The Risk Comes Before the Insurance

Start with the organisation.

There is a familiar rhythm to the corporate insurance cycle. In fact, for many organisations, it is almost ritual.

Let us imagine the following scenario:

• The renewal date approaches.
• Internal and external strategy meetings are arranged.
• The declaration process kicks off.
• Information is gathered and values are updated.
• Claims are reviewed.
• Broking submissions are prepared.
• The market is approached.
• Terms are negotiated.
• Terms are presented to the client.
• A programme is renewed.
• Policies are issued.
• Contract certainty is obtained.

This process is sound. It is necessary, and insurance remains an important and useful way to protect a business from potentially significant financial loss.

But here is the question that should come first, because it can fundamentally change the outcome of the entire scenario:

That question changes the conversation.

Because the starting point should not be the insurance policy.

The starting point should be the risks the organisation faces.

Insurance renewal is not a risk review.

A renewal process can be completed efficiently, accurately and professionally, and still leave an organisation with risks it has not properly understood.

That is because a renewal tells us what we are insuring. It does not necessarily tell us whether we have understood everything that could affect the organisation.

The two conversations are related. They are not the same.

Start with the organisation.

Every organisation has objectives.

It has people, processes, systems, assets, suppliers, customers, contractual obligations, capital and reputation.

It also has things that could prevent it from achieving those objectives.

Some of those risks are obvious.

Others are buried within processes, dependencies, contractual arrangements or assumptions that have simply never been challenged.

Effective risk management begins with understanding those risks.

First, identify what could go wrong.

Then evaluate the likelihood and potential consequences.

Then determine what you can do to prevent the event, reduce its likelihood or minimise its impact.

Only then should we ask:

This is where risk transfer, including insurance, comes in.

Insurance is not risk management.

This distinction sounds simple, but it is important.

Insurance is a mechanism for transferring financial consequences. It does not, on its own, make a business resilient.

• A policy cannot prevent a critical supplier from failing.
• It cannot make a poorly designed process work.
• It cannot replace an inadequate control.
• It cannot restore lost management capacity.
• And it cannot remove the consequences of an event that falls outside the scope of cover.

So what is risk financing?

Once an organisation understands its risks, another question emerges:

That is fundamentally a risk financing question.

An organisation can choose to retain a risk and absorb its consequences through its own balance sheet.

It can transfer some or all of the financial consequences to an insurer.

It can combine retention with insurance.

And, where appropriate, it can consider more sophisticated approaches to risk financing and risk transfer.

The critical point is that no universal answer exists.

Different organisations have different financial strength, cash-flow characteristics, risk profiles, loss experience, objectives and capacity to absorb volatility.

The appropriate financing strategy must reflect the organisation itself.

The cost of risk is different from the insurance premium.

This is where businesses can sometimes look at risk too narrowly.

Imagine an organisation paying R10 million for its annual insurance programme.

That R10 million is visible. It appears on a budget. It can be compared. It can be negotiated.

But what about the first R5 million of every loss that the organisation retains?

• What about uninsured losses?
• What about operational disruption?
• What about lost revenue?
• What about contractual penalties?
• What about management time?
• What about the capital required to withstand an unexpected loss?
• What about the volatility created by a poorly structured risk programme?
• And what about the risks that cannot be insured at all?

That is a very different question from simply asking what the insurance costs.

Transfer does not always mean insurance.

Insurance is one of the most established forms of risk transfer.

But it is not the only possible mechanism.

Depending on the organisation and the nature of the exposure, risk financing and transfer can involve different combinations of:

• retained risk;
• deductibles and self-insured layers;
• conventional insurance;
• structured insurance arrangements;
• captives and cell structures;
• parametric solutions;
• contractual risk transfer;
• and other alternative risk-transfer mechanisms.

The objective is not to complicate the risk programme. In fact, quite the opposite.

The objective is to make risk financing more intentional.

Sometimes the correct answer is more insurance.

Sometimes it is less.

Sometimes it is a greater retention supported by stronger controls.

Sometimes an alternative structure makes more sense.

And sometimes the best answer is to eliminate or materially reduce the risk rather than insure it.

The uncomfortable questions.

Good risk management requires questions that are not always comfortable.

• Why are we carrying this risk?
• Why are we transferring it?
• Why is this retention at this level?
• What has changed since the last review?
• What assumptions are we making?
• Which controls are genuinely effective?
• Where are we dependent on a single supplier, system or individual?
• What happens if that dependency fails?
• What risks are sitting between departments rather than within them?
• What happens if our largest loss is materially larger than our largest historical loss?

These questions are not about finding fault with past decisions.

They are about recognising that risk changes as organisations change.

A business today is not necessarily the same business it was when it designed its insurance programme.

• Its revenue may have changed.
• Its supply chain may have changed.
• Its technology may have changed.
• Its contractual obligations may have changed.
• Its geographic exposure may have changed.
• Its risk appetite may have changed.

Yet sometimes the insurance programme remains remarkably similar.

That should at least prompt a question.

From insurance programme to risk-financing strategy.

This shift is increasingly important.

Rather than starting with:

start with:

Insurance may ultimately form a substantial part of the answer.

But it should be an informed decision, not the starting assumption.

That requires an understanding of the organisation beyond its insurance schedule.

It requires an appreciation of its operations, processes, controls, financial capacity, dependencies and objectives.

It requires the ability to distinguish between a risk that should be controlled, a risk that can reasonably be retained and a risk where transferring the financial consequence makes sense.

It also requires an understanding of how those decisions interact.

That is where risk management and risk financing meet.

A different starting point.

This is the thinking behind the Alba approach.

From there, the conversation can broaden into a wider consideration of risk financing — determining how the organisation should fund both the risks it retains and those it chooses to transfer.

Sometimes that will lead to conventional insurance.

Sometimes it will lead somewhere else.

The Alba perspective.

We don't believe that the objective of risk management is to insure everything.

Nor do we believe that retaining risk is automatically better than transferring it.

The objective is to understand the risk well enough to make a deliberate decision about who should carry it, how much should be carried, and how the financial consequences will be managed if the risk materialises.

Because ultimately, the question isn't:

It is: