comments through the Federal Insurance Office, which are reproduced in appendix II and discussed below. Treasury and DHS provided technical comments, which we incorporated as appropriate and discuss below. We also solicited and received technical comments from the UK Treasury and incorporated them as appropriate. In its written comments, Treasury agreed with our three recommendations and described how it would address them. In response to our first recommendation, Treasury stated that it will consider potential changes to the certification process in conjunction with the results of the review by the Advisory Committee on Risk-Sharing Mechanisms of certification procedures (due in spring 2020). In response to our second and third recommendations, Treasury said that it will further coordinate with DOJ and DHS on their respective roles and evaluate any additional steps to clarify their roles in investigating potential events. In technical comments, DHS questioned our characterization of its role during the certification process. DHS reiterated that it would provide Treasury with information on how DHS handles an incident in relation to the DHS SAFETY Act process, and not information regarding any possible investigation of a terrorist event. DHS stated that this is the information Treasury requested from the office for potential events in the past. However, we found that Treasury has not documented the type of information it expects from each agency during its internal review phase and maintain that information related to the DHS SAFETY Act process is inconsistent with Treasury’s purpose for consultation—to obtain law enforcement and intelligence information. We maintain that documenting the information Treasury expects from each agency would ensure that Treasury obtains the information it needs to make a certification decision. We are sending copies of this report to the Secretary of the Treasury, the Acting Secretary of Homeland Security, the Attorney General, and other interested parties. In addition, the report is available at no charge on the GAO website at https://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-8678 or garciadiazd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. Appendix I: Objectives, Scope, and Methodology In this report, we use “TRIA” to refer to the Terrorism Risk Insurance Act of 2002 and its subsequent reauthorizations. The objectives of our report were to examine (1) the current market for terrorism risk insurance and TRIA’s role in the market; and (2) the Department of the Treasury’s (Treasury) certification and claims processes, and industry stakeholders’ views on these processes, including guidance on cyber risk coverage. To address these objectives, we reviewed the Terrorism Risk Insurance Act of 2002; Terrorism Risk Insurance Extension Act of 2005; the Terrorism Risk Insurance Program Reauthorization Acts of 2007, 2015, and 2019; and implementing regulations, and congressional records. We also reviewed prior GAO work on this topic. We interviewed officials from the Treasury, National Association of Insurance Commissioners (NAIC), and Congressional Research Service and reviewed relevant reports from these entities. We also interviewed and reviewed reports from an academic researcher and several industry participants to obtain information for all our objectives, including insurers, representatives from insurance trade associations (representing insurers, reinsurers, mutual insurers, and captive insurers), risk modeling firms, and a rating agency. Specifically, we obtained information from five insurers. In all interviews, we asked participants about the potential effects of TRIA’s expiration on terrorism risk coverage, the effect of changes to the program from 2015 to 2020, and their views on Treasury’s certification and claims process, and guidance on coverage for cyberterrorism. We initially contacted eight insurers—four from among the largest U.S. commercial property and casualty insurers in TRIA-eligible lines of business (according to SNL Financial) and four smaller insurers previously recommended by insurance brokers and trade associations during prior GAO work. Five of these eight insurers, all of whom provided terrorism coverage to businesses, responded to our request and agreed to meet with us. Among these five insurers, two were large, two were small, and one was a captive insurer; two provided workers’ compensation and one provided cyber risk coverage. We determined that the information we obtained from these five insurers was sufficient for the purposes of obtaining a range of views of the market, but it is not generalizable to the practices of other insurers not included. To describe the current status of the market for terrorism risk insurance and how the market might be affected if TRIA were to expire, we reviewed annual Treasury reports on the program from 2017, 2018, and 2019, as well as reports from Marsh, an insurance risk-management firm, and other industry stakeholders. We reviewed these reports for information on affordability and availability of terrorism risk insurance, including data on take-up rates, premiums, geographic coverage, and trends over time. We also reviewed language in insurance policies that excluded some terrorism coverage in the event that TRIA was not reauthorized. To assess Treasury’s certification and claims processes, we reviewed documentation on the certification process, including Treasury’s internal policies and websites. We interviewed agency officials and the contractor responsible for operating the claims process after a certified terrorist attack, and we reviewed Treasury’s contract with this operator and the contractor’s internal policies. We also interviewed officials from the Departments of Homeland Security and Justice regarding their role in consulting with the Secretary of the Treasury on certification decisions. We reviewed relevant documents from the Organisation for Economic Co- operation and Development and relevant industry reports from four foreign countries with terrorism risk insurance programs: Australia, Belgium, Israel, and the United Kingdom (UK). We selected these countries because their terrorism risk insurance programs require certification by a government entity to pay claims. We interviewed the terrorism risk insurance pool operator and the certification entity for the UK because this program includes a short (21-day) timeline for certifying terrorist events. Additionally, we interviewed and reviewed documentation from a U.S. company that provides loss estimates, primarily to the insurance-linked securities market, which investors use to determine if a catastrophe bond has been triggered by an event. We compared Treasury’s certification and consultation process against criteria in federal internal control standards on management communication. To determine how cyber terrorism is covered under TRIA and in commercial policies, we reviewed Treasury guidance. We also met with Treasury officials and representatives of the Insurance Services Office, a property/casualty insurance industry association that develops standardized policy language, and reviewed its standard policies for cyber insurance. We also reviewed Treasury reports on cyberterrorism coverage, including data on take-up rates and direct earned premiums for cyberterrorism risks. We conducted this performance audit from April 2019 to April 2020 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: Comments from the Department of the Treasury Appendix III: GAO Contact and Staff Acknowledgments GAO Contact: Staff Acknowledgments: In addition to the contact named above, Jill Naamane (Assistant Director), Nathan Gottfried (Analyst in Charge), Anna Blasco, William R. Chatlos, Giselle Cubillos-Moraga, Kaitlan Doying, Karen Jarzynka-Hernandez, May Lee, Barbara Roesmann, Jessica Sandler, Jena Sinkfield, and Rachel Whitaker made significant contributions to this report. Related GAO Products Terrorism Risk Insurance: Market Challenges May Exist for Current Structure and Alternative Approaches. GAO-17-62. Washington, D.C.: January 12, 2017. Terrorism Risk Insurance: Comparison of Selected Programs in the United States and Foreign Countries. GAO-16-316. Washington, D.C.: April 12, 2016. Terrorism Insurance: Treasury Needs to Collect and Analyze Data to Better Understand Fiscal Exposure and Clarify Guidance. GAO-14-445. Washington, D.C.: May 22, 2014. Terrorism Insurance: Status of Coverage Availability for Attacks Involving Nuclear, Biological, Chemical, or Radiological Weapons. GAO-09-39. Washington, D.C.: December 12, 2008. Terrorism Insurance: Status of Efforts by Policyholders to Obtain Coverage. GAO-08-1057. Washington, D.C.: September 15, 2008. Terrorism Insurance: Implementation of the Terrorism Risk Insurance Act of 2002. GAO-04-307. Washington, D.C.: April 23, 2004.