By Kirk Chamberlain
The hope was that when the American Institute of Architects (AIA) came out with its latest updates to the A201 family of documents, one of the areas of focus would be digital data – such as protocols and best practices for the exchange of information among all the parties involved in the design, build and bid process.
But no material changes were proposed, so cyber security remains an area where contractors must be alert to exposures. Meanwhile, a separate update on the design variation approvals may actually create greater exposure for contractors and their subcontractors.
On the Cyber front, the “old” A201 generally described the cyber issue. The update (now A203) defines the risk. As such, cyber liability remains a serious and growing risk for contractors, design consultants, sub-consultants and all other firms engaged on construction projects. Absent any specific guidance regarding risk allocation under the new A203 Form however, individual parties will need to address and contractually allocate cyber risks as they see fit.
Cybercriminals see a lot of openings in the construction business given the vast number of data exchanges among parties to projects, from architects to owners to contractors, partners, subcontractors, suppliers and regulators. In a 2018 study, over 75% of construction, engineering and infrastructure industry respondents reported experiencing a cyber incident in the previous 12 months. Wire fraud –phishing attacks – are ever present risks, where for example hackers get into email systems via malicious attachments or links, and divert payments by changing bank routing numbers.
Contractors should be concerned and take steps to protect themselves from exposure. Cyber liability insurance in one tool, but engaging a cyber services consulting firm to conduct an internal security audit would be the first critical step. In many cases, simply applying for Cyber insurance requires a “mini-audit” or sorts, as part of the carrier’s initial underwriting process, which may kill two birds with one stone!
The second A201 update worth noting centers on a newly streamlined approval process related to design assist changes arising from means & methods/constructability reviews by the contractor.
These design-assist changes arise routinely because the lead design firm doesn’t typically design every single detail of the project – there are many detailed design aspects where the contractor has latitude to choose the “means and methods” associated with building specific project elements. They may also propose more material design changes due to constructability and/or value engineering considerations. Under the prior A201 Form, any variation in design had to be explicitly approved (or disapproved) by the design firm. Now, no explicit sign-off by the design firm is required.
On the positive side, this can speed up work on projects. However, contractors may now be assuming more than simply “incidental” design exposure in situations where they execute such design variations without the explicit sign-off by the design firm. We see this potential shift in professional liability exposure arising under both Design-Build and Design-Bid-Build contracts.
As such, contractors that already purchase professional liability insurance may want to consider higher limits, and those firms that don’t currently buy professional liability coverage may want to seriously reconsider!
Contact your HUB construction services specialist to find out how you can best protect your business from cyber and professional liability risks.
