Data recovery still a major vulnerability in insurance realm.

A lot of attention has been paid to data recovery following the Sept. 11 terrorist attacks, yet it remains a big vulnerability for policyholders and the insurers that sell the business interruption policies to cover those losses, according to a software firm consultant.

"A technology company that sells insurance--that's what the insurance industry has become," said John Sarich, insurance industry marketing manager for FileNet Corp., Costa Mesa, Calif., who has spent 25 years in the industry in a variety of capacities, including consulting, brokering and managing.

While insurers conduct much of their operations electronically, "an incredible amount of information in an insurance company is still paper," Sarich said. One of FileNet's initial services was imaging--turning paper documents into electronic data.

Insurers have paid more attention to disaster recovery for themselves and their policyholders, but there's still a lot "lacking," he said. Generally, larger insurers are further along than smaller firms in terms of protecting themselves, and in their underwriting.

FileNet has about 750 insurance industry customers, who work with FileNet to develop strategies to improve their information technology infrastructure, said Sarich.

Prior to the Sept. 11 attacks, one client, Aon, the broker/reinsurer, called in FileNet because it was interested in workload sharing among its various office locations around the country, he said.

"Disaster recovery wasn't their main concern," Sarich said. Aon had all its electronic data in the World Trade Center, and in the course of building the infrastructure to deal with Aon's workload-sharing issue, FileNet also established data backup centers, so if something disastrous ever happened, "they could recover in a matter of hours," he said.

Six months later, hijackers took out the twin towers. Aon suffered a horrific loss of people, but was able to duplicate all the paper that was lost, he said.

The question of whether a company with an information technology hub in a terrorist target location like New York would be rendered inoperable after a terrorist attack has to be part of an insurers' underwriting criteria, Sarich said.

"If I was writing business interruption, I would be asking questions like, If the 'big one' hits you, how long will it take to set up in another location. The answer to that question would be factored into my rate. Companies with a well-thought out plan would get a better rate," Sarich said.

Insurers have taken action on disaster recovery when it comes to the narrowly focused area of policy administration, and a few other systems, Sarich said, but many insurers are very departmentalized with one IT system for each product. "Homeowners, workers' comp, large commercial, fraud, they all have different systems. It's the history of how this industry has grown over time."

You can find a variety of computer equipment, old computer systems and different generations of software in one insurance company, Sarich said. "That's one of the reasons why companies are looking at outsourcing; they don't want to spend money to convert all this into one system or to train someone to manage this."