Did you know that the first step in taking out cyber risk insurance is to make sure your business has implemented suitable security measures?

In recent years, cyberattacks have increased at an alarming rate. Simply assuming that their business is immune to such threats could turn out to be a business leader’s biggest mistake.

Indeed, any business can fall victim to such threats. A successful scam can not only impact operations and cause significant financial losses—it can also seriously damage business reputation.

A business can nonetheless limit damage by taking out cyber risk insurance. This type of coverage, relatively new to the market, helps mitigate the multiple consequences of a business’s computer systems breach.

Implement the necessary measures

However, to be allowed to purchase insurance that covers cyberattack risks, a business must first implement suitable and effective security measures.

Adopting such measures is necessary: given the explosion of cyberattacks and claims, insurers offering coverage against cyberattack risks no longer commit to insuring vulnerable businesses.

1. Determine the security risks

The first step is to determine what security risks your business is exposed to.

2. Implement core processes

You should then plan and implement basic anti-cyberattack core processes such as:

• identity and access management;
• data and email encryption.

3. Train and raise awareness among employees

It is also important to continuously train your business’s employees to make them aware of IT security risks. This will enable them to adopt the right behaviours and take effective action to avoid attacks or limit the damage. Very often, cybercriminals sneak in through people’s accounts or emails to achieve their objective.

Main types of insurance coverage

Cyber risk insurance may compensate a business for such things as:

• lost income;
• the costs of crisis management and reputational damage;
• the costs of restoring computer equipment disabled by cyberattack;
• data recovery costs;
• cyberextortion ransom payments;
• costs related to damages.

Keep in mind that, as with any insurer’s risk-financing measures, compensation is subject to specific conditions and policy exclusions.

Law 25 and ISO 27001

Businesses may hire external firms to implement cybersecurity solutions. These firms’ expertise offers businesses peace of mind: they know that they are better protected in the event of a cyberattack, and that they meet the security standards and basic criteria for purchasing insurance coverage.

It is worth noting that Law 25, passed last fall by the Québec government, requires businesses to protect the personal information they hold. This new law is inspired by the General Data Protection Regulation, which came into force throughout the European Union in 2018.

ISO 27001 is also proving to be an excellent barometer for identifying potential risks and demonstrating that a business has implemented appropriate measures to manage the security of its information and data.

Of course, all these measures combined cannot guarantee that a business will be fully protected against cyberattacks. Still, the above safeguards greatly reduce the risks and consequences of such attacks. The effectiveness and compliance of the measures you implement will allow your business to take out cyber risk insurance and gain peace of mind.

Deputy Prime Minister and Minister of Finance, Chrystia Freeland, delivered Made-in-Canada Plan (Budget 2023) on March 28, 2023. Budget 2023 is influenced by a range of factors, including tax measures to:

• address the cost-of-living pressures driven by inflation;
• stay competitive in the transition towards a greener economy;
• demonstrate fiscal responsibility after posing massive deficits during the pandemic.

Budget 2023 announces changes to the alternative minimum tax, extends the six-month increase to the GST rebate, and introduces a “grocery rebate”. It also increases spending in areas like health and dental care, and introduces direct support for low-income Canadians, and new programs to boost the clean economy.

Budget 2023 centers around the following three pillars:

People

Budget 2023 announces several measures to support Canadians, including investments in health and child care—such as providing dental care for uninsured Canadians with a family income of less than $90,000 annually, targeted inflation relief, and affordable housing initiatives.

Green economy

Budget 2023 builds on Canada’s transition to a green economy, and introduces various clean-energy programs, partly to compete with new tax breaks and other incentives that were announced in the United States last year.

Labour market

Budget 2023 is focused on strengthening Canada’s labourmarket, and introduces measures to increase skilled trade workers, expand training and innovation programs, and support employee ownership trusts.

In addition, Budget 2023 invests in Canada’s national defense totaling more than $55 billion over 20 years, builds progress towards Indigenous reconciliation, cuts federal travel and reduced outsourcing, and introduces measures to help ensure a fair tax system.

Download our full analysis of Budget 2023 here.

While Europe offers interesting business opportunities, businesses should remember that they may have to pay VAT.

A growing number of Québec businesses are looking to diversify their markets by exporting products or providing services to Europe. The European Union (EU) is considered the world’s second largest economy, providing access to a vast market of over 500 million consumers.

The Comprehensive Economic and Trade Agreement (CETA), signed by 27 EU member states and Canada, exempts most exported products from tariffs. However, businesses still have to pay value added tax (VAT) and fulfil their tax return obligations.

VAT: Somewhat like GST and QST

VAT is applied and invoiced similarly to the Goods and Services Tax (GST) and the Québec Sales Tax (QST) collected by Québec businesses for most goods and services sold in Québec. It is also a consumption tax that is applied differently based on the type of goods and services bought and sold in the EU.

VAT weighs lightly on a business’s finances since, like GST and QST, the end consumer pays it. However, businesses must make sure to calculate the tax amount (in euros), enter it on invoices along with their VAT identification number and then pay it to the country’s tax authorities on time.

Rates: High and variable

Each EU country sets its own rates, based on three categories: standard rate, reduced rate and special rates. The standard rate cannot be lower than 15% and, in practice, hovers around the 20% rate in effect in France.

In Scandinavian and most Eastern European countries, the standard rate is even higher, ranging from 23% to 27%. In Germany, it is slightly lower, at 19%. Reduced rates or additional taxes may also be applied to the provision of specific goods and services (alcohol, energy, costume jewellery, etc.).

An expert’s preliminary analysis can help you determine the impact of EU taxes on your business.

Beware of nasty customs surprises

Québec and Canadian businesses should not overlook the importance of VAT: they risk having their products detained at customs or at the post office if the exporting business has not collected and paid VAT. Consumers may even get the unpleasant surprise of having to pay VAT when they receive their package. Such a situation could very easily break the trust—and even the commercial relationship—between a business and its customers.

What’s more, in France, VAT is the most evaded tax and involves the most common form of tax fraud. It is therefore subject to very strict controls by the French tax authorities. Other EU countries have also raised penalties.

Annual updates required

Some goods and services are exempt from VAT. However, domestic businesses should not assume that since they are not paying GST and QST, they will also be exempt from VAT in EU countries.

Therefore, when companies decide to do business in Europe, it is in their interest to understand the specific rules that apply to VAT. Furthermore, VAT laws are reviewed and amended every year.

As well, businesses selling goods or services liable for VAT in France may be required to appoint a tax representative to carry out their red tape and obligations. They should therefore expect to incur high annual costs.

Given the complexity and diversity of tax obligations, choosing a competent international tax expert could save you a lot of trouble and costly penalties.

This article was written in collaboration with Alexandre Lecomte, tax consultant at Raymond Chabot Grant Thornton.