Risk Experts / Limits

Insurance is a transfer, not a treatment

It changes who pays. It does not change whether the event occurs.

Registers frequently show a risk as treated because it is insured, which conflates two different things. Insurance addresses financial consequence within the terms of a policy. It does not address operational disruption, reputational effect, regulatory consequence or the time taken to recover, and those are frequently the larger costs.

The policy terms matter more than the existence of cover, and they are rarely read by the people maintaining the register. Exclusions, sub-limits, notification requirements and conditions precedent determine whether a claim will actually respond, and a control that depends on an unread contract is not assured.

The notification requirement in particular is a common failure. Many policies require prompt notice of circumstances that might give rise to a claim, and organisations routinely fail this by deciding internally whether something is serious before telling the insurer.

The register entry that reflects reality reads differently: financial consequence partly transferred subject to policy terms, operational consequence untreated. That is a more accurate description and it usually prompts the work that was being skipped.

The other thing insurance does not transfer is the obligation to have managed the risk. Being insured against a consequence does not discharge a duty to take reasonable care, and in several contexts a failure to do so affects both the legal position and the cover itself. Treating a policy as a substitute for a control is therefore weaker than it appears in more than one direction.