Background
Deschutes Corporate Consulting (DCC) was established in 1999, and is headquartered in Western Oregon. The company provides consulting services to regional corporate clients. These services primarily focus on human resource management and mid-level management consulting.
- INDUSTRY: Consulting
- SPECIFIC: HR & Management Consulting
- ANNUAL GROSS REVENUE: $4 Million
- OWNER STRUCTURE: C-Corp with four owners
- EMPLOYEES: 10
Risk Description
Due to recent news reports regarding phishing scams and malware attacks, the company’s directors are concerned about the security of it’s data systems. The directors understand the enormous economic impact a breach may have on the company, which stores sensitive client data, as well as employee data.
Business Situation
- DCC is a highly profitable company and is concerned about the growing risks of doing business in the modern-day.
- It is currently working on implementing an 831(b) Plan that will be comprehensive in addressing risks such as data breach, business interruption, supply chain interruption, and brand protection.
- Their traditional property and casualty policy covers data breach and includes six specific coverages:
- Notifying the affected customers
- Credit monitoring services for the affected customers
- Rebuilding the facilities reputation
- Investigating the breach
- Legal advice and representation
- Judgments or settlements
- The policy contains exclusions for unencrypted data, employee negligence, failing to keep encryption software updated, and sub-limits on costs incurred to notify customers of a breach.
- The company has implemented encryption systems and has given it’s employees training on best practices to avoid breaches. However, DCC is concerned about the possibility of these precautions failing to prevent a breach, or the possibility the company fails to install a software update.
- DCC is concerned about the sub-limits within the policy regarding client notification costs.
- The company is also concerned they will suffer a loss of income in the event of a data breach, and is unable to purchase traditional coverage for loss of income.
Resolution
- SRA designed an 831(b) Plan that would help recoup loss of income due to a breach
- Loss of income is calculated as an average of the three years prior to a breach for the same period.
- The strategy mitigates the risk of the employee negligence and unencrypted data exclusions on the company’s current policy.
- The strategy addressed the concerns DCC had regarding its policy sub limits.
- Risk was determined as a percent of gross revenue through the company’s point of sale system
The Solution
SRA successfully implemented a strategy that would ultimately protect DCC if a data breach resulted in a loss of income or resulted from employee negligence. SRA also created and now administers an 831(b) Plan with the same ownership structure as DCC. SRA’s program allowed the owners to place money in their 831(b) Plan and utilize tax efficiencies only available through that program
Key Takeaways
BENEFITS TO DESCHUTES CORPORATE CONSULTING & OWNERS
- The program created a source of funds available in the event of a loss of income due to a data breach.
- The strategy filled in gaps in DCC’s current coverage from a traditional carrier’s policy that had exclusions for employee negligence and unencrypted data.
- The company was structured to mirror the ownership of DCC.
- DCC is now better prepared in the event of a data breach.
Get Started