Insurers may have to adjust policies to reflect 'silent' cyber risks

Re: Could it be a box ticking exercise?

“The PRA expects firms to adopt a proportionate approach when assessing their non-affirmative exposures. The firm’s underwriting and risk management functions should play a key role in leading this effort,” it said.

More of a key role than the IT dept?

Seems like box ticking to me.

Re: Could it be a box ticking exercise?

Doubt it: the insurers see a big chance here and also a big stick with which to beat customers

I think you're right. They see the opportunity to hike premiums anyway, and then disallow any claims as (by definition) the IT security wasn't up to scratch.

Fines need to hurt if they're going to have any effect, otherwise such things will just be factored into the cost of doing business.

In most ordinary businesses fines are an exceptional cost of doing business. In financial services fines are a routine operating cost. For both scenarios, fines rarely reduce director and employee incentive rewards, so the problem is that the fines (usually) don't have any impact on those whose behaviour needs to change - and even if they did, they're far too long after the important decisions were taken to have any bearing on the future decision making process.

If fines are to change behaviour, they need to directly affect those who are making decisions or specifically doing something wrong (like mis-selling), and that includes potentially going after people who left the company long ago, who have retired and are now playing the "helpless pensioner" card, and making sure that the internal and external auditors are also clobbered if they didn't identify relevant major risks.