Behind the Times.

Today's fast-changing e-commerce risks require insurers to re-evaluate products and the ways in which exposures are assessed.

It's no surprise that the cyber-age has spawned widespread dependence on computers and the Internet to conduct business. But what is amazing is the speed with which businesses have reached that level of dependency.

The problem is insurance products have not kept up with the changing risks associated with the cyber-age.

Insurers tend to take a traditional view of risk, looking to past results to predict the future. But with fast-changing risks, old product forms may cover more than the insurer imagined. Or they may leave coverage gaps that make business clients vulnerable to major perils--possibly creating problems for agents and eventually for carriers. Either way, today's risks require some changes to today's products and some changes in the way we evaluate exposures.

This brings us to the root question: How do you underwrite exposures that have no precedent, no history? But there is history. As an industry we need to use what we know to determine what we don't yet know.

One way to evaluate e-business risks is along a continuum that involves four major stages: access, presence, integration and e-commerce. Each of these stages presents increasing risks, so it's up to forward-thinking insurers to determine the nature of the exposures at each stage.

These days, virtually all businesses access the Internet for e-mail and Web surfing. In 2000, the "Love Bug"virus showed us what exposures can arise from these seemingly innocuous activities. Additionally, objectionable material is easily accessible and passed around, creating an increased employment-practices liability exposure.

In reviewing an account at the access stage, we might provide advice regarding regular use of updated anti-virus software and having plans to mitigate potential losses arising from virus attacks. We also might suggest development of strict policies on the use of e-mail and the Web to ensure that no objectionable materials are downloaded or distributed on company systems.

The presence stage occurs when the company registers a domain name and establishes a Web site to provide information about itself, its products and services. During this stage, the company may start collecting information from visitors, use "cookies" to track visitors, begin accepting advertising on its Web site and linking to other sites. Exposures may increase for privacy, defamation, copyright, libel and slander, but there would be minimum impact if the Web site was inoperable.

The integration stage--when the company connects with partners, suppliers and vendors but still doesn't sell products or services directly over the Internet--marks an increase in property exposure, since loss of Internet service could result in significant business disruption. Haying contingency plans in the event of loss of Internet service is critical to controlling these exposures.

Finally, in the e-commerce phase where orders are accepted and payment received over the Internet, more careful attention must be paid to both property and liability exposures. Once a company is deriving revenue from its online activities, system availability becomes a critical issue. Hacker or virus attacks that bring down a company's Web site can affect both its top and bottom lines. In addition, increased Web site traffic translates into increased exposure to personal and advertising injury claims.

In determining which risks to write in the e-commerce stage, the wise underwriter would require the business to have a formal contingency plan in the event of an Internet service disruption. The underwriter also would want to know that the company was serious about protecting its systems and information through regular data backups and use of state-of-the-art virus protection and encryption technology. Adequate fire-wall protection and other security practices also should be in place.

On the liability side, the underwriter should evaluate privacy statements to ensure that they contain the required components. They also should determine whether there is a procedure detailed on the Web site for reporting potentially infringing or offensive materials.

Pure Internet companies have their own set of challenges. Underwriters should do their homework online, reviewing the company's Web site to understand the business and the company's plans, as well as determine the appropriate classification for general liability coverage. The Web site should be reviewed periodically to note changes in business model or in operations that could affect exposures. It also is wise for underwriters to carefully review financial records, especially when considering Internet start-up operations, since that sector has been extremely volatile.

Judith A. Blades, a Best's Review columnist, is president of business insurance at The Hartford Financial Services Group, Hartford, Conn.